Block domain or “Delete not Deny Request”

  • Resolved dsiv

    (@dsiv)


    10 months, 1 week ago

    I am a Premium user. This plugin is working well for us. Unfortunately, I have been getting a lot of spam requests. Why do I think that they are spam requests?

    1. I get a lot of requests from specific domains, each from different users
    2. I send the email requesting the account an email before I approve their request and I get various types of bounce backs.

    The “Approve” and “Deny” are working great. Both of these generate an email to the requestor.

    All “Approve” requests correctly result in an email being sent.

    Some “Deny” requests should receive an email about the denial. This is currently working great.

    Most “Deny” requests should NOT have an email sent, since most “Deny” responses are due to spam. I don’t need or want the domain to know that I responded. I see the solution as either:

    1. Add a “Delete” option, which would delete the queued request without sending an email OR
    2. Add a “Block domain” option, which would automatically delete the queued request WITHOUT sending an email and automatically delete future requests from that domain, WITHOUT send an email OR
    3. both options

    I love the different ways that I can configure responses.

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Support muddasirhayat

    (@muddasirhayat)

    10 months, 1 week ago

    Hi @dsiv,

    Thank you for reaching out, we’re glad to hear the plugin is working well for you.

    Regarding the spam registration requests, especially those coming from specific domains and resulting in bounce-backs, you’ve raised a valid concern. While the current “Approve” and “Deny” functionalities are working as intended, we understand your need for greater control in managing suspicious or unwanted requests more discreetly.

    At this time, you can reduce spam by blacklisting specific domains, which prevents users with email addresses from those domains from registering. Here’s how to configure this:

    1. Navigate to New User Approve → Auto Approve → Domain Blacklist.
    2. Enter the domains you want to block in the Domain List textbox.
    3. Enable the Blacklist Toggle to activate the feature.
    4. Optionally, enter a Custom Message to display when a user from a blacklisted domain attempts to register.
    5. Click Save Changes to apply the settings.

    You can find more details in our documentation here: New User Approve Documentation – Blacklist by Domain

    As for your suggestions:

    • A “Delete” option that removes the request without sending a notification, and
    • A “Block Domain” option that automatically deletes both current and future requests from specific domains without sending emails

    These are excellent ideas. We’ve shared them with our development team for consideration in a future update. Your feedback is invaluable and helps us improve the plugin experience for all users.

    Thanks & Regards,
    WP Experts Support Team

    Thread Starter dsiv

    (@dsiv)

    10 months, 1 week ago

    I could not find the Auto Approve, but I eventually realized that Settings->Enable Auto-Approve needed to be selected first.

    I was able to add domains to the blacklist. Time will tell if they are successfully blocked.

    I don’t have Enable Whitelist checked. I hope that no requests will be automatically approved in my configuration and only requests from these domains are blocked.

    delhinightqueen.com
    2-construction.store
    noreply0.com
    solstris.com

    Thank you for the help.

    Plugin Support muddasirhayat

    (@muddasirhayat)

    10 months ago

    Hi @dsiv,

    Thank you for your update.

    You can get back to us any time. If you have any issue or need assistance.

    Thank you

    Thread Starter dsiv

    (@dsiv)

    10 months ago

    Note that I set several domains in the blacklist. One is delhinightqueen.com. However, these requests come in as <subdomain>.delhinightqueen.com, which did not get blocked overnight. As such, I added *.delhinightqueen.com and hope this new entry helps. If you have other ideas on how to block these subdomains, I would love to learn more.

    Plugin Support muddasirhayat

    (@muddasirhayat)

    10 months ago

    Hi @dsiv,

    Thank you for your feedback!

    You’re absolutely right—using the domain blacklist is a good first step, but subdomains like <subdomain>.delhinightqueen.com can bypass a basic domain entry. Including *.delhinightqueen.com in the blacklist is the correct approach, and should help mitigate those cases. Let us know if you continue seeing requests get through, and we’ll investigate further.

    Additionally, if you’d like to add an extra layer of protection against spam, we recommend implementing Google reCAPTCHA on your registration form. It’s one of the most effective and user-friendly options available.

    To set it up:

    1. Visit Google reCAPTCHA Admin Console to generate your API keys.
    2. After obtaining your keys, install a free WordPress reCAPTCHA plugin (like “Advanced noCaptcha & invisible Captcha” or “reCaptcha by BestWebSoft”).
    3. Configure the plugin to protect your registration form.

    This should significantly reduce automated spam signups.

    Thank you

    Thread Starter dsiv

    (@dsiv)

    10 months ago

    I will look at adding reCAPTCHA. In the meantime, my blacklist has the entries shown below. I get quite a few requests from solstris, but none since putting them in the blacklist. It may be coincidence or it may be working. However, I continue to get delhinightqueen.com requests, even though I have the primary domain and the * subdomains. It looks like the subdomain entry is not working.

    This is where the Delete option would be great, instead of using Deny.

    *.delhinightqueen.com
    delhinightqueen.com
    2-construction.store
    noreply0.com
    solstris.com
    discardmail.com
    europeandocfestival.org.uk

    Plugin Support muddasirhayat

    (@muddasirhayat)

    10 months ago

    Hi @dsiv,

    Thank you for the update and details.

    It appears that the blocklist is working correctly, as evidenced by solstris.com, which is great to hear. However, the ongoing requests to delhinightqueen.com suggest that the wildcard entry (*.delhinightqueen.com) may not be functioning as expected. For this, please create a ticket on our official website so we can assist you promptly.

    For the reader: We will update you soon. Once the issue get resolved.

    Thank you

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Block domain or “Delete not Deny Request”’ is closed to new replies.