I have a installation of Multisite that has a history of serious signup spam problems.

When we ran WPMU 2.9.2 we tried this .htaccess method, this math plugin, and CAPTCHAs. After little success with those options we added some common email domains to Limited Email Registrations. We noticed that even after adding this measure we were still getting signups from domains we had banned. This made me think that there was a hole somewhere in the signup script (explaining our limited success with other measures). Are there any known issues with Limited Email Registrations or any other holes in the signup process with older/current versions of WP Multisite?

We have since updated to 3.3.1 and continue to experience significant spam signups. With the .htaccess method, math plugin, bad behavior, and of course e-mail activation, we still get 20-50 spam signups a day. I have a hard time believing that their isn't a hole somewhere.

2 Answers 2


There is a known problem as described in this ticket and this blog post

The problem was identified in 2.9.2 but looks to also have been identified in 3.0.

From the sounds of it, the wordpress team won't fix this bug, because they feel spam is inevitable, and that it is the responsibility of spam protection plugin authors to account for this bug.


Have you tried ZBBlock yet?


It would help prevent known spammers and known spamming attempts. Just remember to enable the Stop Spam Forum option.

Also have you tried this plugin with optional .htaccess method? http://wordpress.org/extend/plugins/cookies-for-comments/

You could also try requiring a PHP session cookie. Once you have the cookie set: http://www.php.net/manual/en/session.configuration.php#ini.session.use-only-cookies you could do something like the following in .htaccess:

RewriteCond %{HTTP_COOKIE} !^PHPSESSID=\w+ [OR]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?example\. [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^wp-(login|register|signup)\.php http://example.com [R=301,L,NS] 

Where example.com is your domain

  • We use cookies-for-comments for comments and it seems to be very effective. I hadn't noticed the option to add it for signups, so I'll try this. Jun 29, 2012 at 21:24
  • You could also try requiring a PHP session cookie. Once you have the cookies set: <br/> php.net/manual/en/… you could do something like the following in .htaccess: <br/> 'RewriteCond %{HTTP_COOKIE} !^PHPSESSID=\w+ [OR] RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?example\. [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^$ RewriteRule ^wp-(login|register|signup)\.php example.com [R=301,L,NS]' <br/> Where example.com is your domain Jun 29, 2012 at 23:08
  • See above edits to my original answer. Jun 29, 2012 at 23:16
  • After a few days of experimenting, adding RewriteCond %{HTTP_COOKIE} !^.*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.*$` `RewriteRule ^wp-signup.php - [F,L] to .htaccess was very effective. The problem is that with a subdomain multisite install, I cannot link users to wp-signup.php from a network site. While I appreciate the recommendations, the main question is "are there holes in wordpress multisite that allow bots to bypass spam prevention methods?" because I've observed strange behavior and am surprised that it takes 5 different methods to combat signup spam. Jul 3, 2012 at 23:31
  • @ SomewhereThere. I don't have any experience with Multi-Site, because there are so many unknowns for me and that many plugins won't work. But it seems possible that if you require a cookie and/or a referer, in .htaccess that would stop a lot of spammers or sploggers. I do remember reading somewhere that some time ago some Black Hat SEO person figured out a way to spam BuddyPress and Multi-Site. I just don't remember finding out how they did it. Jul 4, 2012 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.