My website has recently come under attack by a wave of spam user accounts. My website uses a custom login that forces users to use their email address as their username, however the spam users all have regular usernames so I am assuming they are running a script which sends POST requests to /wp-login.php
.
It is not enough to remove this page I need to disable the ability to make user accounts via POST requests to this page as I'm pretty sure the spammers are using software and not hand crafting these accounts.
Lastly I need to disable /wp-admin/profile.php
as I believe they are creating accounts to insert back-links into their profiles.
How would I go about doing this?