Support » Networking WordPress » Registration is disabled, but users still register

  • Hi, I have a multisite setup of 7 sites. In the main network settings I’ve disabled user registration, but I still receive emails that users register. The register form is not visible in the frontend, on the /wp-signup.php page it says registration is disabled, /wp-login page does not have an option to register. On the network users page, these users do not have a site specified on which they have registered. The interval of users registering is 1.5 per day. Can someone please guide me on what is happening and how to solve this I am afraid that this might evolve into something more serious.

    Thanks

Viewing 5 replies - 1 through 5 (of 5 total)
  • Moderator t-p

    (@t-p)

    I’ve had the same problem for a number of months when after getting hundreds of spam registrations. I tried renaming the register path and installed extra anti-spam plugins too. Eventually I decided to just disable registrations completely thinking that would end the problem.

    However, I still get around 10-20 spam registrations on some days by people (bots?) that don’t need any registration page to be able to register on my site. There exists no page or legitimate means on my site to register but still they do. Apparently, people say the spammers can exploit WordPress security loopholes to register directly without a registration form.

    I would be grateful if someone could explain what these loopholes are and why I can’t prevent registrations. At the moment the default registrations are set to ‘Pending’ with only very minimal rights so they need to be approved before they can actually post anything visible. Still I have to continually manually delete these spam registrations where they soon outnumber the small group of 50 legitimate members.

    I’ve looked at T-P’s links and already have Askimet installed (free version) and doubt if the no-bot-registration would fix the problem as it’s aimed at adding questions to the registration process to thwart bots – which I don’t have.

    It’s possible that blocking spam registrations with .htaccess is something worth looking into but that’s going to be a whole new learning curve for me. It would work if the bulk of IP addresses of the spammers are closely related.

    Though I’m still not sure why if I don’t want registrations WordPress just can’t stop this happening? Especially if there are ways of blocking particular IP addresses from registering!

    Rob-e

    (@rob-e)

    Same problem as above: Registration is disabled, no front end link to register and still dozens of new users by the day. Attempted logins almost drove me mad, now this! Used WP for fifteen years but am seriously thinking of abandoning it 🙁

    martinneumannat

    (@martinneumannat)

    There are some mechanisms in WordPress for User registration that bypass the normal contact form. One would be the REST API, and another one is XML-RPC. The second one you can disable easily with the SG Security plugin. I had problems on a site with SPAM registrations, and it seems that this plugin did resolve it.

    Having the same issue. Registrations is unchecked, but spam registrations still coming in.

    • This reply was modified 10 months, 2 weeks ago by OSHGroup.
Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Registration is disabled, but users still register’ is closed to new replies.