How to Stop Spam User Registration in WordPress

Turn Off Open Registration (the Fastest Fix)

If visitors never need to create an account on your site, close the registration form entirely. The change takes effect as soon as you save it.

1. Log in to the WordPress dashboard and go to Settings > General.
2. In the Membership section, uncheck Anyone can register.
3. Click Save Changes at the bottom of the page.

With this box unchecked, the public registration link and the wp-login.php?action=register page stop accepting new accounts. Existing users can still log in normally.

If You Need Registration Open, Add Verification

Some sites genuinely need open sign-ups: forums, communities, or sites that gate content behind a free account. In that case, add a challenge that bots fail but humans pass.

1. Install a CAPTCHA or honeypot plugin from the WordPress Plugin Directory that specifically supports the registration form, not just comments or login.
2. If the plugin uses Google reCAPTCHA, create a site key and secret key in the reCAPTCHA admin console, then paste both into the plugin's settings screen.
3. Enable the challenge on the registration form in the plugin settings. Many plugins apply it to login or comments by default and leave registration unchecked.
4. Open the registration page in a private or incognito browser window and confirm the challenge appears before submitting.

A honeypot (a hidden field real users never fill in, but bots do) works well as a lighter alternative to visible CAPTCHA and doesn't add a visible step for human visitors.

Switch New Accounts to Manual Approval

Core WordPress does not include a built-in approval queue for new user accounts. If your site runs on a forum, membership, or community plugin, check whether that plugin offers moderation for new sign-ups.

1. Open the settings screen for your forum, membership, or community plugin.
2. Look for an option such as Require admin approval for new accounts or Moderate new registrations and enable it.
3. Set the New User Default Role in Settings > General to Subscriber so unapproved accounts have minimal access while they wait for review.

This adds a manual step, but it is a reliable backstop when automated filters miss a batch of sign-ups.

On WooCommerce or Membership Sites

Store and membership sites often need accounts tied to a real purchase or payment attempt, which filters out most registration bots on its own.

1. Go to WooCommerce > Settings > Accounts & Privacy.
2. Uncheck Allow customers to create an account on the "My account" page if accounts should only be created during checkout.
3. Leave account creation enabled only at checkout. A bot that has to complete an order and payment attempt to get an account is far less likely to bother.

Menu names in WooCommerce settings can shift between versions, so confirm the exact label in your installed version before changing anything.

Multisite Networks

Multisite installs control registration at the network level, separately from each individual site's settings.

1. Go to My Sites > Network Admin > Settings.
2. Under Registration Settings, set Allow new registrations to Registration is disabled unless the network genuinely needs open sign-ups.
3. If sign-ups must stay open, enable the notification option that emails the network admin on new registrations, and check the Network Users list regularly.

Clean Up Existing Spam Accounts

Closing registration stops new spam but leaves old spam accounts in place. Remove them separately.

1. Go to Users in the dashboard. The default list doesn't include a sign-up date column, so filter by the Subscriber role first if that's where new accounts land, or sort by Username or Email to spot repeated patterns.
2. Check the box next to accounts that are clearly spam: garbled usernames, matching or disposable email domains, no posts or activity.
3. Choose Delete from the Bulk actions dropdown above the list and click Apply.
4. On the confirmation screen, choose whether to delete or reassign any content attributed to those accounts, then confirm.

Work through the list in batches rather than trying to clear a large number of accounts in one pass, and double check each batch before deleting since this action cannot be undone from within WordPress.

When Spam Keeps Getting Through

If spam accounts still appear after applying the steps above, check these in order:

• Confirm the CAPTCHA or honeypot is actually active on the registration form itself, not only on login or comment forms.
• Check whether a caching plugin is serving a cached copy of the registration page that doesn't include the verification script. Exclude that page from caching if so.
• Look at your security or firewall plugin for rate limiting on wp-login.php and, on multisite, wp-signup.php. Repeated rapid requests from the same IP range are a sign of automated abuse that a firewall rule can block before it reaches WordPress.
• If registrations arrive through a custom form built with the REST API rather than the default WordPress form, verify that form has its own verification step, since plugin settings for the default form won't cover it.
• If the volume is heavy and consistent, ask your hosting provider whether they offer server-level bot filtering, since some abuse is easier to block before it reaches PHP.