How to Stop Spam Registrations on your WordPress Membership Site

Dealing with spam registrations on your WordPress membership site can be a real headache. Spam users can clutter your database and waste your time.

We heard from many of our readers that they notice this issue when they allow user sign-ups. We also have our free video tutorials set up on a members’ only site, so we have dealt with spam registrations firsthand. They are annoying and can slow down your website.

In this guide, we will help you stop spam registrations on your WordPress membership site. With just a few simple steps, you can keep your site spam-free.

Why Do Spammers Register On Your Site in the First Place?

Generally, spammers are looking for easy access points to get their way into your site. They often go about making spam accounts on less secure websites using spam bots and other automation.

This allows spammers to collect your email address and try to distribute their phishing links, which are designed to distribute malware to other members.

Let’s say a plugin on your site has a vulnerability. Then, spammers can easily exploit it if they can log into your dashboard.

Now, the default WordPress registration process lacks strong anti-spam mechanisms. That’s why you’ll need third-party tools in most cases.

Fortunately, if you use a form builder for user registration, you can apply the same anti-spam strategies as you do for contact form spam.

With that in mind, we’ll give you some ways to stop these spam bots and ensure all submissions are from real people. Simply follow these methods to maintain a clean and efficient membership site:

Ready? Let’s say goodbye to the hassle of spam.

Method 1: Turn On Email Activation for User Registration

One of the easiest and most efficient ways to deal with spam registrations is using a form builder with an email activation feature.

Email activation is a feature that automatically sends out a verification link for every new account that’s created on your WordPress site. Real users must click on the email confirmation link to complete the signup.

WPForms is the best form builder plugin on the market, with a variety of spam defense features. It also comes with a User Registration Addon that allows you to create custom registration forms.

You will need a Pro License to access the user registration add-on and the email activation feature. The good news is that WPBeginner users can use the WPForms Coupon to get 50% off their purchase.

Now, the first thing you need to do is install and activate the WPForms plugin. For more details, you can see our step-by-step guide on how to install a WordPress plugin.

Upon activation, you’ll want to go to WPForms » Settings to verify your license key. You can get this key from your account on the WPForms website.

After verification, you can navigate to WPForms » Addons. Then, simply scroll down the page to locate the ‘User Registration Addon.’

Once found, go ahead and click the ‘Install Addon’ button.

The next step is to create a user registration form. To do this, let’s go to WPForms » Add New.

You’ll then be prompted to provide a title for your new form. After that, you’ll want to find the user registration form template. Once you have found it, simply hover over it and click on ‘Use Template’.

This will launch the form builder with a user registration form template. You can edit the fields by clicking on them.

You can also drag and drop fields to rearrange them.

In the ‘Settings’ panel, you can configure form notifications, confirmation, and user registration settings.

Let’s open the ‘User Registration’ section.

On this page, you can map the form fields to your WordPress user registration fields. Then, you might want to scroll down and check the box next to the ‘Enable User Activation’ option. This will reveal a dropdown menu where you can select a user activation method.

WPForms uses 2 creative ways to prevent spam registrations on a WordPress site.

You can choose to send a verification email to each user so that they can confirm their registration. Alternatively, you can require admin approval for each registration on your WordPress site.

Feel free to choose the option that best suits your needs and click the ‘Save’ button to store your form settings.

You can now add this form to any page on your WordPress site and then use that page as your user registration page.

Simply click the ‘Embed’ button at the top.

Then, you can either click the ‘Select Existing Page’ or ‘Create New Page’ option.

For this tutorial, we’ll choose the ‘Select Existing Page’ to embed the new form into an existing page on our website.

On the next pop-up window, you’ll select a page from the dropdown menu.

After that, you can go ahead and click on the ‘Let’s Go!’ button.

You’ll then be taken to the block editor in WordPress.

From here, you can click the ‘+’ button to add the WPForms block. Then, you’ll select the form you just created from the dropdown menu. You should then be able to see the form in your editor.

When you’re ready to publish the page with the embedded user registration form, simply click ‘Save’ or ‘Publish’ to launch it.

Now, if you visit your website, you will see your spam-proof user registration form.

Depending on your user activation settings, the plugin will either require users to verify their email address or an admin will have to manually approve each user registration on your site.

Method 2: Adding a reCAPTCHA Field to Your User Registration Form

Another simple way to block spambots from getting through is to use reCAPTCHA.

This free Google service is the more advanced version of the CAPTCHA method, and it helps protect websites from spam by distinguishing between automated bots and human users.

To add reCAPTCHA v3 to your forms, head over to WPForms » Settings in your WordPress dashboard. Then, click on the ‘CAPTCHA’ tab.

Next, you want to select ‘reCAPTCHA’ and make sure that the ‘Checkbox reCAPTCHA v2’ option is enabled.

This will force new users to check a box that proves they’re human.

WPForms will also ask you for a ‘Site Key’ and a ‘Secret Key.’ You can get this information by heading over to Google’s reCAPTCHA setup page.

When you’re on the Google reCAPTCHA page, you’ll want to click on ‘v3 Admin Console.’

You’ll then be taken to a screen where you will register your WordPress website. Simply type in a name under ‘Label,’ which is used for internal reference and won’t be visible to others.

After that, you can choose the ‘Challenge v2’ option and the ‘I’m not a robot Checkbox’ underneath that.

From there, you can type in your website’s domain name in the ‘Domain’ field.

Then, you might want to check out the Google Cloud Platform Terms of Service and check the agreement box.

When everything is set, just click the ‘Submit’ button to finish the configuration.

Now, you’ll see a page with your website’s site key and secret key.

Simply copy this information.

Now, you can head back to the WPForms » Settings » CAPTCHA page.

Then, be sure to click the reCaptcha box to open its customization panel. After that, simply paste your keys into the ‘Site Key’ and ‘Secret Key’ fields.

Once you’ve done that, simply scroll down the page and hit the ‘Save Settings’ button.

From there, you’ll want to go to WPForms » All Forms from your WordPress admin area. Then, let’s choose the user registration form to which you want to add the reCAPTCHA and select ‘Edit.’

Doing this will now open up the form builder.

Then select the ‘reCAPTCHA’ button in the left side panel.

You should see a message appear telling you that your Google Checkbox v2 reCAPTCHA has been enabled.

Go ahead and click ‘OK.’

To confirm that it’s there, you’ll see the ‘reCAPTCHA Enabled’ verification at the top right corner of your form.

When you’re done, remember to save your changes by clicking the ‘Save’ button.

Method 3: Use Custom CAPTCHA to Prevent User Registration Form Spam

Sometimes, you may want to use a custom captcha instead of reCAPTCHA. That’s because some users have privacy concerns since it involves interacting with Google’s servers.

WPForms Pro comes with a custom CAPTCHA add-on allowing you to create a question-based CAPTCHA, typically in the form of a math equation, to block user registration form spam.

All you have to do is edit the user registration form to which you want to add the custom CAPTCHA. This will open the form builder.

In the left side panel menu, you’ll want to find the ‘Custom Captcha’ button under ‘Fancy Fields’ and drag it over to your form.

By default, the field shows a random math question. If you use this default setting, then WPForms will automatically generate random math questions for every user who fills out the form to make it less predictable.

You can also customize the questions to visitors to challenge users to enter the correct answers.

For example, sometimes, in membership or job application forms, you may want to include a keyword that you want users to mention in the form. This shows that they read through the application and aren’t blindly submitting forms through copy and paste.

To make edits, you’ll want to click on the ‘Custom Captcha’ field within your form builder. Then, let’s make sure you’re on the ‘General tab’ in the left-hand panel.

Simply select ‘Question and Answer’ under the ‘Type’ dropdown, and just add any questions you’d like.

If you decide on the ‘Question and Answer’ format, make sure to include a few different questions. That way, WPForms can rotate those questions randomly, so it’s more difficult for spambots to predict.

Once you’re done, go ahead and save your changes.

Now, you have a custom CAPTCHA button that can easily prevent new spam user accounts.

Method 4: Enable the WPForms Anti-Spam Token

Using WPForms offers many security advantages. For one, It has a built-in anti-spam protection feature that verifies a token for each submission.

Spam bots can’t detect this token and, therefore, won’t be able to submit the form. Since the token is embedded into the HTML, it doesn’t affect the user experience.

Every new form automatically has this feature enabled. If you want to check for yourself, navigate to the ‘Settings’ panel. Then click on the ‘Spam Protection and Security’ tab.

You should see that the ‘Enable anti-spam protection’ is toggled on.

Method 5: Connect Your Form to Akismet

Akismet is a popular spam-filtering plugin designed to combat comments and form submission spam on websites. It assesses the submission for signs of spam, including spammy keywords and links to suspicious websites.

If you’re already using the Akismet plugin, then you can connect it to WPForms. This ensures your user registration forms get the same spam protection that you also have in your blog comments.

Let’s edit the forms you want to filter spam for and head to Settings » Spam Protection and Security. From here, you can toggle on the ‘Enable Akismet anti-spam protection’ option.

Method 6: Block Specific Email Addresses on Your User Registration Forms

Not all spam registrants will be bots. You may get spam submissions from humans as well. Sales agents and scammers are often lurking on websites trying to solicit their products.

CAPTCHAs won’t work against humans, which is why you’ll need to analyze the common types of spam you get and choose the appropriate method.

One way to deal with solicitors is to create a ‘denylist’ of email addresses so that those visitors with that email address can’t create a new account on your WordPress site.

With WPForms, you can create an allowlist and denylist for each form.

When in the form builder, simply navigate to the ‘Fields’ panel.

Then, you’ll want to select the ‘Email’ block from within your user registration form. Under the ‘Advanced tab,’ you’ll see an ‘Allowlist / Denylist.’

In the dropdown menu, you can choose ‘Denylist.’

In the box below, you can type in all of the email addresses you want to block from registering an account on your form.

The great thing about this feature is that you can simply type a complete email address or use an asterisk to create a partial match.

Then, simply separate the email addresses by using a comma. WPForms will automatically tidy up the list for you like so:

Method 7: Restrict User Registration by Country and Keywords

If you notice that your forms are targeted from a specific country or often contain specific keywords, WPForms offers various filters to block those entries.

The country filter accepts or denies submissions from specific countries.

To activate and add countries to deny, you can go to the ‘Settings.’ Then, you just need to click the ‘Spam Protection and Security’ tab and make sure the ‘Enable country filter’ is on.

Once you do that, you should be able to select ‘Deny’ from the dropdown menu and add all the countries that you want to deny user registrations from.

That said, country filtering may not be the best option for online stores.

For instance, if you own a WooCommerce store, any customers in the blocked countries won’t be able to access their accounts.

Method 8: Use Dedicated Anti-Spam Plugins

If you aren’t using WPForms to create new accounts, you may need dedicated anti-spam plugins. In that case, there are other options on WordPress that can add additional layers of spam protection for your user registration forms.

The Stop Spammers Security plugin is a reliable tool that gives you a lot of control over how you want to filter spambots.

The first thing you need to do is install and activate the plugin. For more details, see our step-by-step guide on how to install a WordPress plugin.

Once activated, you’ll want to navigate to Stop Spammers » Protection Options. Stop Spammer Security is a powerful WordPress plugin that aggressively monitors your website for suspicious spam activity.

The default settings on this page will work for most websites. However, you can uncheck a few of them if you feel lots of legitimate users are unable to log in.

You can even block users from specific countries if you wish. Once you’re done, click on the ‘Save Changes’ button to store your settings.

The plugin uses a number of spam prevention techniques. It uses HTTP Referrer and Header requests to verify that a user is genuinely accessing your website.

It also checks against Akismet API for known spamming activity. The plugin also maintains a list of bad hosts known for tolerating spam activity and blocks them.

Under Stop Spammer » Block Lists, you can block IP addresses, emails, and spam words.

The great thing about this plugin is that default settings have just about most spam defenses already activated.

That means there’s not much you need to do other than to install the plugin and test to see if it’s working.

Method 9: Stop Spam Registrations Using Sucuri

At WPBeginner, we used to use Sucuri to protect our website against spammers and other security threats.

Sucuri is a website security monitoring service. It blocks hackers, malicious requests, and spammers from accessing your site or injecting any malicious code.

For more details, you can check out how Sucuri helped us block 450,000 WordPress attacks in 3 months.

If you want an alternative, then MalCare is a great choice. It’s a powerful security plugin that comes with a bot protection feature.

We hope this article helped you stop spam registrations on your WordPress membership site. You may also want to read our guides on how to protect emails from spammers with WordPress email encoder and how to use Antispam Bee to block spam comments in WordPress.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.