Can an uninvited person RSVP to my wedding website?
On most open platforms, yes. If your wedding website is publicly accessible — or if the URL is shared beyond your invited list — anyone can submit an RSVP on most major platforms. No verification, no cross-reference against your guest list, no check that the person submitting is someone you invited.
Why this is possible
Most wedding website RSVP forms work the same way: a guest visits the URL, types their first and last name, and submits their response. The platform records the submission. That is the entire flow.
There is no step where the platform checks whether the name matches someone on your guest list. There is no email verification. There is no confirmation that the person typing the name is the person you invited. The RSVP form is effectively open to anyone who reaches it.
On a public site — one indexed by Google — anyone who searches for your names can find the URL, navigate to the RSVP page, and submit a response. On a password-protected site, anyone who knows or guesses the password can do the same.
The documented vulnerability in The Knot's RSVP
In 2021, a security researcher published a report documenting a business logic flaw in The Knot's RSVP system. The findings included the ability to:
- ·Accept or decline an RSVP on behalf of another person by entering their name
- ·Access custom fields and notes left by invited guests
- ·Enumerate the full guest list if the site had "Guest List Visibility" enabled
- ·Submit RSVPs for people you were not — with no notification to the couple or the real guest
The root cause was architectural, not incidental: the RSVP system was not designed with access control. It was designed for convenience — type a name, get in. The assumption was that only invited guests would find the URL. That assumption does not hold on a public or password-forwarded site.
The real-world consequence
Uninvited RSVPs create practical problems:
- ·Your headcount is wrong — you plan and pay for a number that does not reflect reality
- ·Your caterer, venue, and seating chart are based on inaccurate data
- ·Someone you deliberately did not invite may appear on your confirmed guest list
- ·A real guest may find their RSVP already submitted — by someone else — when they try to respond
What actually prevents this
There are two structural approaches:
A closed guest list
Before the RSVP form is shown, the platform checks the name entered against an uploaded guest list. If the name does not match, the form does not proceed. This is more effective than a password alone, because it means knowing the site URL is not sufficient to submit a response — you also need to be on the list.
Email verification before the RSVP
Requiring guests to verify a specific email address before they can access the RSVP form closes the impersonation gap. Even if someone knows an invited guest's name, they cannot complete verification unless they also control that guest's inbox.
Per-guest plus-one limits
Even with a verified guest list, a global “plus-ones allowed: yes/no” toggle lets guests interpret that however they want. Per-guest limits — where each individual is permitted a specific number of additional attendees — prevent the common problem of one guest RSVPing for three extras.
Note on The Knot's current state: The 2021 research report was published publicly, and some of the specific vulnerabilities described may have been addressed since then. However, the underlying design question — whether the platform verifies identity before accepting an RSVP — is structural. Check your specific platform's current behavior before relying on it for a closed guest list.
Veil's RSVP is never open.
Guests verify their email via OTP before they ever see your site — let alone an RSVP form. Per-guest plus-one limits are set in your admin dashboard per individual, not as a global toggle. Uninvited RSVPs are architecturally prevented, not just discouraged.
Configure your site →