You open Users and there are forty accounts you did not expect. Names like `xrkq8842`, addresses at domains you have never heard of, none of them have done anything since signing up.
Most advice treats this as tidying. It is not. Understanding what the accounts are for tells you how urgent it is.
What fake registrations are actually for
Comment and content privileges. On many sites, a registered user can post comments without moderation, or submit content. An account is a bypass for the protection you put on the front end.
Reconnaissance. A registered account, even a subscriber, can see endpoints and pages a logged-out visitor cannot. It is a cheap way to map what your site runs.
Waiting for a mistake. An account created today costs nothing to hold. If a plugin later grants subscribers a capability it should not, or an upgrade changes a default, every dormant account becomes useful at once.
Profile-field spam. Bio, website and display-name fields sometimes render publicly — on author archives, in comment markup, or in structured data. That makes an account a place to park links.
Database weight. Forty accounts is nothing. Forty thousand — which is entirely achievable if a form is left open for months — slows user queries and makes real administration miserable.
The honest summary: a fake account is rarely damaging on the day it is created. It is an option the attacker holds, cheaply, against something changing later.
Why your registration form gets found
If `wp-login.php?action=register` responds, it will be found. Bots crawl for it directly — no link from your site is needed.
The same applies to WooCommerce account creation, membership plugin signups and any custom registration form. If it creates a user, it is a target.
How to stop it, in order
1. Ask whether you need open registration at all
Settings → General → Membership. If “Anyone can register” is ticked and you do not run a shop, a membership site or a community, untick it. The whole problem disappears.
This sounds too obvious to mention, but a great many WordPress sites have it enabled because a theme or plugin turned it on years ago and nobody looked again. Check yours before doing anything else.
2. Honeypot and timing on the registration form
The same two checks that work on contact forms work here, for the same reason. A hidden field a human never sees; a submission arriving faster than a person could type.
Registration is actually a better fit for timing checks than a contact form — creating an account involves choosing a username and password, which takes real people longer than they think.
3. Rate limits per address and network
Registration abuse is rarely one account. It is a run of them from one network, often within a few minutes. A per-address limit catches the naive version; a per-network limit catches the real one.
4. Disposable address detection
Bot registrations lean heavily on throwaway mailboxes. If the address will not exist in ten minutes, the account behind it is not a customer.
This is the single highest-yield check on registration specifically — more so than on contact forms, because a genuine customer creating an account almost always uses an address they intend to keep.
5. Email confirmation before the account becomes usable
Requiring a verified address before the account can do anything removes most of the value of a bot signup. Many membership and WooCommerce setups support this natively.
6. Country rules, if your customers are local
If you serve one region, excluding the rest removes a large volume of automated signups at a stroke. Only use this if you genuinely have no international customers — it is a blunt instrument, and you will not see the people it turns away.
What to do with the accounts you already have
Do not bulk-delete on a hunch. Check first:
- – Zero posts, zero comments, zero orders — the safe signal.
- – Registered in a burst — sort by registration date. Real signups arrive scattered; bot signups arrive in clusters.
- – Disposable email domain — a strong indicator on its own.
Where a user might have made a purchase, be careful: in WooCommerce, deleting a user can orphan order records. Check for orders before removing anyone.
How to know whether the fix worked
Registration spam is bursty. It can stop for a fortnight for reasons that have nothing to do with your settings, which makes it very easy to credit the wrong change.
The reliable approach is to watch rather than guess. GatekeepWP scores registration attempts alongside form submissions, and Monitor Mode records what it would have blocked without acting. A fortnight of that tells you whether the attempts stopped or your protection is doing the work — a distinction you cannot make from the Users screen alone.
Frequently asked questions
Are fake WordPress user registrations dangerous? Individually, rarely. They matter because they are cheap to hold and become useful the moment a plugin grants subscribers a capability it should not, or a profile field renders publicly.
Should I just disable registration? If you do not need it, yes — Settings → General → Membership. It is the most complete fix available. Only keep it enabled if a shop, membership or community genuinely depends on it.
Will a CAPTCHA stop bot signups? It reduces them. It will not stop a bot posting directly to the registration endpoint, and it costs you some genuine signups, which matters more on registration than on a contact form.
Is it safe to delete spam accounts in bulk? Only after checking for orders, posts and comments. In WooCommerce especially, deleting a user can leave orders orphaned.
Why do the fake accounts have real-looking names? Because names are trivial to generate. The reliable signals are the address domain, the registration timing pattern and the complete absence of activity.
TL;DR — Check whether you need open registration at all first. If you do, apply honeypot, timing, rate limits and disposable-address checks, and verify email before the account can do anything.
Related: How to stop WordPress contact form spam — the same checks, applied to forms.
Try it: GatekeepWP protects registration, login, comments and every form on the site from one install. Free, no account, no API key.
