Description

LC Anti-Spam Registration provides comprehensive, multi-layer registration security and automated bot defense for WordPress. It prevents fake user accounts, spam registrations, and credential-stuffing bots from ever polluting your database — without frustrating real human visitors with annoying CAPTCHAs.

Whether you run a WooCommerce store, membership site, LMS portal, online community, or standard WordPress blog, automated bot registrations clog your database, skew conversion analytics, trigger unwanted transactional emails, and introduce severe security vulnerabilities.

LC Anti-Spam Registration operates at the gate: it evaluates registration requests in real time using lightweight behavioral honeypots, human timing algorithms, disposable email detection, and intelligent username pattern heuristics.

🛡️ Core Defensive Capabilities

Invisible Honeypot Trap — Injects invisible fields into registration forms that automated bots inevitably fill out, instantly trapping and discarding malicious attempts without disturbing genuine users.
Human Form-Timing Verification — Measures registration submission velocity. Bots submit forms within milliseconds; human users take time to type. Requests submitted below human speed thresholds are safely denied.
Algorithmic Username & Pattern Scoring — Analyzes username entropy to detect machine-generated bot accounts (e.g. random consonant strings, suspicious character distributions, and algorithmic digit sequences).
Disposable & Temporary Email Defense — Blocks registrations from known temporary inbox providers, throwaway domains, and malformed email patterns.
Registration Rate Limiting & Dynamic IP Firewall — Imposes strict request thresholds per IP address. Bursts of rapid registration attempts are automatically throttled and blocked before server resources are consumed.
Brute-Force Login & Credential-Stuffing Protection — Monitors and mitigates aggressive login probes and dictionary attacks across wp-login.php and registration endpoints.
Retrospective Spam Account Scanner — Deep-scans your existing user database to identify dormant, unverified, or bot-generated accounts registered before plugin activation.
Registration Burst Cohort Review — Identifies coordinated mass-registration attack waves across specific calendar windows. Allows administrators to inspect suspicious cohorts with granular activity metrics before taking action.
Administrator Shield & Role Safelisting — Hardcoded immunity for Administrator and Editor roles, plus a flexible custom safelist to guarantee zero accidental deletions of trusted staff, students, or clients.
Interactive Quick Setup Guide — Step-by-step onboarding tracker directly on the Overview dashboard to arm registration defense, rate limiting, and firewall shields in seconds.
ManageWP & Remote Maintenance Compatibility — Cryptographically verifies signed master requests from remote management tools (such as ManageWP Worker) so automated backups and updates are never falsely rate-limited or blocked.
100% Privacy-First & GDPR Compliant — All security evaluations and detection heuristics run entirely on your local server. Zero external API calls, zero visitor tracking, and built-in integration with WordPress Personal Data Exporter & Eraser tools.
Academic Research Citation — Based on published research: “Algorithmic Mitigation of Asymmetric Bot Registration Attacks and Credential Stuffing in High-Concurrency CMS Ecosystems” (Light & Composition University Academic Journal, Vol. 14, Issue 3, Pages 65–96).

Installation

Upload the lc-anti-spam-registration folder to the /wp-content/plugins/ directory, or install the plugin directly through the WordPress plugins screen.
Activate the plugin through the ‘Plugins’ screen in WordPress.
Navigate to LC Anti-Spam in your WordPress admin menu to review your security status and run your initial database scan.
Customize registration protection thresholds, IP rate limits, and brute-force defenses under the Protection tab if desired.

FAQ

Will it slow down my website?: No. LC Anti-Spam Registration runs entirely in memory with lightweight algorithmic checks and microsecond execution times. There are zero external API calls or third-party DNS dependencies, so registrations and form submissions experience zero noticeable latency.
Does this work with WooCommerce, BuddyPress, and custom registration forms?: Yes. The plugin hooks into standard WordPress user registration flows (registration_errors, register_form, user_register, wp_login), providing automatic defense for WooCommerce, membership portals, and LMS platforms.
How do I monitor blocked bots and flagged accounts?: Navigate to the LC Anti-Spam menu in your WordPress admin dashboard. The Live Overview displays real-time statistics of protected accounts, blocked bots, and flagged accounts ready for review.
Can I customize the spam score sensitivity?: Yes. You can adjust the spam score threshold (Low, Medium, High), rate limiting windows, and brute-force retry counts under the Protection and Spam Scan tabs.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“LC Anti-Spam Registration” is open source software. The following people have contributed to this plugin.

Translate “LC Anti-Spam Registration” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.4.19 (September 14, 2026)

FLAGGED USER EMAIL VISIBILITY & FORENSIC REVIEW — Enhanced the Flagged Accounts review table to ensure administrators can always see and verify user emails before deciding to delete or safelist accounts.
EXPLICIT “EMAIL MISSING” STATUS BADGE — Added a high-contrast warning badge (Email missing) when accounts have no registered email address in WordPress or metadata (e.g. legacy social/Facebook registrations without email scopes), eliminating confusing blank table cells.
WOOCOMMERCE BILLING EMAIL FALLBACK — Added automatic fallback resolution from billing_email in usermeta with a dedicated billing source badge, preventing legitimate store customers from being mischaracterized as email-less accounts.
CLICKABLE EMAIL & USER PROFILE INSPECTION — Formatted valid emails with clickable mailto: links with dashicons and made user display names clickable directly to /wp-admin/user-edit.php for instant forensic inspection.
SENSEI LMS STUDENT & SOCIAL LOGIN DETECTION — Integrated account origin and LMS enrollment tracking (Enrolled (N courses), Social Login) directly into the review tags, protecting active students and social login members from accidental deletion.
RETROSPECTIVE SCAN STUDENT IMMUNITY — Hardened check_existing_user() to exempt active Sensei LMS students and use effective billing emails during scans, eliminating false-positive flags on legitimate members.

1.4.18 (September 14, 2026)

USER CACHE PRIMING COMPATIBILITY — Implemented canonical lcasr_prime_user_caches() cache priming helper, safely delegating to core _prime_user_caches() or falling back to cache_users() and update_meta_cache(). Resolves unhandled fatal error on live WordPress sites during full user directory scans.
SCANNER MEMORY BOUNDING & CHUNK OPTIMIZATION — Replaced monolithic upfront cache priming in scan_all_users() with bounded chunking (100 users per batch) and per-record runtime memory eviction via clean_user_cache(), eliminating memory exhaustion crashes across high-capacity user directories.
AJAX SCAN ERROR HANDLING HARDENING — Wrapped handle_manual_scan() and handle_manual_cleanup() in try / catch (\Throwable) blocks to return structured JSON error payloads, preventing raw HTTP 500 crashes and providing actionable admin notifications.

1.4.17 (September 13, 2026)

IP RATE LIMITING, BRUTE FORCE & DYNAMIC FIREWALL HARDENING (PIPELINE 3) — Completed end-to-end audit and hardening of the request rate limiter, brute-force login monitor, and dynamic IP firewall engine.
CRITICAL BRUTE-FORCE SECURITY LOOPHOLE CLOSED — Closed critical security flaw in handle_failed_login() where brute-force login attacks against administrator accounts were erroneously bypassed from failure counters. Untrusted IPs targeting administrator or regular accounts are now strictly tracked and blocked once the failure threshold is met.
SUCCESSFUL AUTHENTICATION RESET — Added handle_successful_login() hook on wp_login to immediately purge transient failed-login attempts upon valid password entry, eliminating false-positive lockouts from previous typographical errors.
IMMEDIATE 429 RESPONSES ON RATE-LIMIT FLOODS — Updated check_request() to immediately halt execution with HTTP 429 Too Many Requests status when the rate limit is exceeded, preventing abusive traffic from consuming server CPU rendering time.
CRON & CLI EXECUTION SAFEGUARDS — Added execution safeguards to automatically exempt wp_doing_cron() and WP-CLI (WP_CLI) from rate-limiting and blocking.
PUBLIC INSPECTION & UNBLOCK APIS — Converted is_ip_blocked(), block_ip(), and get_client_ip() to public APIs; implemented unblock_ip() and get_blocked_ips() for administrative control and contract test verification.
DUAL HOOK EMISSION & EXEMPTION PARITY — Supported both lcasr_firewall_request_exempt and sad_firewall_request_exempt, and emit both lcasr_ip_blocked/sad_ip_blocked and lcasr_ip_unblocked/sad_ip_unblocked.
AUTOMATED SECURITY EMAIL NOTIFICATION — Added administrative email alert dispatch via wp_mail() when option lcasr_notify_admin_brute_force is active and an attacker is blocked.

1.4.16 (September 13, 2026)

ALGORITHMIC USERNAME ENTROPY & DISPOSABLE EMAIL DEFENSE (PIPELINE 2) — Completed full audit and hardening of the algorithmic username entropy and disposable inbox defense engines.
SHANNON ENTROPY CALCULATION — Implemented calculate_entropy() computing information entropy H(X) in bits per character to mathematically distinguish machine-generated pseudo-random identifiers from genuine human choices.
FALSE-POSITIVE HUMAN COMPOUND ELIMINATION — Fixed critical registration-blocking bug where legitimate human names and compound nouns (christopher, alexsmith, blacksmith, manchester, birmingham, strathmore, williamson) were erroneously denied registration due to broad consonant cluster boundaries. Refined heuristics with natural English trigraph detection (chr, str, tch, cks, mth, nch, ngh, etc.) and tightened vowel scarcity thresholds.
DISPOSABLE EMAIL PROVIDER CATALOG & SUBDOMAIN MATCHING — Added get_disposable_email_domains() providing a comprehensive 40+ provider catalog with filter lcasr_disposable_email_domains and wildcard subdomain defense (*.mailinator.com, etc.).
PRE-REGISTRATION DISPOSABLE EMAIL INTERCEPTION — Added proactive blocking in check_registration_limits() with lcasr_disposable_email_blocked audit action trigger before user records touch the database.
SUSPICIOUS EMAIL STRUCTURE HEURISTICS — Hardened is_suspicious_email_structure() with sub-addressing abuse detection (+temp..., +987654321) and high-risk TLD pattern heuristics with filter lcasr_is_suspicious_email_structure.
PCRE UNAMBIGUOUS CAPTURE GROUPS — Standardized regex backreferences to PCRE \g{1} and \g{2} syntax across doubled-vowel detector routines to eliminate string escape ambiguities across PHP versions.

1.4.15 (September 13, 2026)

REGISTRATION BOT TRAP & BEHAVIORAL TIMING HARDENING (PIPELINE 1) — Fully audited and hardened the registration bot trapping and submission velocity verification engine.
CRYPTOGRAPHIC ANTI-TAMPERING TIMING TOKENS — Injected server-signed verification tokens (wp_hash('lcasr_time_' . $start_time)) alongside registration timestamps to prevent malicious bots from forging past timestamps.
WOOCOMMERCE & MULTISITE PROTECTION PARITY — Extended honeypot injection and human velocity verification hooks to woocommerce_register_form, woocommerce_process_registration_errors, and signup_extra_fields.
ACCESSIBLE HONEYPOT MARKUP — Added hidden accessible <label> markup and filterable honeypot field names (lcasr_honeypot_field_name) for zero screen reader impact and customizable obfuscation.
SCRAPER & HEADLESS BROWSER DETECTION — Expanded automated client blocking to intercept empty User-Agents and modern scraper frameworks (scrapy, aiohttp, headlesschrome) with filterable pattern overrides (lcasr_bot_ua_regex).
THREAT AUDIT ACTION HOOKS — Added lcasr_honeypot_triggered, lcasr_registration_timing_failed, and lcasr_bot_ua_blocked action triggers for threat logging and Pro telemetry integration.
REGISTRATION QUOTA BOUNDING — Capped in-memory registration tracking arrays to 500 items max to guarantee zero database option table bloat under high concurrency.
DUAL BOOTSTRAP COMPATIBILITY HOOKS — Attached both lcasr_base_plugin_ready and sad_base_plugin_ready to guarantee instant synchronization with Pro add-ons and legacy integrations.

1.4.14 (September 13, 2026)

WORDPRESS.ORG COMPLIANCE & PREFIX HARMONIZATION — Systematically refactored all class names, constants, functions, options, AJAX endpoints, and filter/action hooks to the approved 5-character plugin prefix lcasr_ / LCASR_, eliminating the generic 3-character sad_ prefix.
TESTED UP TO 7.1 — Verified and validated compatibility against WordPress 7.1 core standards.
ASSET & NAMESPACE CONSOLIDATION — Renamed core component classes to LCASR_Spam_Detector, LCASR_Spam_Cleaner, LCASR_Firewall, LCASR_Privacy, LCASR_Dashboard_Widget, and LCASR_Admin_Interface.
AJAX & SCRIPT STANDARDIZATION — Updated admin AJAX handlers and localized script object to lcasrAjax with lcasr_admin_nonce.
UPGRADE MIGRATION — Added seamless backward-compatible options migration for existing installations upgrading from previous releases.

1.4.13 (September 8, 2026)

SAFELIST RETRIEVAL QUERY OPTIMIZATION — Added user cache priming (_prime_user_caches()) in get_safelist(), eliminating N+1 database queries when loading safelisted accounts in the admin console.
FLAGGED ACCOUNTS METADATA BATCH PRIMING — Integrated update_meta_cache('user', $page_ids) across paginated slices in get_flagged_accounts(), fetching spam scores, reasons, and marked dates in a single bulk query rather than 60 separate queries per page.
SAFELIST AUDIT NOTIFICATION HOOKS — Added lcasr_user_safelisted and lcasr_user_removed_from_safelist alongside legacy sad_* action hooks for audit trails and activity feeds.
DASHBOARD WIDGET CAPABILITY HARDENING — Restricted widget registration, stylesheet enqueueing, and content rendering strictly to administrators with manage_options capability.
PATH STANDARDIZATION & DOUBLE-SLASH PREVENTION — Standardized asset URLs and filesystem paths to modern LCASR_PLUGIN_DIR / LCASR_PLUGIN_URL with rtrim(), eliminating malformed double-slash asset links.
QUICK SETUP AJAX FAILURE RECOVERY — Added .fail() network error recovery handlers to the interactive Quick Setup checklist toggles, preventing controls from getting trapped in busy state during server disruptions.

1.4.12 (September 8, 2026)

AUTOMATED CLEANUP EXECUTION SAFEGUARDS — Added @set_time_limit(120) and wp_raise_memory_limit('admin') to cleanup_spam_accounts(), preventing script timeouts and memory exhaustion during automated background cron cleanups on large candidate pools.
DUAL STATS TRANSIENT INVALIDATION — Synchronized cache purging to clear both lcasr_cleanup_stats and legacy sad_cleanup_stats on single deletions, batch purges, and manual scans.
ACCOUNT DELETION ACTION HOOKS — Added lcasr_spam_user_deleted and sad_spam_user_deleted notification actions to allow audit loggers and Pro add-on hooks to record user removals.
DUAL CAN-DELETE & ROLE FILTERS — Added modern lcasr_can_delete_user and lcasr_protected_roles filter bridges alongside legacy sad_* hooks in the cleanup candidate pipeline.
SCHEDULED CLEANUP HOOK PARITY — Attached scheduled cleanup handler to both lcasr_cleanup_spam_accounts and legacy sad_cleanup_spam_accounts.

1.4.11 (September 8, 2026)

EMAIL LOGIN BRUTE-FORCE LOCKOUT PREVENTION — Enhanced handle_failed_login() with is_email() check and email-based user resolution, preventing false-positive IP bans when administrators or staff log in using their email address.
SAFELIST LOGIN IMMUNITY — Extended failed login protection to bypass rate-limiting and blocking for users explicitly included in the administrator safelist.
FIREWALL EXEMPTION FILTER PARITY — Upgraded check_request() to evaluate both modern lcasr_firewall_request_exempt and legacy sad_firewall_request_exempt filter hooks.
IP BLOCKING NOTIFICATION HOOKS — Added lcasr_ip_blocked and sad_ip_blocked action triggers upon dynamic IP blocks for integration with live threat analytics.
LOCAL IP FIREWALL BYPASS — Guarded firewall rate-limiting and failed-login transient generation against placeholder 0.0.0.0 addresses, preventing transient bloat and false blocks during local development and CLI testing.
STALE BLOCK PRUNING CONSISTENCY — Fixed timestamp evaluation in block_ip() to prune legacy entries without timestamps, maintaining full parity with is_ip_blocked().

1.4.10 (September 8, 2026)

HONEYPOT ACCESSIBILITY & OBFUSCATION — Enhanced honeypot markup with aria-hidden="true" and multi-technique CSS concealment (position: absolute; left: -9999px; opacity: 0; width: 0; height: 0;), thwarting smart bot evasion while protecting assistive screen readers.
TYPE SAFETY & PROTECTED ROLE DEFENSE — Hardened check_login_attempt() with WP_User instance verification and is_protected_user() checks, preventing PHP runtime errors from third-party auth plugins and guaranteeing administrator/editor immunity.
DUAL ACTION HOOK PARITY — Added lcasr_spam_detected and lcasr_suspicious_login action hooks alongside legacy sad_* equivalents for complete forward compatibility across modern extensions.
EXTENSIBLE COHORT & REGISTRATION FILTERS — Added modern lcasr_* filters for avatar detection, profile content completeness, member activity metrics, and registration rate limits with legacy fallback.
OPTIONS AUTOLOAD & LATENCY RESOLUTION — Explicitly configured autoload = false for large option stores (sad_registration_records, sad_spam_detection_log, sad_spam_training_data), eliminating massive database array bloat from the global alloptions cache and reducing frontend page latency.
LOCAL IP THROTTLING GUARD — Added placeholder 0.0.0.0 exclusion in registration rate limiting to prevent false-positive throttling on CLI environments.
LEGACY USERMETA PARITY — Synchronized sad_markeddate alongside sad_marked_date on new account spam flags to maintain compatibility with legacy third-party readers.

1.4.9 (September 8, 2026)

BOOTSTRAP VERSION SYNCHRONIZATION — Upgraded activation and auto-migration pipelines to synchronize both lcasr_version and legacy sad_version options, preventing stale state fallback.
DEPENDENCY LOADING PATH INTEGRITY — Switched internal dependency require paths to LCASR_PLUGIN_DIR for absolute path safety.
SCHEDULED CRON DEACTIVATION HYGIENE — Added sad_regular_scan to the deactivation hook cleanup loop alongside registration records and account cleanups, preventing orphaned background cron tasks.
EXEMPTION FILTER PARITY — Added modern lcasr_firewall_request_exempt filter alongside legacy sad_firewall_request_exempt for ManageWP and license route exclusions.
PRO COMPATIBILITY INTERFACE MODERNIZATION — Introduced modern lcasr_* functions (lcasr_has_pro_feature, lcasr_is_pro_active, lcasr_pro_upgrade_url, lcasr_render_pro_panel) with dual filter bridges.
UNINSTALL QUERY HARDENING — Extended database transient purge in uninstall.php to clean both _transient_lcasr_% and legacy _transient_sad_% records.

1.4.8 (September 8, 2026)

WORDPRESS.ORG COMPLIANCE & REBRANDING — Renamed plugin display name to “LC Anti-Spam Registration” and slug to lc-anti-spam-registration per WordPress.org review team guidance to eliminate trademark confusion with Google and HUMAN Security’s “Account Defender”.
TEXT DOMAIN & SLUG PARITY — Standardized text domain, translation calls, and internal identifiers strictly to lc-anti-spam-registration.
BACKWARD COMPATIBILITY SURFACE — Preserved backward-compatible class aliases, constants, and hooks (Spam_Account_Defender, SAD_VERSION, sad_base_plugin_ready) to ensure seamless operation with existing add-ons and integrations.

1.4.7 (September 6, 2026)

LATENCY & QUERY OPTIMIZATION — Added 120-second transient caching to get_cleanup_stats() with automatic instant cache invalidation on scans and cleanup actions, eliminating redundant database table queries across admin page loads.
BATCH CACHE PRIMING — Integrated bulk user and usermeta cache priming (_prime_user_caches and update_meta_cache) before candidate verification, resolving N+1 queries and improving review load times by up to 95%.
SCANNER EXECUTION HARDENING — Added dedicated execution time and memory limits in handle_manual_scan() to prevent timeouts during full user directory scans on large sites.
ASSET ISOLATION & HYGIENE — Restricted dashboard widget stylesheet enqueueing strictly to the main WordPress dashboard (index.php), preventing unnecessary asset loading on other admin screens.
DEPRECATED TIMESTAMP MIGRATION — Replaced deprecated current_time('timestamp') calls with time() across detector and logging routines, preventing timezone skew and aligning with modern WordPress core standards.
NAVIGATION & TAB ROBUSTNESS — Hardened admin navigation layout with fallback container rendering for all sidebar tabs, ensuring consistent presentation and zero UI errors across all site configurations.
SCHEDULED CLEANUP RELIABILITY — Harmonized background cron scheduling to ensure safe, reliable automated cleanup runs with enhanced execution safeguards.

1.4.6 (September 6, 2026)

WORDPRESS.ORG COMPLIANCE — Renamed plugin display name to “LC Anti-Spam Registration” and slug to lc-anti-spam-registration to align with the LC plugin ecosystem (like lc-seo-optimizer and lc-smart-media-redirect-cleaner) and eliminate generic naming overlap with other plugins.
SCHEDULED CLEANUP UNRESTRICTED (GUIDELINE 5) — Ensured automated scheduled cleanup in cleanup_spam_accounts() operates with complete functionality and zero restrictions in the core plugin.
PLUGIN HEADER CLEANUP — Removed Tested up to from the main PHP file header to ensure compatibility versions are declared exclusively in readme.txt.
PREFIX STANDARDS — Encapsulated version checking helpers within the core plugin class and eliminated un-prefixed functions from the global namespace.

1.4.5

CANDIDATE QUERY OPTIMIZATION — Eliminated duplicate is_reviewable_spam_user() checks in get_cleanup_candidates(), reducing database queries by up to 4,000 lookups on large batches.
IP REPUTATION SAFETY — Guarded get_registrations_by_ip() and firewall block_ip() against placeholder 0.0.0.0 addresses to prevent false-positive scoring on CLI/local environments.
TIMEOUT HARDENING — Added explicit memory and execution time bounds (@set_time_limit(120) and wp_raise_memory_limit('admin')) in handle_manual_cleanup() and bulk_review_action().

1.4.4 (September 1, 2026)

MEMORY OPTIMIZATION — Streamlined delete_spam_user to batch delete authored posts and comments using lightweight ID arrays with no_found_rows, preventing memory spikes on large user stores.
QUERY HARDENING — Fixed SQL ORDER BY clause in get_review_candidates for complete compliance across strict database engines (MySQL 8.0 ONLY_FULL_GROUP_BY, MariaDB, SQLite).
METRICS ACCURACY — Removed redundant review candidate traversal in get_cleanup_stats() to optimize dashboard rendering latency.
COHORT ACTIVITY ACCURACY — Refined get_user_activity_count() to filter out spam and trashed comments so spam accounts with discarded comments are not falsely shielded.
UNINSTALL COMPLETENESS — Added missing burst-cohort and bot-blocking options to uninstall.php for 100% database cleanup upon plugin removal.

1.4.3

RESEARCH CITATION ALIGNMENT — Updated administrative console Research Journal citation to link directly to the newly published dedicated academic manuscript: “Algorithmic Mitigation of Asymmetric Bot Registration Attacks and Credential Stuffing in High-Concurrency CMS Ecosystems” (Light & Composition University Academic Journal, Vol. 14, Issue 3, Pages 65–96).
Fixed text domain consistency across all admin templates and detector routines (spam-account-defender).
Cleaned and structured readme.txt to full WordPress.org repository specifications.
Enhanced input sanitization and late-escaping across admin AJAX endpoints.
Verified 100% test pass rate with automated contract test suite.

1.4.2

WordPress.org repository compliance: removed off-repo custom updater routines, standardized text domain and slug to spam-account-defender.
Synchronized Tested up to: 7.1, Requires at least: 6.0, and added Contributors: nasruleam, celsiusanderson.
Enhanced PHPCS and strict nonce verification across all admin AJAX actions.
Purged hidden and non-standard development files for clean repository distribution.

1.4.1

Set Plugin URI to the official Dev Lab product portal (/dev/spam-account-defender/).

1.4.0

Security hardening: added strict type checking on login validations and removed legacy unescaped queries.

1.3.9

Accessibility & internationalization audit for WordPress dashboard widgets.