Spam registrations

Hello,

According to our dashboard, we are using Better WP Build Version: 3064. My site is having an issue with spam registrations.

There is not any method on the site to register. There is not a “login” or “register” link anywhere on the site presently.

On the “hide” tab, Enable Hide Backend is checked. The login, register and admin slugs have been changed to paths no one would reasonably guess. The site bans users with too many 404 errors so even if a user tried to guess, they would not get far.

Despite the above, multiple users are registering daily. It is clear these are some form of auto-registration bots. I noticed the following:

site.com/wp-login = 404 error
site.com/wp-login.php = 404 error

The same is true with admin and admin.php respectively. However, site.com/wp-login.php?action=register works.

I recognize I can turn off site registrations completely, but that is not our long-term goal. We wish to ensure the site does not receive any spam registrations, then open the site up for registration. Why is the plugin not blocking the register URL above?

https://wordpress.org/plugins/better-wp-security/