Extension:Debounce

MediaWiki extensions manual

Debounce Release status: stable
Implementation	User identity
Description	Block signups using disposable or invalid email addresses
Author(s)	Skizzerztalk
Latest version	1.2.0 (2020-09-28)
Compatibility policy	Master maintains backward compatibility.
MediaWiki	1.34+
License	GNU General Public License 3.0 or later
Download	Download latest version
Parameters $wgDebounceApiKey $wgDebounceFree $wgDebouncePrivate
Hooks used isValidEmailAddr
Issues	Open issues · Report a bug

The Debounce extension integrates with the debounce.io API to check whether email addresses are disposable or otherwise invalid for registration. Both the free disposable email API as well as the paid email validation API are available. By default, this uses the free API.

Installation

• Download and place the file(s) in a directory called Debounce in your extensions/ folder.
• Add the following code at the bottom of your LocalSettings.php file:

  wfLoadExtension( 'Debounce' );
  

•  Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

It is recommended that you "follow" the extension on mwusers.org so that you can be notified by email about any updates.

Configuration

$wgDebounceApiKey (string)

If you are using the paid email validation API, set this to your API key. Enabling the paid API but forgetting to set this will cause errors upon registration until it is configured.

$wgDebounceFree (boolean, default true)

If true, uses Debounce's free disposable email API. This API only checks whether or not the email domain is associated with a disposable email address provider. If the user is using a disposable email address, their registration will be denied. If false, uses Debounce's paid email validation API. This API performs a number of additional checks, and will only allow registration if the user's email address is considered to be safe for transactional email.

$wgDebouncePrivate (boolean, default true)

If using the free disposable email API, this will obscure the user's email address before it is sent to the Debounce service by replacing the address portion with "example." For example, if the user registered using the email address "john.doe@mwusers.org" and private mode was enabled, the debounce API would be sent the address "example@mwusers.org." If using the paid email validation API, this configuration setting has no effect.

GDPR Considerations

You should notify your users that you are making use of Debounce for validating email addresses during registration in your privacy policy, meaning that the email address the user submits during registration will be sent to them. Debounce's privacy policy is available at https://debounce.io/privacy-policy/ and Data Processing Agreements are available with them upon request. Please contact Debounce directly to sign a DPA, and not the extension authors or maintainers; the extension authors and maintainers are not sent any email addresses and are not data processors. See Debounce's GDPR page for more information on their GDPR compliance policies.

When using the free disposable email address API, a "private mode" can be enabled which only sends the domain of the user's email address to Debounce instead of the entire email address. The private mode is not available when using the paid API, as the paid API does additional checks on the address portion of the email which could case false positives or false negatives if it was obscured before sending over.

Support

For free community support, please make use of the extension's talk page on mediawiki.org or by posting a new forum thread on mwusers.org. Paid support plans are available on mwusers.org.