13

I wonder if there is a way of disable user-registrations completely? I have a client that is really in no need of adding users. For me that would be an extreme measure of security. Of course I must be able to add users through code or similar.

Is there a way of achieving this?

bestprogrammerintheworld
  • 5,417
  • 7
  • 43
  • 72

7 Answers7

21

You can disable your user-registration by routing to Settings > General and then do the following:

Search a checkbox that says “Anyone can register” Uncheck this, so nobody can register on your blog. Now when someone accesses the login page, there will no longer be a “Register” link they can use.

http://www.netwebbing.com/wordpress-user-registration-disable/

Also if you still want a registration page, that's kind of secure. Look at the following:

http://www.onextrapixel.com/2013/01/24/how-to-create-an-effective-registration-page-for-wordpress-sign-up/

Kees Sonnema
  • 5,759
  • 6
  • 51
  • 106
  • 11
    This is *security by obscurity* by WordPress. Also known as ***no security***. Hiding the link to the script does not hide/disable the script. Is there an effective way to not allow bots to create 500 subscribers / hour programmatically? – tao Jan 04 '17 at 17:37
8

Tried to find a plugin / SO answer to disable user registration completely (as in: prevent bots from registering accounts when Anyone can register is unchecked).

Couldn't find any, so I made this plugin.

tao
  • 82,996
  • 16
  • 114
  • 150
7

Besides disabling checkbox Settings > General > Anyone can register, you may want to add a simple mod_rewite to your .htaccess @Andrei Gheorghiu is right, Hiding the link to the script does not hide/disable the script.

So, something like that will prevent spam boots to register, return a '403 access denied', and keep your logs lighter

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} ^.*(wp-login.php\?action=register).* [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>
Grashopper
  • 449
  • 1
  • 7
  • 15
1

Didn't want to install an extra plugin if there was a simple way around this (and it felt like there was one).

I simply followed the PHP logic that handles registration, and it seemed to point to a single script:

wp-signup.php

I renamed that script, and I am confident there won't be more attacks. I'll update this post in a couple of weeks.

Konstantinos Vasileiadis
  • 595
  • 4
  • 8
1

Another gaping loophole for account creation that I found on our site was created by WooCommerce.

There is an option under:

WooCommerce Settings
Accounts & Privacy
Allow customers to create an account on the "My account" page

And the default (at least for us) was to have it on.

Fred Andrews
  • 648
  • 9
  • 18
1

Another option -- if you just want to update via DB change:

update wp_options set option_value=0 where option_name="users_can_register";
tres
  • 1,282
  • 1
  • 13
  • 15
0

It is actually really easy to find:

enter image description here

source: https://www.competethemes.com/blog/disable-user-registration-wordpress/

user1767754
  • 23,311
  • 18
  • 141
  • 164
  • 1
    It is actually really easy to bypass. Please read the comments on your source article. – tao Nov 09 '18 at 20:28