Add email-based accounts to a PHP app

Create users, verification tokens, password resets, timestamps and revocation semantics.

Use PHP password hashing, CSRF and session regeneration with rate-limited login.

Choose an email API with suitable sender-domain authentication.

Use single-use expiring tokens; never treat an unverified recipient as owning the account.

Define retention, deletion, recovery and incident responses before launch.