I run a drupal / civicrm build for a non-profit. We are very careful with our members information, and want to make sure that no one trying to, would be able to figure out if someone they knew was a registered user.

The problem we have is when someone goes to create a new user account, if they use an e-mail that is already on our site, they get an error message saying that they can't use that e-mail because it's already registered on the site.

There are plenty of people - bosses, spouses, etc who could be testing an e-mail address to see if someone they know is on our site, and this error message pretty much confirms it.

Is it possible to change the error message to something else? We have the e-mail confirmation enabled, why can't it say, "An e-mail has been sent to [email protected] with your login information?"

1 Answer 1


You can do a couple of things. One, I would advise installing the Username Enumeration Prevention module:


This will stop forgot password form abuse.

Secondly, hiding this fact on the registration side is hard. You can't have duplicate email or usernames in Drupal (not easily), and if you get an error on that then it is pretty apparent it is already in use. Giving a vague error here could also confuse actual users who are trying to register.

  • I get why drupal makes it hard to edit the error messages - to keep people from writing some confusing message. But I don't think it would be that hard for drupal to have an error message that prevents that kind of 'snooping'. Something like, "We've sent a confirmation message to xyz e-mail, if that is not your e-mail address or you did not receive the e-mail, please click here to create a new account with your correct e-mail address.' Sep 6, 2016 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.