Sign-up spam protection

Stop WordPress Spam Registrations Before the Accounts Exist

WordPress spam registrations are accounts opened by bots, usually in bursts and usually with throwaway email addresses. WP SecureGate checks every sign-up from someone who isn't allowed to create users, limits how many accounts one address can open, refuses inboxes that are disposable or can't receive mail, and helps you clear out the fake accounts already on the site.

See plans & pricingAll features
  • ✓ On by default
  • ✓ WordPress and WooCommerce
  • ✓ You choose what to delete

Where WordPress spam registrations come from

Spam user registration doesn't only happen on the WordPress registration page. On a shop, bots also open accounts through WooCommerce's My Account form and the checkout, and page-builder sign-up widgets are another way in. WP SecureGate covers all of them:

  • WordPress registration;
  • WooCommerce My Account and checkout;
  • Essential Addons and Ultimate Addons sign-up widgets.

On by default. Being signed in doesn't get around it.

Limits per address and across the site

Each IP address may open at most 3 new accounts a day. You can change that to 1, 5, 10 or no limit. Across the whole site, no more than 60 accounts can be opened in an hour, which caps a burst spread over many addresses. An IPv6 /64 counts as one address, so a bot can't dodge the limit by stepping through the addresses in one IPv6 allocation.

A buyer opening an account at checkout is never limited, because many real customers can share one address. Accounts created by an admin, by WP-CLI, by cron jobs or by imports are never touched either.

On by default: 3 accounts per address per day, 60 an hour site-wide.

Block disposable email registration

Throwaway inboxes are refused at sign-up. The plugin ships with a list of about 90 disposable-mail domains, including Mailinator, YOPmail and 10 Minute Mail.

On WordPress and WooCommerce forms it also refuses addresses whose domain can't receive mail. Only a definite answer that the domain doesn't exist leads to a refusal. If the lookup fails or times out, the sign-up goes through, so a slow DNS server never locks out a real person.

On by default.

One email a day instead of one per sign-up

WordPress normally emails the admin about every new account, so a wave of bot sign-ups means a wave of mail. WP SecureGate replaces that with one daily summary. If you prefer, you can go back to one email per account, or switch the emails off. Accounts an admin creates are still emailed as before.

Daily summary by default. Choices: daily, each, off.

Is registration meant to be open?

WordPress's "Anyone can register" setting is what lets bots in through the WordPress form, and it is easy to leave on by accident. When it's on, WP SecureGate says so and offers to turn it off in one click. WooCommerce sign-up has its own setting, so a shop's customer accounts keep working.

It also warns when new accounts are given a role above Subscriber, a setting that would hand every bot more access than it should have.

The warning shows whenever open registration is on.

Find fake user accounts already on WordPress

Bots that got in before you installed protection leave accounts behind. The unused-accounts review lists subscriber and customer accounts with no sign-in on record and no posts, comments, orders, memberships or courses. Accounts with a throwaway email are flagged, and accounts opened in a burst are pointed out for you to judge.

Nothing is deleted automatically. You pick the accounts to remove and confirm how many before anything happens.

A review you open when you want. It never deletes on its own.

A CAPTCHA on the registration form

For sites that want a challenge as well, a CAPTCHA can be added to the WordPress and WooCommerce registration forms with Cloudflare Turnstile, hCaptcha, Google reCAPTCHA or a built-in math challenge. See WordPress CAPTCHA for the providers and the other forms it can cover.

Shops can read how sign-up protection fits with the checkout guards on the WooCommerce security plugin page, and how it pairs with the billing-email check on WooCommerce fake orders.

Off by default. Needs a CAPTCHA provider and the registration form ticked.

Part of WP SecureGate: WooCommerce security →

Related protection

WooCommerce securityCheckout protection for WooCommerce shops plus the firewall, scanning and login security the store runs on.Fake ordersRefuses orders with throwaway billing emails and limits card-testing and coupon abuse at WooCommerce checkout.Form CAPTCHATurnstile, hCaptcha, reCAPTCHA or a math challenge on login, comment and form-builder forms, plus a hidden honeypot.Login securityLockouts, a custom login URL, password checks and 2FA, with a way back in if you ever lock yourself out.

Questions about spam registrations

Start by checking whether you need open registration at all, and turn it off if not. Where sign-ups must stay open, limit accounts per address and refuse disposable emails. WP SecureGate does both by default and adds an optional CAPTCHA on top.

Yes. The same limits and email checks apply to WooCommerce's My Account registration and to accounts opened at checkout. The one difference is that a buyer creating an account while placing an order is never held to the per-address limit.

No. The unused-accounts review only lists accounts that look unused and flags the suspicious ones. You choose which to delete and confirm the count first.

Yes. Accounts created by an administrator, through WP-CLI, by cron jobs or by imports are never limited or checked by sign-up protection.

Every feature, in every plan

One licence covers the firewall, malware scanner, login protection, WooCommerce checkout protection and everything else. Plans differ only in the number of sites, and every charge has a 7-day refund.

Choose a planAsk a question