I want to use the user registration page to collect user data and use its email verification checking to filter out fake users. But the thing is I don't want these users to be able to login to the site. How can this be done in Drupal 7?

Note: So no login at all. I just want to use the registration system to send them an email to verify their account.

  • 1
    Does selecting Visitors, but administrator approval is required option on /admin/config/people/accounts page work for you? Mar 17, 2016 at 23:12
  • 2
    If users don't verify their email address, when the Visitors, but administrator approval is required option is select, they cannot login in the site. Did you have something else in mind?
    – apaderno
    Mar 18, 2016 at 6:18
  • You don't want them to login at all, even after verification?
    – No Sssweat
    Mar 18, 2016 at 12:03
  • yea no login at all. I just wanted to use the registration system to send them an email to verify their account. Mar 18, 2016 at 15:21
  • you didn't select best answer as final answer !!!
    – Yuseferi
    May 28, 2016 at 7:51

4 Answers 4


Question refinement

This is a pretty tricky question, especially the "... no login at all ..." part of it. IMO you have to allow at least somebody with some specific role to perform a login ... If you don't, then even an admin (or user/1) cannot login. Which also implies you can't just deny access to the login URL for everybody (how else would an admin perform a login?).

Proposed solution

Below is a solution to "kick everybody (except admins) out right after login, but only after you send such user an appropriate eMail".

Here is the rule (in Rules import format) that should answer your question:

{ "rules_redirect_to_logout_except_for_role_id3" : {
    "LABEL" : "Redirect to logout except for role ID3",
    "PLUGIN" : "reaction rule",
    "ACTIVE" : false,
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "user_login" : [] },
    "IF" : [
      { "NOT user_has_role" : { "account" : [ "account" ], "roles" : { "value" : { "3" : "3" } } } }
    "DO" : [
      { "mail" : {
          "to" : "[account:mail]",
          "subject" : "No login allowed",
          "message" : "You just completed a login to [site:name], located at [site:url].\r\n\r\nHowever, at this time we do not allow any login ...\r\n\r\nThanks anyway for validating some of your account data, such as your eMail ID.",
          "language" : [ "" ]
      { "redirect" : { "url" : "user\/logout" } }

The rule will be triggered (Rules Condition) right after login was completed. For any user who does not have the role that matches "role id = 3" (= Rules Condition), aka for any user who is not an administrator, it will perform these Rules Actions (in the order specified):

  1. Send an appropriate eMail to the user that completed the login (since the user is logged in, you have the user's eMail Id available as part of the user's account info).
  2. Redirect to the page user/logout (= force the user to be logged out again).

If you have the Rules UI enabled, you can just import the above rule and adapt the value (=3) of the role id to fit your needs. With that you solved your question.

Obviously, you'd have to adapt the eMail subject and content to fit your needs. Possibly you may also want to use some other (or additional) role IDs that you want to allow to login anyhow.

With the above approach, all what's left to do to fully answer your question, is to create an inventory (a view?) of all users and check their last login date. Those accounts that were created X hours/days ago but for which no login was completed ever, are the fake users you're looking for (because the eMail ID they entered during registration was invalid, or such users didn't really want to get registered so they never confirmed their registration request via an appropriate, temporary, login).

Note: by default the rule is disabled (so don't forget to enable it also).


You could use Rules

Event: After saving a new account

Action: Block a user >> data selector: account


The Easiest way to do this is, go to admin/config/people/accounts and choose Visitors, but administrator approval is required and save.
by selecting this option user can register on site and by default they status set to blocked and if admin approve them , they can log in to site otherwise they can not login site(block user can not login to site). There is not need any additional Rules or Code.


Add a validation hook to your login form and make it fail.

 * Implementation of hook_form_alter().
function YOUR_MODULE_form_alter(&$form, $form_state, $form_id) {
    if ($form_id == 'user_login') {
       array_unshift($form['#validate'], 'YOUR_MODULE_login_form_validate');

function YOUR_MODULE_login_form_validate($form, $form_state) {
    form_set_error('','Your user is not enabled to login');

This can be useful to you

  • Hi gbalduzzi, welcome. Please try not to post link only answers, as links can go down over time. Better is to include the essential part of the answer here and provide a link for further reference. Could you edit your post? May 23, 2016 at 10:40
  • of course i will, but i considered the essiental part of my answer "Add a validation hook to your login form and make it fails"
    – gbalduzzi
    May 23, 2016 at 10:49
  • That may be true, but like this, the meaning of those words is more clear to the OP and future readers. Thanks for editing :) May 23, 2016 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.