“How do I stop fake user registrations in WordPress?”
How do I stop fake user registrations in WordPress?
Short answer
Start in Settings, General: the Anyone can register checkbox decides whether the signup form exists at all, and New User Default Role decides what a new account gets, so keep it at Subscriber. Then challenge the forms bots use, wp-login and the registration page. CaptchaKit's WordPress plugin covers login, registration and comments, verifies the token server-side for you, and also covers WooCommerce checkout.
Steps
- 1
Check who can register
In Settings, General, under Membership, decide whether Anyone can register stays on at all. If you do not need open signup, uncheck it and the registration form disappears.
- 2
Set the default role to Subscriber
Same screen: New User Default Role offers Administrator, Editor, Author, Contributor or Subscriber. New accounts from an open form should get Subscriber, never anything with publishing rights.
- 3
Challenge the forms
Add a CAPTCHA to the login and registration forms. CaptchaKit's plugin covers login, registration and comments; configure it under Settings, CaptchaKit.
- 4
Verify on the server
The plugin verifies the token for you. On custom forms, post the token to the verify endpoint before wp_insert_user runs.
- 5
Watch the users list
Check the Users screen occasionally for accounts with odd emails or no activity. Delete what you do not recognize, and note the date.
The two settings that matter
WordPress documents both on the Settings General screen. Membership has the Anyone can register checkbox; New User Default Role sets the role for accounts created through registration, with Administrator, Editor, Author, Contributor and Subscriber as the choices. Abuse gets worse when the default is anything above Subscriber, because a fake signup inherits whatever the default grants.
Closing open registration is the only setting that removes the attack surface entirely. Everything else manages it.
Why bots register accounts
Fake accounts are rarely the goal; they are groundwork. OWASP's taxonomy of automated threats to web applications names fake account creation and spamming among its threat events, and both start with a signup form a script can fill. Accounts get used for comment spam or as a beachhead for password reset attacks.
The cheaper your signup is for a script, the more of this you get. That is the case for a challenge on the form itself, not just cleanup after it.
Adding the CAPTCHA
The CaptchaKit WordPress plugin covers login, registration and comment forms, plus WooCommerce checkout in classic and Blocks, with no code: install it, enter your keys, and pick the placements under Settings, CaptchaKit. The verify call happens server-side inside the plugin.
Prefer manual control? Any form can embed the widget with a script tag and a div and post the token to your own handler. Start from how to verify a CAPTCHA token.
Cheap layers that help
Keep WordPress and your plugins updated, since registration abuse often rides known holes. Require email confirmation before an account can do anything, using whatever membership setup you already have. Limit repeated registrations from one IP at the server or CDN level. And audit the users list on a schedule; a weekly glance catches slow drips that alerts miss.
Questions
Should Anyone can register be on?
Only if you actually need open signup. Otherwise turn it off and the registration form disappears.
Where are these settings?
Settings, General, in the Membership section of the screen.
What should New User Default Role be?
Subscriber. Administrator, Editor, Author and Contributor all grant powers a stranger should not inherit.
Which forms does the CaptchaKit plugin cover?
Login, registration and comment forms, plus WooCommerce checkout, classic and Blocks.
Where do I configure the plugin?
In wp-admin under Settings, CaptchaKit.
Does a CAPTCHA stop all fake signups?
It stops scripts filling the form. Pair it with registration settings and IP-level limits for the rest.
I also run WooCommerce. What about fake orders?
See fake orders and card testing in WooCommerce for the checkout-side layers.
Sources
- WordPress documentation: Settings General screen (checked 2026-10-18)
- OWASP Automated Threats to Web Applications (checked 2026-10-18)
- CaptchaKit WordPress plugin (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.