I'm getting maybe 1-10 user registrations a day on my site. They all look like spam but maybe one in twenty.
I am using a plugin that integrates with my application that allows creating new user accounts so I don't need any client side pages that allow registrations. The plugin will do it.
How can I disable all client side registrations but allow my users to create new accounts through my plugin? I've listed some ideas below I've thought about.
Theoretical Method 1:
1. disable all new account creation using options on WordPress settings page 2. allow new accounts through the plugin. it calls standard methods wp_create_user()
- the problem with that is will wp_create_user() work if account creation is turned off in WordPress?
- if the api call still works will the new email account message be sent and then will the confirm email account activation link still work?
Theoretical Method 2:
1. Delete the wp-register.php page?
- this may prevent the page from loading but my guess is that spam bots are posting to wp-login.php which I do not want to delete.
- apparently there are three places where a visitor can register wp-login.php?action=register, wp-includes/wp-register.php and /wp-register.php.
Setting up Method 1 is possible but a lot of work with a lot of questions if I run into road blocks.
FYI I'm running a multiuser WPMU Network site.