Title: LC Anti-Spam Registration
Author: Celsius Anderson
Published: <strong>September 16, 2026</strong>
Last modified: September 16, 2026

---

Search plugins

![](https://ps.w.org/lc-anti-spam-registration/assets/banner-772x250.png?rev=3698567)

![](https://ps.w.org/lc-anti-spam-registration/assets/icon-256x256.png?rev=3698567)

# LC Anti-Spam Registration

 By [Celsius Anderson](https://profiles.wordpress.org/celsiusanderson/)

[Download](https://downloads.wordpress.org/plugin/lc-anti-spam-registration.1.4.19.zip)

 * [Details](https://wordpress.org/plugins/lc-anti-spam-registration/#description)
 * [Reviews](https://wordpress.org/plugins/lc-anti-spam-registration/#reviews)
 *  [Installation](https://wordpress.org/plugins/lc-anti-spam-registration/#installation)
 * [Development](https://wordpress.org/plugins/lc-anti-spam-registration/#developers)

 [Support](https://wordpress.org/support/plugin/lc-anti-spam-registration/)

## Description

**LC Anti-Spam Registration** provides comprehensive, multi-layer registration security
and automated bot defense for WordPress. It prevents fake user accounts, spam registrations,
and credential-stuffing bots from ever polluting your database — without frustrating
real human visitors with annoying CAPTCHAs.

Whether you run a WooCommerce store, membership site, LMS portal, online community,
or standard WordPress blog, automated bot registrations clog your database, skew
conversion analytics, trigger unwanted transactional emails, and introduce severe
security vulnerabilities.

LC Anti-Spam Registration operates at the gate: it evaluates registration requests
in real time using lightweight behavioral honeypots, human timing algorithms, disposable
email detection, and intelligent username pattern heuristics.

### 🛡️ Core Defensive Capabilities

 * **Invisible Honeypot Trap** — Injects invisible fields into registration forms
   that automated bots inevitably fill out, instantly trapping and discarding malicious
   attempts without disturbing genuine users.
 * **Human Form-Timing Verification** — Measures registration submission velocity.
   Bots submit forms within milliseconds; human users take time to type. Requests
   submitted below human speed thresholds are safely denied.
 * **Algorithmic Username & Pattern Scoring** — Analyzes username entropy to detect
   machine-generated bot accounts (e.g. random consonant strings, suspicious character
   distributions, and algorithmic digit sequences).
 * **Disposable & Temporary Email Defense** — Blocks registrations from known temporary
   inbox providers, throwaway domains, and malformed email patterns.
 * **Registration Rate Limiting & Dynamic IP Firewall** — Imposes strict request
   thresholds per IP address. Bursts of rapid registration attempts are automatically
   throttled and blocked before server resources are consumed.
 * **Brute-Force Login & Credential-Stuffing Protection** — Monitors and mitigates
   aggressive login probes and dictionary attacks across `wp-login.php` and registration
   endpoints.
 * **Retrospective Spam Account Scanner** — Deep-scans your existing user database
   to identify dormant, unverified, or bot-generated accounts registered before 
   plugin activation.
 * **Registration Burst Cohort Review** — Identifies coordinated mass-registration
   attack waves across specific calendar windows. Allows administrators to inspect
   suspicious cohorts with granular activity metrics before taking action.
 * **Administrator Shield & Role Safelisting** — Hardcoded immunity for Administrator
   and Editor roles, plus a flexible custom safelist to guarantee zero accidental
   deletions of trusted staff, students, or clients.
 * **Interactive Quick Setup Guide** — Step-by-step onboarding tracker directly 
   on the Overview dashboard to arm registration defense, rate limiting, and firewall
   shields in seconds.
 * **ManageWP & Remote Maintenance Compatibility** — Cryptographically verifies 
   signed master requests from remote management tools (such as ManageWP Worker)
   so automated backups and updates are never falsely rate-limited or blocked.
 * **100% Privacy-First & GDPR Compliant** — All security evaluations and detection
   heuristics run entirely on your local server. Zero external API calls, zero visitor
   tracking, and built-in integration with WordPress Personal Data Exporter & Eraser
   tools.
 * **Academic Research Citation** — Based on published research: _“Algorithmic Mitigation
   of Asymmetric Bot Registration Attacks and Credential Stuffing in High-Concurrency
   CMS Ecosystems”_ (_Light & Composition University Academic Journal_, Vol. 14,
   Issue 3, Pages 65–96).

## Installation

 1. Upload the `lc-anti-spam-registration` folder to the `/wp-content/plugins/` directory,
    or install the plugin directly through the WordPress plugins screen.
 2. Activate the plugin through the ‘Plugins’ screen in WordPress.
 3. Navigate to **LC Anti-Spam** in your WordPress admin menu to review your security
    status and run your initial database scan.
 4. Customize registration protection thresholds, IP rate limits, and brute-force defenses
    under the **Protection** tab if desired.

## FAQ

### Will it slow down my website?

No. LC Anti-Spam Registration runs entirely in memory with lightweight algorithmic
checks and microsecond execution times. There are zero external API calls or third-
party DNS dependencies, so registrations and form submissions experience zero noticeable
latency.

### Does this work with WooCommerce, BuddyPress, and custom registration forms?

Yes. The plugin hooks into standard WordPress user registration flows (`registration_errors`,`
register_form`, `user_register`, `wp_login`), providing automatic defense for WooCommerce,
membership portals, and LMS platforms.

### How do I monitor blocked bots and flagged accounts?

Navigate to the **LC Anti-Spam** menu in your WordPress admin dashboard. The Live
Overview displays real-time statistics of protected accounts, blocked bots, and 
flagged accounts ready for review.

### Can I customize the spam score sensitivity?

Yes. You can adjust the spam score threshold (Low, Medium, High), rate limiting 
windows, and brute-force retry counts under the **Protection** and **Spam Scan**
tabs.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“LC Anti-Spam Registration” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ Celsius Anderson ](https://profiles.wordpress.org/celsiusanderson/)
 *   [ Nasrul Eam ](https://profiles.wordpress.org/nasruleam/)

[Translate “LC Anti-Spam Registration” into your language.](https://translate.wordpress.org/projects/wp-plugins/lc-anti-spam-registration)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/lc-anti-spam-registration/),
check out the [SVN repository](https://plugins.svn.wordpress.org/lc-anti-spam-registration/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/lc-anti-spam-registration/)
by [RSS](https://plugins.trac.wordpress.org/log/lc-anti-spam-registration/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.4.19 (September 14, 2026)

 * FLAGGED USER EMAIL VISIBILITY & FORENSIC REVIEW — Enhanced the Flagged Accounts
   review table to ensure administrators can always see and verify user emails before
   deciding to delete or safelist accounts.
 * EXPLICIT “EMAIL MISSING” STATUS BADGE — Added a high-contrast warning badge (`
   Email missing`) when accounts have no registered email address in WordPress or
   metadata (e.g. legacy social/Facebook registrations without email scopes), eliminating
   confusing blank table cells.
 * WOOCOMMERCE BILLING EMAIL FALLBACK — Added automatic fallback resolution from`
   billing_email` in usermeta with a dedicated `billing` source badge, preventing
   legitimate store customers from being mischaracterized as email-less accounts.
 * CLICKABLE EMAIL & USER PROFILE INSPECTION — Formatted valid emails with clickable`
   mailto:` links with dashicons and made user display names clickable directly 
   to `/wp-admin/user-edit.php` for instant forensic inspection.
 * SENSEI LMS STUDENT & SOCIAL LOGIN DETECTION — Integrated account origin and LMS
   enrollment tracking (`Enrolled (N courses)`, `Social Login`) directly into the
   review tags, protecting active students and social login members from accidental
   deletion.
 * RETROSPECTIVE SCAN STUDENT IMMUNITY — Hardened `check_existing_user()` to exempt
   active Sensei LMS students and use effective billing emails during scans, eliminating
   false-positive flags on legitimate members.

#### 1.4.18 (September 14, 2026)

 * USER CACHE PRIMING COMPATIBILITY — Implemented canonical `lcasr_prime_user_caches()`
   cache priming helper, safely delegating to core `_prime_user_caches()` or falling
   back to `cache_users()` and `update_meta_cache()`. Resolves unhandled fatal error
   on live WordPress sites during full user directory scans.
 * SCANNER MEMORY BOUNDING & CHUNK OPTIMIZATION — Replaced monolithic upfront cache
   priming in `scan_all_users()` with bounded chunking (100 users per batch) and
   per-record runtime memory eviction via `clean_user_cache()`, eliminating memory
   exhaustion crashes across high-capacity user directories.
 * AJAX SCAN ERROR HANDLING HARDENING — Wrapped `handle_manual_scan()` and `handle_manual_cleanup()`
   in `try / catch (\Throwable)` blocks to return structured JSON error payloads,
   preventing raw HTTP 500 crashes and providing actionable admin notifications.

#### 1.4.17 (September 13, 2026)

 * IP RATE LIMITING, BRUTE FORCE & DYNAMIC FIREWALL HARDENING (PIPELINE 3) — Completed
   end-to-end audit and hardening of the request rate limiter, brute-force login
   monitor, and dynamic IP firewall engine.
 * CRITICAL BRUTE-FORCE SECURITY LOOPHOLE CLOSED — Closed critical security flaw
   in `handle_failed_login()` where brute-force login attacks against administrator
   accounts were erroneously bypassed from failure counters. Untrusted IPs targeting
   administrator or regular accounts are now strictly tracked and blocked once the
   failure threshold is met.
 * SUCCESSFUL AUTHENTICATION RESET — Added `handle_successful_login()` hook on `
   wp_login` to immediately purge transient failed-login attempts upon valid password
   entry, eliminating false-positive lockouts from previous typographical errors.
 * IMMEDIATE 429 RESPONSES ON RATE-LIMIT FLOODS — Updated `check_request()` to immediately
   halt execution with HTTP 429 Too Many Requests status when the rate limit is 
   exceeded, preventing abusive traffic from consuming server CPU rendering time.
 * CRON & CLI EXECUTION SAFEGUARDS — Added execution safeguards to automatically
   exempt `wp_doing_cron()` and WP-CLI (`WP_CLI`) from rate-limiting and blocking.
 * PUBLIC INSPECTION & UNBLOCK APIS — Converted `is_ip_blocked()`, `block_ip()`,
   and `get_client_ip()` to public APIs; implemented `unblock_ip()` and `get_blocked_ips()`
   for administrative control and contract test verification.
 * DUAL HOOK EMISSION & EXEMPTION PARITY — Supported both `lcasr_firewall_request_exempt`
   and `sad_firewall_request_exempt`, and emit both `lcasr_ip_blocked`/`sad_ip_blocked`
   and `lcasr_ip_unblocked`/`sad_ip_unblocked`.
 * AUTOMATED SECURITY EMAIL NOTIFICATION — Added administrative email alert dispatch
   via `wp_mail()` when option `lcasr_notify_admin_brute_force` is active and an
   attacker is blocked.

#### 1.4.16 (September 13, 2026)

 * ALGORITHMIC USERNAME ENTROPY & DISPOSABLE EMAIL DEFENSE (PIPELINE 2) — Completed
   full audit and hardening of the algorithmic username entropy and disposable inbox
   defense engines.
 * SHANNON ENTROPY CALCULATION — Implemented `calculate_entropy()` computing information
   entropy H(X) in bits per character to mathematically distinguish machine-generated
   pseudo-random identifiers from genuine human choices.
 * FALSE-POSITIVE HUMAN COMPOUND ELIMINATION — Fixed critical registration-blocking
   bug where legitimate human names and compound nouns (`christopher`, `alexsmith`,`
   blacksmith`, `manchester`, `birmingham`, `strathmore`, `williamson`) were erroneously
   denied registration due to broad consonant cluster boundaries. Refined heuristics
   with natural English trigraph detection (`chr`, `str`, `tch`, `cks`, `mth`, `
   nch`, `ngh`, etc.) and tightened vowel scarcity thresholds.
 * DISPOSABLE EMAIL PROVIDER CATALOG & SUBDOMAIN MATCHING — Added `get_disposable_email_domains()`
   providing a comprehensive 40+ provider catalog with filter `lcasr_disposable_email_domains`
   and wildcard subdomain defense (`*.mailinator.com`, etc.).
 * PRE-REGISTRATION DISPOSABLE EMAIL INTERCEPTION — Added proactive blocking in `
   check_registration_limits()` with `lcasr_disposable_email_blocked` audit action
   trigger before user records touch the database.
 * SUSPICIOUS EMAIL STRUCTURE HEURISTICS — Hardened `is_suspicious_email_structure()`
   with sub-addressing abuse detection (`+temp...`, `+987654321`) and high-risk 
   TLD pattern heuristics with filter `lcasr_is_suspicious_email_structure`.
 * PCRE UNAMBIGUOUS CAPTURE GROUPS — Standardized regex backreferences to PCRE `\
   g{1}` and `\g{2}` syntax across doubled-vowel detector routines to eliminate 
   string escape ambiguities across PHP versions.

#### 1.4.15 (September 13, 2026)

 * REGISTRATION BOT TRAP & BEHAVIORAL TIMING HARDENING (PIPELINE 1) — Fully audited
   and hardened the registration bot trapping and submission velocity verification
   engine.
 * CRYPTOGRAPHIC ANTI-TAMPERING TIMING TOKENS — Injected server-signed verification
   tokens (`wp_hash('lcasr_time_' . $start_time)`) alongside registration timestamps
   to prevent malicious bots from forging past timestamps.
 * WOOCOMMERCE & MULTISITE PROTECTION PARITY — Extended honeypot injection and human
   velocity verification hooks to `woocommerce_register_form`, `woocommerce_process_registration_errors`,
   and `signup_extra_fields`.
 * ACCESSIBLE HONEYPOT MARKUP — Added hidden accessible `<label>` markup and filterable
   honeypot field names (`lcasr_honeypot_field_name`) for zero screen reader impact
   and customizable obfuscation.
 * SCRAPER & HEADLESS BROWSER DETECTION — Expanded automated client blocking to 
   intercept empty User-Agents and modern scraper frameworks (`scrapy`, `aiohttp`,`
   headlesschrome`) with filterable pattern overrides (`lcasr_bot_ua_regex`).
 * THREAT AUDIT ACTION HOOKS — Added `lcasr_honeypot_triggered`, `lcasr_registration_timing_failed`,
   and `lcasr_bot_ua_blocked` action triggers for threat logging and Pro telemetry
   integration.
 * REGISTRATION QUOTA BOUNDING — Capped in-memory registration tracking arrays to
   500 items max to guarantee zero database option table bloat under high concurrency.
 * DUAL BOOTSTRAP COMPATIBILITY HOOKS — Attached both `lcasr_base_plugin_ready` 
   and `sad_base_plugin_ready` to guarantee instant synchronization with Pro add-
   ons and legacy integrations.

#### 1.4.14 (September 13, 2026)

 * WORDPRESS.ORG COMPLIANCE & PREFIX HARMONIZATION — Systematically refactored all
   class names, constants, functions, options, AJAX endpoints, and filter/action
   hooks to the approved 5-character plugin prefix `lcasr_` / `LCASR_`, eliminating
   the generic 3-character `sad_` prefix.
 * TESTED UP TO 7.1 — Verified and validated compatibility against WordPress 7.1
   core standards.
 * ASSET & NAMESPACE CONSOLIDATION — Renamed core component classes to `LCASR_Spam_Detector`,`
   LCASR_Spam_Cleaner`, `LCASR_Firewall`, `LCASR_Privacy`, `LCASR_Dashboard_Widget`,
   and `LCASR_Admin_Interface`.
 * AJAX & SCRIPT STANDARDIZATION — Updated admin AJAX handlers and localized script
   object to `lcasrAjax` with `lcasr_admin_nonce`.
 * UPGRADE MIGRATION — Added seamless backward-compatible options migration for 
   existing installations upgrading from previous releases.

#### 1.4.13 (September 8, 2026)

 * SAFELIST RETRIEVAL QUERY OPTIMIZATION — Added user cache priming (`_prime_user_caches()`)
   in `get_safelist()`, eliminating N+1 database queries when loading safelisted
   accounts in the admin console.
 * FLAGGED ACCOUNTS METADATA BATCH PRIMING — Integrated `update_meta_cache('user',
   $page_ids)` across paginated slices in `get_flagged_accounts()`, fetching spam
   scores, reasons, and marked dates in a single bulk query rather than 60 separate
   queries per page.
 * SAFELIST AUDIT NOTIFICATION HOOKS — Added `lcasr_user_safelisted` and `lcasr_user_removed_from_safelist`
   alongside legacy `sad_*` action hooks for audit trails and activity feeds.
 * DASHBOARD WIDGET CAPABILITY HARDENING — Restricted widget registration, stylesheet
   enqueueing, and content rendering strictly to administrators with `manage_options`
   capability.
 * PATH STANDARDIZATION & DOUBLE-SLASH PREVENTION — Standardized asset URLs and 
   filesystem paths to modern `LCASR_PLUGIN_DIR` / `LCASR_PLUGIN_URL` with `rtrim()`,
   eliminating malformed double-slash asset links.
 * QUICK SETUP AJAX FAILURE RECOVERY — Added `.fail()` network error recovery handlers
   to the interactive Quick Setup checklist toggles, preventing controls from getting
   trapped in busy state during server disruptions.

#### 1.4.12 (September 8, 2026)

 * AUTOMATED CLEANUP EXECUTION SAFEGUARDS — Added `@set_time_limit(120)` and `wp_raise_memory_limit('
   admin')` to `cleanup_spam_accounts()`, preventing script timeouts and memory 
   exhaustion during automated background cron cleanups on large candidate pools.
 * DUAL STATS TRANSIENT INVALIDATION — Synchronized cache purging to clear both `
   lcasr_cleanup_stats` and legacy `sad_cleanup_stats` on single deletions, batch
   purges, and manual scans.
 * ACCOUNT DELETION ACTION HOOKS — Added `lcasr_spam_user_deleted` and `sad_spam_user_deleted`
   notification actions to allow audit loggers and Pro add-on hooks to record user
   removals.
 * DUAL CAN-DELETE & ROLE FILTERS — Added modern `lcasr_can_delete_user` and `lcasr_protected_roles`
   filter bridges alongside legacy `sad_*` hooks in the cleanup candidate pipeline.
 * SCHEDULED CLEANUP HOOK PARITY — Attached scheduled cleanup handler to both `lcasr_cleanup_spam_accounts`
   and legacy `sad_cleanup_spam_accounts`.

#### 1.4.11 (September 8, 2026)

 * EMAIL LOGIN BRUTE-FORCE LOCKOUT PREVENTION — Enhanced `handle_failed_login()`
   with `is_email()` check and email-based user resolution, preventing false-positive
   IP bans when administrators or staff log in using their email address.
 * SAFELIST LOGIN IMMUNITY — Extended failed login protection to bypass rate-limiting
   and blocking for users explicitly included in the administrator safelist.
 * FIREWALL EXEMPTION FILTER PARITY — Upgraded `check_request()` to evaluate both
   modern `lcasr_firewall_request_exempt` and legacy `sad_firewall_request_exempt`
   filter hooks.
 * IP BLOCKING NOTIFICATION HOOKS — Added `lcasr_ip_blocked` and `sad_ip_blocked`
   action triggers upon dynamic IP blocks for integration with live threat analytics.
 * LOCAL IP FIREWALL BYPASS — Guarded firewall rate-limiting and failed-login transient
   generation against placeholder `0.0.0.0` addresses, preventing transient bloat
   and false blocks during local development and CLI testing.
 * STALE BLOCK PRUNING CONSISTENCY — Fixed timestamp evaluation in `block_ip()` 
   to prune legacy entries without timestamps, maintaining full parity with `is_ip_blocked()`.

#### 1.4.10 (September 8, 2026)

 * HONEYPOT ACCESSIBILITY & OBFUSCATION — Enhanced honeypot markup with `aria-hidden
   ="true"` and multi-technique CSS concealment (`position: absolute; left: -9999px;
   opacity: 0; width: 0; height: 0;`), thwarting smart bot evasion while protecting
   assistive screen readers.
 * TYPE SAFETY & PROTECTED ROLE DEFENSE — Hardened `check_login_attempt()` with `
   WP_User` instance verification and `is_protected_user()` checks, preventing PHP
   runtime errors from third-party auth plugins and guaranteeing administrator/editor
   immunity.
 * DUAL ACTION HOOK PARITY — Added `lcasr_spam_detected` and `lcasr_suspicious_login`
   action hooks alongside legacy `sad_*` equivalents for complete forward compatibility
   across modern extensions.
 * EXTENSIBLE COHORT & REGISTRATION FILTERS — Added modern `lcasr_*` filters for
   avatar detection, profile content completeness, member activity metrics, and 
   registration rate limits with legacy fallback.
 * OPTIONS AUTOLOAD & LATENCY RESOLUTION — Explicitly configured `autoload = false`
   for large option stores (`sad_registration_records`, `sad_spam_detection_log`,`
   sad_spam_training_data`), eliminating massive database array bloat from the global`
   alloptions` cache and reducing frontend page latency.
 * LOCAL IP THROTTLING GUARD — Added placeholder `0.0.0.0` exclusion in registration
   rate limiting to prevent false-positive throttling on CLI environments.
 * LEGACY USERMETA PARITY — Synchronized `sad_markeddate` alongside `sad_marked_date`
   on new account spam flags to maintain compatibility with legacy third-party readers.

#### 1.4.9 (September 8, 2026)

 * BOOTSTRAP VERSION SYNCHRONIZATION — Upgraded activation and auto-migration pipelines
   to synchronize both `lcasr_version` and legacy `sad_version` options, preventing
   stale state fallback.
 * DEPENDENCY LOADING PATH INTEGRITY — Switched internal dependency require paths
   to `LCASR_PLUGIN_DIR` for absolute path safety.
 * SCHEDULED CRON DEACTIVATION HYGIENE — Added `sad_regular_scan` to the deactivation
   hook cleanup loop alongside registration records and account cleanups, preventing
   orphaned background cron tasks.
 * EXEMPTION FILTER PARITY — Added modern `lcasr_firewall_request_exempt` filter
   alongside legacy `sad_firewall_request_exempt` for ManageWP and license route
   exclusions.
 * PRO COMPATIBILITY INTERFACE MODERNIZATION — Introduced modern `lcasr_*` functions(`
   lcasr_has_pro_feature`, `lcasr_is_pro_active`, `lcasr_pro_upgrade_url`, `lcasr_render_pro_panel`)
   with dual filter bridges.
 * UNINSTALL QUERY HARDENING — Extended database transient purge in `uninstall.php`
   to clean both `_transient_lcasr_%` and legacy `_transient_sad_%` records.

#### 1.4.8 (September 8, 2026)

 * WORDPRESS.ORG COMPLIANCE & REBRANDING — Renamed plugin display name to “LC Anti-
   Spam Registration” and slug to `lc-anti-spam-registration` per WordPress.org 
   review team guidance to eliminate trademark confusion with Google and HUMAN Security’s“
   Account Defender”.
 * TEXT DOMAIN & SLUG PARITY — Standardized text domain, translation calls, and 
   internal identifiers strictly to `lc-anti-spam-registration`.
 * BACKWARD COMPATIBILITY SURFACE — Preserved backward-compatible class aliases,
   constants, and hooks (`Spam_Account_Defender`, `SAD_VERSION`, `sad_base_plugin_ready`)
   to ensure seamless operation with existing add-ons and integrations.

#### 1.4.7 (September 6, 2026)

 * LATENCY & QUERY OPTIMIZATION — Added 120-second transient caching to `get_cleanup_stats()`
   with automatic instant cache invalidation on scans and cleanup actions, eliminating
   redundant database table queries across admin page loads.
 * BATCH CACHE PRIMING — Integrated bulk user and usermeta cache priming (`_prime_user_caches`
   and `update_meta_cache`) before candidate verification, resolving N+1 queries
   and improving review load times by up to 95%.
 * SCANNER EXECUTION HARDENING — Added dedicated execution time and memory limits
   in `handle_manual_scan()` to prevent timeouts during full user directory scans
   on large sites.
 * ASSET ISOLATION & HYGIENE — Restricted dashboard widget stylesheet enqueueing
   strictly to the main WordPress dashboard (`index.php`), preventing unnecessary
   asset loading on other admin screens.
 * DEPRECATED TIMESTAMP MIGRATION — Replaced deprecated `current_time('timestamp')`
   calls with `time()` across detector and logging routines, preventing timezone
   skew and aligning with modern WordPress core standards.
 * NAVIGATION & TAB ROBUSTNESS — Hardened admin navigation layout with fallback 
   container rendering for all sidebar tabs, ensuring consistent presentation and
   zero UI errors across all site configurations.
 * SCHEDULED CLEANUP RELIABILITY — Harmonized background cron scheduling to ensure
   safe, reliable automated cleanup runs with enhanced execution safeguards.

#### 1.4.6 (September 6, 2026)

 * WORDPRESS.ORG COMPLIANCE — Renamed plugin display name to “LC Anti-Spam Registration”
   and slug to `lc-anti-spam-registration` to align with the LC plugin ecosystem(
   like `lc-seo-optimizer` and `lc-smart-media-redirect-cleaner`) and eliminate 
   generic naming overlap with other plugins.
 * SCHEDULED CLEANUP UNRESTRICTED (GUIDELINE 5) — Ensured automated scheduled cleanup
   in `cleanup_spam_accounts()` operates with complete functionality and zero restrictions
   in the core plugin.
 * PLUGIN HEADER CLEANUP — Removed `Tested up to` from the main PHP file header 
   to ensure compatibility versions are declared exclusively in `readme.txt`.
 * PREFIX STANDARDS — Encapsulated version checking helpers within the core plugin
   class and eliminated un-prefixed functions from the global namespace.

#### 1.4.5

 * CANDIDATE QUERY OPTIMIZATION — Eliminated duplicate `is_reviewable_spam_user()`
   checks in `get_cleanup_candidates()`, reducing database queries by up to 4,000
   lookups on large batches.
 * IP REPUTATION SAFETY — Guarded `get_registrations_by_ip()` and firewall `block_ip()`
   against placeholder `0.0.0.0` addresses to prevent false-positive scoring on 
   CLI/local environments.
 * TIMEOUT HARDENING — Added explicit memory and execution time bounds (`@set_time_limit(
   120)` and `wp_raise_memory_limit('admin')`) in `handle_manual_cleanup()` and `
   bulk_review_action()`.

#### 1.4.4 (September 1, 2026)

 * MEMORY OPTIMIZATION — Streamlined `delete_spam_user` to batch delete authored
   posts and comments using lightweight ID arrays with `no_found_rows`, preventing
   memory spikes on large user stores.
 * QUERY HARDENING — Fixed SQL `ORDER BY` clause in `get_review_candidates` for 
   complete compliance across strict database engines (MySQL 8.0 `ONLY_FULL_GROUP_BY`,
   MariaDB, SQLite).
 * METRICS ACCURACY — Removed redundant review candidate traversal in `get_cleanup_stats()`
   to optimize dashboard rendering latency.
 * COHORT ACTIVITY ACCURACY — Refined `get_user_activity_count()` to filter out 
   spam and trashed comments so spam accounts with discarded comments are not falsely
   shielded.
 * UNINSTALL COMPLETENESS — Added missing burst-cohort and bot-blocking options 
   to `uninstall.php` for 100% database cleanup upon plugin removal.

#### 1.4.3

 * RESEARCH CITATION ALIGNMENT — Updated administrative console Research Journal
   citation to link directly to the newly published dedicated academic manuscript:“
   Algorithmic Mitigation of Asymmetric Bot Registration Attacks and Credential 
   Stuffing in High-Concurrency CMS Ecosystems” (Light & Composition University 
   Academic Journal, Vol. 14, Issue 3, Pages 65–96).
 * Fixed text domain consistency across all admin templates and detector routines(`
   spam-account-defender`).
 * Cleaned and structured `readme.txt` to full WordPress.org repository specifications.
 * Enhanced input sanitization and late-escaping across admin AJAX endpoints.
 * Verified 100% test pass rate with automated contract test suite.

#### 1.4.2

 * WordPress.org repository compliance: removed off-repo custom updater routines,
   standardized text domain and slug to `spam-account-defender`.
 * Synchronized `Tested up to: 7.1`, `Requires at least: 6.0`, and added `Contributors:
   nasruleam, celsiusanderson`.
 * Enhanced PHPCS and strict nonce verification across all admin AJAX actions.
 * Purged hidden and non-standard development files for clean repository distribution.

#### 1.4.1

 * Set `Plugin URI` to the official Dev Lab product portal (`/dev/spam-account-defender/`).

#### 1.4.0

 * Security hardening: added strict type checking on login validations and removed
   legacy unescaped queries.

#### 1.3.9

 * Accessibility & internationalization audit for WordPress dashboard widgets.

## Meta

 *  Version **1.4.19**
 *  Last updated **1 day ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.0 or higher **
 *  Tested up to **7.1**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[bot protection](https://wordpress.org/plugins/tags/bot-protection/)
   [honeypot](https://wordpress.org/plugins/tags/honeypot/)[registration](https://wordpress.org/plugins/tags/registration/)
   [security](https://wordpress.org/plugins/tags/security/)
 *  [Advanced View](https://wordpress.org/plugins/lc-anti-spam-registration/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/lc-anti-spam-registration/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/lc-anti-spam-registration/reviews/)

## Contributors

 *   [ Celsius Anderson ](https://profiles.wordpress.org/celsiusanderson/)
 *   [ Nasrul Eam ](https://profiles.wordpress.org/nasruleam/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/lc-anti-spam-registration/)

## Donate

Would you like to support the advancement of this plugin?

 [ Donate to this plugin ](https://www.lightandcomposition.com/dev-lab/)