I need this because it makes life a bit more difficult for 'professional' spammers who just change their emails after logging in, so that the can use that very email for the next registration, after being blocked.

Appreciate your hints.

3 Answers 3


You can either force users to confirm email change or protect the email field from changes. Both modules have D6/7 versions. Second module can lock password and some other fields as well.

  • Great, as usual Drupal community offers more than you expect. That's partly why I love Drupal. Thanks mate.
    – alfish
    Sep 6, 2012 at 21:30
  • I prefered 'email confirm' as a better solution but for some reason it did not install, neither through GUI nor drush. Any ideas?
    – alfish
    Sep 7, 2012 at 0:32

There is a new module which is made to handle this situation perfectly.

The module User Account Permissions add the following new permissions for user accounts:

  1. edit own user account
  2. edit own email address
  3. edit other user's email address
  4. change own password
  5. change other user's password

Or try to use Field Permissions module (D6 or D7). set custom permission to allow create but disallow to edit own field..

  • I don't think that works for the e-mail address, it doesn't show up in the field list to be edited like other fields.
    – UltraBob
    Sep 9, 2016 at 7:57
  • 1
    The module Field Permissions works fine with Drupal 8 but you could hide only custom fields. User protectworks fin on D8 to hide user name, email, etc. Oct 4, 2017 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.