Stop spam users from registering without disabling user registration?

Question

My site http://remotejobs.io currently uses a plugin to power the job board and user supplied resumes. The plugin creates users from it's own interface, so there is not typical user creation method on the site.

However, lately I've had an overwhelming amount of new user creations from spam bots. I know the difference because I get a new user registration email from these users who I suppose are just hitting the http://remotejobs.io/wp-login.php?action=register page, whereas the interface used by users actually posting a resume or a job doesn't generate this email notification.

Is there someway to block the ability for spam bots to create accounts this way without disabling user registration all together?

To be clear, no spam is actually ending up on the site because users can only post content through the plugin's interface. But I'd like to prevent a user database filled with spam accounts.

EDIT: I'm using the wpjobboard plugin.

Answer 1

This is similar to Shawn H's answer but is more effective for me.

I already had registrations disabled, but bots still show up constantly to try anyway. My goal was to completely kill all requests to the registration form to avoid the load on my server (and mess in my logs) caused by bots trying to register, so this solution sends a 403 denied error to anyone that tries to register. It may be overkill for you if you still want people to be able to register.

It goes in your .htaccess, near the top (obviously it will only work if you are using Apache as your server and have mod_rewrite enabled, which most people do) :

#BLOCK SPAM REGISTRATION REQUESTS (wp-login.php?action=register) 
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} ^.*(wp-login.php\?action=register).* [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>

wp-login.php?action=register is the URL you end up at when you try to register, so this should stop all requests regardless of whether they go straight to wp-login.php (like the bots I'm fighting) or through wp-includes/wp-register.php or just /wp-register.php.

Answer 2

If you are just creating users in the admin dashboard, you can disable user registrations. As an admin you will still be able to create users, but general visitors to your site will not be able to self register.

Login to your site, go to Admin > Settings > General.

There is an option titled Membership.

Make sure the checkbox next to Anyone can register is not checked.

Answer 3

Depending on the flexibility of your plugin, you could add a CAPTCHA to the registration, and/or you could add a "honey pot." In terms of blocking registration spam, a honey pot is essentially a regular input field hidden to the human user (usually with CSS) that if it gets filled out, the system rejects the registration Without knowing the plugin, it would be hard to tell you if or how you can add those elements.

Answer 4

You could try blocking access to the default registration through your .htaccess file, adding:

Redirect 301 /wp-includes/wp-register.php /

which would just redirect all visitors trying to get to the registration page back to the home page. This still allows the functions inside wp-registrer to be accessed by your plugin.

Answer 5

Reference : https://snippets.webaware.com.au/snippets/remove-register-link-wordpress-wp-login-php/

add_filter('option_users_can_register', function($value) {
$script = basename(parse_url($_SERVER['SCRIPT_NAME'], PHP_URL_PATH));

if ($script == 'wp-login.php') {
    $value = false;
}

return $value;
});