UM design issue with the email “Activation” and “Reset password” links

[MissVeronica]

Expected behavior
Clicking on the “Activation” or “Reset password” links received via email should Activate a new UM Account or make Password reset possible to perform for all UM users without any detailed instructions.

Isolating the problem (mark completed items with an [x]):

• Users have deactivated other plugins and confirmed this bug occurs when only Ultimate Member plugin is active.
• This bug happens with a default WordPress theme active, or UM Theme.
• Many users can reproduce this bug consistently using the steps above.
• Both SMTP and WP-mail have been tested.
• Follow UM documentation: https://docs.ultimatemember.com/article/1518-password-reset-doesnt-work
• UM version 2.1.20

Examples from UM support forum during last week and a lot of hard work for the Thread Starters:
https://wordpress.org/support/topic/password-102/
https://wordpress.org/support/topic/this-activation-link-is-expired-or-have-already-been-used-5/

Describe the bug
There is an UM design issue with these “Activation” and “Reset password” links because many email clients do a pre-fetch of the link when the email is opened by the user and this pre-fetch makes the link invalid/old/used when the user clicks the link.
Other software like firewall/anti-virus/anti-malware might also do pre-fetches for analytical purposes without any user actively triggering it.

A rule from the direct mail community is:

Links (HTTP GETs) aren’t supposed to “do” anything, only a HTTP POST is. For example, your “unsubscribe me” link in your email should not directly unsubscribe the subscriber. It should “HTTP GET” a page the subscriber can then HTTP POST from.

UM is sending "Activation" and "Password reset" links which are HTTP GETs .
Hiding the link behind a HTML like "button" is no solution and HTTP POSTs are rarely supported by email clients.

To Reproduce
Steps to reproduce the behavior:

1. Create an UM account with email account activation set to true.
2. Use an email client web based or Outlook 365, Gmail, temp-mail
3. Click the Link in the email
4. In many cases with the result "This activation link is expired or have already been used"

Microsoft and Google pre-fetch examples
Pre-fetch or link preview can be turned off in Outlook but this feature is on as default and turning off for users signing up for an UM driven site is NOT a solution.
https://support.microsoft.com/en-us/office/use-link-preview-in-outlook-com-and-outlook-on-the-web-ebbfd8ce-d38e-40ef-bb8c-a5362e881163

Click-time link protections in third-party email clients by Google: https://support.google.com/mail/answer/10173182?hl=en

For these users, clicking a link in a recent message starts a malicious link check. If nothing malicious is detected, the user is taken to the destination.

Expected behavior/solutions

Today:
Add an attribute to the email templates both UM original and user modified with one-time-only links rel="nofollow" if not already done by a clever user.
Looks like in this example: .... letter-spacing: 0.3px;" rel="nofollow" href="{password_reset_link}"> ....
Hopefully some email clients will follow the attribute but they may also dismiss it.
Review other UM email templates for this attribute addon.

Short term:
Replace current strategy and create an UM intermediate landing page from the email link requiring the user to confirm their Activation/Password reset request with a HTTP POST, Review all email templates for the new setup.

[MissVeronica]

UM Support history

The error message “This activation link is expired or have already been used.” has been reported in the UM Support Forum for the last 4 years and if any reply by an UM developer the standard questions about "any caching" and "plugin/theme conflicts".

Some Thread Starters are close to the issue with email clients pre-fetches but are being ignored by the UM developers.

https://wordpress.org/support/topic/this-activation-link-is-expired-or-have-already-been-used-4/

https://wordpress.org/support/topic/this-activation-link-is-expired-or-have-already-been-used-3/

https://wordpress.org/support/topic/this-activation-link-is-expired-or-have-already-been-used-2/

https://wordpress.org/support/topic/activation-error-this-activation-link-is-expired-or-have-already-been-used/

3 years, 8 months ago:
UM email activation- This activation link is expired or have already been used.

https://wordpress.org/support/topic/um-email-activation-this-activation-link-is-expired-or-have-already-been-used/

Thread Starter:

.... before clicking on the activation link, email provider do some security action and visit all the links in the email to check them, so when the user clicks on the activation link, it consider the second time not the first time and thats why he receive this message” This activation link is expired or have already been used.”

UM Developer reply:

Do you have any caching plugins or server side caching active on your site?
Please exclude Ultimate member pages from the cache and see if this helps.
You can also try to do a quick conflict test and try to reset Ultimate member -> Settings -> Emails section.

[MissVeronica]

Today one additional user having this UM design issue with an email Activation link:

https://wordpress.org/support/topic/members-get-a-this-activation-link-is-expired-error-when-verifying/#post-14517437

[AnaStepic]

I'm having the same issue. Outlook visits the links even if they are set to rel="nofollow", which results in the "This activation link is expired or have already been used." error for activation every time.

[MissVeronica]

In Outlook you can temporarily turn off Link preview:

https://support.microsoft.com/en-us/office/use-link-preview-in-outlook-com-and-outlook-on-the-web-ebbfd8ce-d38e-40ef-bb8c-a5362e881163

At the top of the page, select Settings > View all Outlook settings.

In the Settings pane, select Mail > Compose and reply.

Scroll down to Link preview.

Under Link preview, clear the Preview links in email check box to turn off Link Preview.

[MissVeronica]

A quick fix for this issue:

https://github.com/MissVeronica/um-landing-page-for-email-links

[MissVeronica]

Support Forum post "The activation link is expired"

https://wordpress.org/support/topic/the-activation-link-is-expired/

[MissVeronica]

Support Forum post "Activation Link Expired (E-Mail Anti-Virus)"

https://wordpress.org/support/topic/activation-link-expired-e-mail-anti-virus/

[Graphnic]

I am also having this problem on a couple of sites.

It seems to happen quite commonly amongst users on corporate email accounts so the explanation that the email client is prefetching/scanning the links makes perfect sense. The solution suggested of having an intermediary page also makes a lot of sense.

Is there any progress on this bug as I can't think of a way to work around it? It seems to be referenced in a number of forums, so one would assume it is quite commonplace amongst other users of this feature.

[Graphnic]

Hey @ultimatemember, @champsupertramp, could the approach adopted here https://github.com/MissVeronica/um-landing-page-for-email-links by @MissVeronica be integrated into core? I discovered today that Office 365's 'safe links' feature appears to be following the link automatically before the user sees the email. I am concerned it may also be activating the account too, although it's difficult to test without access to an Office 365 account.

If this is indeed the case, there is a potential data security/privacy risk. For example, if the activation feature is being used as a safeguard against a user registering for an account under someone else's email ID, then access could be granted automatically via the the malware scanner triggering the activation link without their consent. This could be a problem where additional pre-existing personal data is loaded into a WordPress account on login via a CRM integration based on the email address of the user.

[MissVeronica]

The quick fix for this issue has been updated to version 3 now supporting both pre UM 2.5.0 and UM 2.5.0:

https://github.com/MissVeronica/um-landing-page-for-email-links

UM 2.5.0 release notes Fixed:
Password Reset process via Ultimate Member - Password Reset form. Reset password links' arguments changed to the same view as WordPress native has. Password Reset is available for the same cases as native WordPress Password Reset has

[Graphnic]

Hey @ultimatemember, @champsupertramp this still seems to be a problem with some emails hosts - namely Office365. Is the additional plugin by @MissVeronica still the only solution?