5

My site http://remotejobs.io currently uses a plugin to power the job board and user supplied resumes. The plugin creates users from it's own interface, so there is not typical user creation method on the site.

However, lately I've had an overwhelming amount of new user creations from spam bots. I know the difference because I get a new user registration email from these users who I suppose are just hitting the http://remotejobs.io/wp-login.php?action=register page, whereas the interface used by users actually posting a resume or a job doesn't generate this email notification.

Is there someway to block the ability for spam bots to create accounts this way without disabling user registration all together?

To be clear, no spam is actually ending up on the site because users can only post content through the plugin's interface. But I'd like to prevent a user database filled with spam accounts.

EDIT: I'm using the wpjobboard plugin.

  • This is where a captcha would come in handy. There are many plugins for this. – Twifty Sep 26 '13 at 16:56
  • But I don't need users to be able to create accounts through the regular registration at all. Isn't there a simple way to block access to that page or something? – Joel Glovier Sep 26 '13 at 20:11
9

This is similar to Shawn H's answer but is more effective for me.

I already had registrations disabled, but bots still show up constantly to try anyway. My goal was to completely kill all requests to the registration form to avoid the load on my server (and mess in my logs) caused by bots trying to register, so this solution sends a 403 denied error to anyone that tries to register. It may be overkill for you if you still want people to be able to register.

It goes in your .htaccess, near the top (obviously it will only work if you are using Apache as your server and have mod_rewrite enabled, which most people do) :

#BLOCK SPAM REGISTRATION REQUESTS (wp-login.php?action=register) 
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} ^.*(wp-login.php\?action=register).* [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>

wp-login.php?action=register is the URL you end up at when you try to register, so this should stop all requests regardless of whether they go straight to wp-login.php (like the bots I'm fighting) or through wp-includes/wp-register.php or just /wp-register.php.

| improve this answer | |
  • This looks perfect. However I don't understand when you say 'I already had registrations disabled'. This question is about enabling registrations on the site through other mechanisms, just disabling the default wp-login?action=register – Kit Johnson Apr 10 '15 at 5:23
  • What I meant by 'I already had registrations disabled' is that I had the wp-admin settings related to registration set to dissalow them, so I had already crossed that bridge. For me the point of blocking these URLs was for performance and log cleanliness. – jerclarke Jan 19 '18 at 22:16
2

If you are just creating users in the admin dashboard, you can disable user registrations. As an admin you will still be able to create users, but general visitors to your site will not be able to self register.

Login to your site, go to Admin > Settings > General.

There is an option titled Membership.

Make sure the checkbox next to Anyone can register is not checked.

| improve this answer | |
  • So the plugin creates users in the plugin dashboard, on the front end of the site. Not sure how it's doing it, but it's not through the Wordpress dashboard and I'm not doing it manually. So if I understand correctly disabling user registration means the plugin cannot create new users. – Joel Glovier Sep 27 '13 at 20:13
  • Yeah I just tested it and when I disabled that, it prevents users from registering on the site even through the plugin. It says "registration is disabled" on that page after I uncheck that. – Joel Glovier Sep 27 '13 at 20:18
  • 1
    It looks like the plugin just uses the WordPress registration but just puts a nicer face on it. Since it is a paid plugin I would recommend you seek support from the plugin author. – John Kleinschmidt Sep 27 '13 at 20:40
  • John I downvoted this not because it's unhelpful, but because it doesn't answer the question, which is asking for a solution that doesn't involve disabling registration (not sure if the title was changed, but I came in with a similar problem and was similarly unhelped by your answer). <3 – jerclarke Dec 3 '14 at 18:56
1

Depending on the flexibility of your plugin, you could add a CAPTCHA to the registration, and/or you could add a "honey pot." In terms of blocking registration spam, a honey pot is essentially a regular input field hidden to the human user (usually with CSS) that if it gets filled out, the system rejects the registration Without knowing the plugin, it would be hard to tell you if or how you can add those elements.

| improve this answer | |
  • Good answer because it leaves real people able to register if they stumble across your form for some reason but will block most bots. – jerclarke Dec 3 '14 at 19:29
1

You could try blocking access to the default registration through your .htaccess file, adding:

Redirect 301 /wp-includes/wp-register.php /

which would just redirect all visitors trying to get to the registration page back to the home page. This still allows the functions inside wp-registrer to be accessed by your plugin.

| improve this answer | |
  • Nice Shawn :) In my case my logs are full of this: GET /wp-login.php?action=register, which seems to lead to the same place (wp-login.php?registration=disabled). Do you know the htaccess to block action=register? – jerclarke Dec 3 '14 at 18:53
  • NM, found it and added my own answer :) – jerclarke Dec 3 '14 at 19:37
0

Reference : https://snippets.webaware.com.au/snippets/remove-register-link-wordpress-wp-login-php/

add_filter('option_users_can_register', function($value) {
$script = basename(parse_url($_SERVER['SCRIPT_NAME'], PHP_URL_PATH));

if ($script == 'wp-login.php') {
    $value = false;
}

return $value;
});
| improve this answer | |
  • Hello @FadyKarma - Welcome to the WordPress Development community! A couple tips - good answers which work well here are generally composed of more than just a link and/or code. It's nice to provide context for a link and describe how your code addresses the question. Check out the "How to Answer" page in our help center for more information – bosco Mar 29 '17 at 21:10
  • this disables the Register link, but not the registration page – moped Jun 19 '18 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.