Release status: stable
|Description||Block signups using disposable or invalid email addresses|
|Latest version||1.2.0 (2020-09-28)|
|Compatibility policy||Master maintains backward compatibility.|
|License||GNU General Public License 3.0 or later|
|Download||Download latest version|
|Issues||Open issues · Report a bug|
The Debounce extension integrates with the debounce.io API to check whether email addresses are disposable or otherwise invalid for registration. Both the free disposable email API as well as the paid email validation API are available. By default, this uses the free API.
- Download and place the file(s) in a directory called
- Add the following code at the bottom of your LocalSettings.php:
wfLoadExtension( 'Debounce' );
- Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.
It is recommended that you "follow" the extension on mwusers.org so that you can be notified by email about any updates.
- $wgDebounceApiKey (string)
- If you are using the paid email validation API, set this to your API key. Enabling the paid API but forgetting to set this will cause errors upon registration until it is configured.
- $wgDebounceFree (boolean, default true)
- If true, uses Debounce's free disposable email API. This API only checks whether or not the email domain is associated with a disposable email address provider. If the user is using a disposable email address, their registration will be denied. If false, uses Debounce's paid email validation API. This API performs a number of additional checks, and will only allow registration if the user's email address is considered to be safe for transactional email.
- $wgDebouncePrivate (boolean, default true)
- If using the free disposable email API, this will obscure the user's email address before it is sent to the Debounce service by replacing the address portion with "example." For example, if the user registered using the email address "firstname.lastname@example.org" and private mode was enabled, the debounce API would be sent the address "email@example.com." If using the paid email validation API, this configuration setting has no effect.
When using the free disposable email address API, a "private mode" can be enabled which only sends the domain of the user's email address to Debounce instead of the entire email address. The private mode is not available when using the paid API, as the paid API does additional checks on the address portion of the email which could case false positives or false negatives if it was obscured before sending over.