I'm getting tons of spam from people registering on my site, but there is no place to register. I did check http://MyWebsiteName.com/wp-login?action=register, but it said "Page not found," so that's not it. Where and how are they registering?

I unchecked the box "Anyone can register" under general settings. Just can't figure out how spammers are getting in.

  • Can you elaborate, maybe provide the URL (i can respect being weary of that) but otherwise you will be more receiving a shot at the dark as opposed to a definitive answer.Also does your theme or any plugins create a custom registration form? – DigitalDesigner Aug 1 '17 at 3:49

My research: "By default, WordPress websites allow for user registrations from a specific link: http://www.example.com/wp-login.php?action=register. These spambots are programmed to go looking for that link to register fake users."

So, your first step is to change the login page from wp-login.php to something else. Unfortunately, this is not the easiest thing to do by yourself. But fortunately, there are many plugins that will help you do this; one is the Better WP Security plugin, described here https://managewp.com/change-your-wordpress-login-url . (Find others by looking in the plugin directory for 'registration spam'.)

Haven't dug into the wp-login.php code for hooks to change things, that's is a bit beyond this answer. A plugin that has already done the work might be a better choice, unless you like 'reinventing the wheel'.

It is also possible that an htaccess that checks for that specific URL and looks for a referring page on your site might work. But that is not entirely foolproof, as a spammer can spoof the referring page. One of the many existing 'stop registration spam' plugins might be easiest for you.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.