6

My site http://remotejobs.io currently uses a plugin to power the job board and user supplied resumes. The plugin creates users from it's own interface, so there is not typical user creation method on the site.

However, lately I've had an overwhelming amount of new user creations from spam bots. I know the difference because I get a new user registration email from these users who I suppose are just hitting the http://remotejobs.io/wp-login.php?action=register page, whereas the interface used by users actually posting a resume or a job doesn't generate this email notification.

Is there someway to block the ability for spam bots to create accounts this way without disabling user registration all together?

To be clear, no spam is actually ending up on the site because users can only post content through the plugin's interface. But I'd like to prevent a user database filled with spam accounts.

EDIT: I'm using the wpjobboard plugin.

2
  • This is where a captcha would come in handy. There are many plugins for this.
    – Twifty
    Sep 26, 2013 at 16:56
  • But I don't need users to be able to create accounts through the regular registration at all. Isn't there a simple way to block access to that page or something? Sep 26, 2013 at 20:11

5 Answers 5

11

This is similar to Shawn H's answer but is more effective for me.

I already had registrations disabled, but bots still show up constantly to try anyway. My goal was to completely kill all requests to the registration form to avoid the load on my server (and mess in my logs) caused by bots trying to register, so this solution sends a 403 denied error to anyone that tries to register. It may be overkill for you if you still want people to be able to register.

It goes in your .htaccess, near the top (obviously it will only work if you are using Apache as your server and have mod_rewrite enabled, which most people do) :

#BLOCK SPAM REGISTRATION REQUESTS (wp-login.php?action=register) 
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} ^.*(wp-login.php\?action=register).* [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>

wp-login.php?action=register is the URL you end up at when you try to register, so this should stop all requests regardless of whether they go straight to wp-login.php (like the bots I'm fighting) or through wp-includes/wp-register.php or just /wp-register.php.

2
  • This looks perfect. However I don't understand when you say 'I already had registrations disabled'. This question is about enabling registrations on the site through other mechanisms, just disabling the default wp-login?action=register Apr 10, 2015 at 5:23
  • What I meant by 'I already had registrations disabled' is that I had the wp-admin settings related to registration set to dissalow them, so I had already crossed that bridge. For me the point of blocking these URLs was for performance and log cleanliness.
    – jerclarke
    Jan 19, 2018 at 22:16
2

If you are just creating users in the admin dashboard, you can disable user registrations. As an admin you will still be able to create users, but general visitors to your site will not be able to self register.

Login to your site, go to Admin > Settings > General.

There is an option titled Membership.

Make sure the checkbox next to Anyone can register is not checked.

4
  • So the plugin creates users in the plugin dashboard, on the front end of the site. Not sure how it's doing it, but it's not through the Wordpress dashboard and I'm not doing it manually. So if I understand correctly disabling user registration means the plugin cannot create new users. Sep 27, 2013 at 20:13
  • Yeah I just tested it and when I disabled that, it prevents users from registering on the site even through the plugin. It says "registration is disabled" on that page after I uncheck that. Sep 27, 2013 at 20:18
  • 1
    It looks like the plugin just uses the WordPress registration but just puts a nicer face on it. Since it is a paid plugin I would recommend you seek support from the plugin author. Sep 27, 2013 at 20:40
  • John I downvoted this not because it's unhelpful, but because it doesn't answer the question, which is asking for a solution that doesn't involve disabling registration (not sure if the title was changed, but I came in with a similar problem and was similarly unhelped by your answer). <3
    – jerclarke
    Dec 3, 2014 at 18:56
1

Depending on the flexibility of your plugin, you could add a CAPTCHA to the registration, and/or you could add a "honey pot." In terms of blocking registration spam, a honey pot is essentially a regular input field hidden to the human user (usually with CSS) that if it gets filled out, the system rejects the registration Without knowing the plugin, it would be hard to tell you if or how you can add those elements.

1
  • Good answer because it leaves real people able to register if they stumble across your form for some reason but will block most bots.
    – jerclarke
    Dec 3, 2014 at 19:29
1

You could try blocking access to the default registration through your .htaccess file, adding:

Redirect 301 /wp-includes/wp-register.php /

which would just redirect all visitors trying to get to the registration page back to the home page. This still allows the functions inside wp-registrer to be accessed by your plugin.

2
  • Nice Shawn :) In my case my logs are full of this: GET /wp-login.php?action=register, which seems to lead to the same place (wp-login.php?registration=disabled). Do you know the htaccess to block action=register?
    – jerclarke
    Dec 3, 2014 at 18:53
  • NM, found it and added my own answer :)
    – jerclarke
    Dec 3, 2014 at 19:37
1

Reference : https://snippets.webaware.com.au/snippets/remove-register-link-wordpress-wp-login-php/

add_filter('option_users_can_register', function($value) {
$script = basename(parse_url($_SERVER['SCRIPT_NAME'], PHP_URL_PATH));

if ($script == 'wp-login.php') {
    $value = false;
}

return $value;
});
2
  • Hello @FadyKarma - Welcome to the WordPress Development community! A couple tips - good answers which work well here are generally composed of more than just a link and/or code. It's nice to provide context for a link and describe how your code addresses the question. Check out the "How to Answer" page in our help center for more information
    – bosco
    Mar 29, 2017 at 21:10
  • this disables the Register link, but not the registration page
    – moped
    Jun 19, 2018 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.