WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My website has recently come under attack by a wave of spam user accounts. My website uses a custom login that forces users to use their email address as their username, however the spam users all have regular usernames so I am assuming they are running a script which sends POST requests to /wp-login.php.

It is not enough to remove this page I need to disable the ability to make user accounts via POST requests to this page as I'm pretty sure the spammers are using software and not hand crafting these accounts.

Lastly I need to disable /wp-admin/profile.php as I believe they are creating accounts to insert back-links into their profiles.

How would I go about doing this?

share|improve this question
go to your wordpress setting and in general option uncheck the Membership that anyone can register on site it will dissable the registration process for site you can active any time by checking this checkbox again – Vikas Gautam Sep 17 '13 at 8:57
@Vickey, disable the resgitration when the site needs it is not a solution from my point of view. – cybmeta Sep 17 '13 at 9:03
@Vickey Thanks but I want users to register using my custom login and registration pages (which use wordpress functions to do so) I just want to block these pages which create vulnerabilities. Answer has been found and posted. – George Reith Sep 17 '13 at 9:04
yes i know but for current you can use it after that you can user secure register wordpress plugins or adding captcha to filter the spam user – Vikas Gautam Sep 17 '13 at 9:05
up vote 1 down vote accepted

I realised this is probably better dealt by the server, I ended up putting the following in a .htaccess:

# Block regular login/registration and profile pages
<Files wp-login.php>
    Order Deny,Allow
    Deny from All
<Files profile.php>
    Order Deny,Allow
    Deny from All

This prevents any requests to those pages and forces users to use my custom login and registration pages.

Edit: I don't think I made this clear and I do not recommend this solution to most WordPress users.

I have a custom user registration, login and profile system. These do not extend the default WordPress ones but are completely stand-alone and do not require access to these pages as all logic and requests are handled by the system itself and not passed on (However they do use WordPress functions and the default user table in the WordPress database).

This is not the same as say a plugin which provides a custom login page just to change the theme but actually sends POST requests back to wp-login.php as this would break under my solution.

share|improve this answer
Is your solution really working? What if you need to login to the admin area? – cybmeta Sep 17 '13 at 9:04
@cybnet I have a custom login page (at a different location). This just removes the default one which was being easily spammed. – George Reith Sep 17 '13 at 9:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.