Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Due to recent spam, I wanted to stop registration on my website for a while.

But doing so meant the registration page would redirect to the homepage, which was bad for SEO.

So I left the registration page there, removed the 'register' submit button and put in a little message telling people to contact me if they wanted to be registered manually.

1 day later, I have another 5 users who somehow managed to register! All of these are spam users.

How did they do this?

I removed the 'register' submit button on the register page so did they manage to make their own submit button? (editing the webpage on their end)

Also if you go to mysite.com/wp-register.php or /wp-admin/ it asks for a password (.htpasswd protected).

The actual register page is located at: /wp-login.php?action=register (This is a custom page that matches my theme btw)

What do you think it is? I can private message you the website if you like.

Thank you!

share|improve this question

1 Answer 1

up vote 0 down vote accepted

One could easily submit the form on the page by adding a submit button to the DOM through javascript. I would suggest a redirect from the registration page to some other page without a form submission.

share|improve this answer
    
I need it to remain on the same page, is it possible to remove all the input fields on the page? Would that work? –  Mohammad G Sep 12 '12 at 0:32
    
Yes, you could do that. There is probably some sort of nonce in the form that might do the trick by removing it. –  Douglas.Sesar Sep 12 '12 at 0:35
    
Okay! So I removed the fields and the script on the page making it impossible to register! Thanks! –  Mohammad G Sep 12 '12 at 0:42
    
no problem, comment back if there are any more troubles with it. –  Douglas.Sesar Sep 12 '12 at 0:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.