Why do new users need to click an extra button to Activate their account?

Product Support

AI-generated summary

A new Discourse community member questioned why users must click an extra button to activate their account after receiving an email, suggesting the URL load itself should activate the account. mcwumbly raised this as a usability concern, seeking ways to streamline onboarding. codinghorror explained the activation step is a critical anti-spam measure: allowing automatic activation via URL would enable spammers to create thousands of accounts using scripts (e.g., curl), especially since modern spammers are often human and bypass CAPTCHAs. He also noted that clicking a button is a minimal barrier. watchmanmonitor humorously referenced a related feature — copying invite links — and linked to a feature request for admins to edit user names, implying that while activation can’t be skipped, other UX improvements could make onboarding smoother. The core tension is balancing user convenience against security: eliminating the extra click risks enabling mass spam account creation, which would degrade community quality. The discussion reflects broader Discourse philosophy — prioritize trust and safety over marginal UX gains, especially when automation and human spam are prevalent threats.

1

Testing out discourse with a new community and got this feedback from one member.

Is there any way to eliminate the need for having to activating your account via email in order to use the site? i.e. create your and account and immediately be able to interact with the site. Or, allow the loading of the URL in the email to act as the activation rather than requiring an additional click on a dummy page?

I feel like there must be a topic on here somewhere with similar discussion, but haven’t found anything yet. Regardless, what do people think about this? Particularly the last idea:

allow the loading of the URL in the email to act as the activation rather than requiring an additional click on a dummy page?

2

It is an anti spam / auto account creation protection.

If you can activate by just retrieving the link, auto creation of accounts becomes trivial at the command line. Send 500 email activations, loop through them with curl, bam, you have 500 new accounts to spam with.

(Reminder, most spammers are 100% human these days so captcha does nothing. Say hello to our leetle friend bamwar for example, huge problems with these insanely persistent humans on many Discourse sites)

Also the premise of the question is a bit weird, clicking one button in the browser is “too long”?

3

You mean, this little beauty?

it’s a true gem! :gem:

Now we just to be able to edit their name from admin, and setting up a new user account will be pretty darn efficient