Fake WordPress registrations: how to stop bots without making life harder for customers

Fake WordPress registrations are stopped in layers, not with one trick. Invisible traps, email address confirmation, and control over where accounts come from and how fast they are created. CAPTCHA alone? It won’t solve the problem, and it can scare off real buyers too. I’m writing this for WooCommerce store owners and company website owners whose user base keeps swelling with ghost accounts. I’ll show you how to spot the problem, which safeguards customers won’t even notice, and how to clean up what has already piled up without throwing the baby out with the bathwater.

Where do fake WordPress registrations come from and what harm do they do?

Accounts are created by bots. They look for forms at predictable addresses, like wp-login.php?action=register or the WooCommerce „My account” page. Why? It varies. To drop spam links into profiles and comments, test stolen logins and passwords, sign up for a newsletter, or try to gain higher privileges through a plugin vulnerability. And it’s not just the admin’s problem. Your customer base loses its value, bounced emails hurt your sender domain’s reputation, your stats show growth that isn’t there, and the server churns through worthless traffic. Then there’s GDPR (which everyone likes to forget): if you keep personal data you don’t need, you also have a duty to clean up the database regularly.

How do you spot user registration spam in the dashboard?

By patterns. Real customers simply don’t behave like this. What I look at first:

• random strings of characters as usernames,
• addresses from disposable email domains,
• a series of accounts created a few seconds or minutes apart,
• accounts with no orders and not a single login.

Open the Users list and sort by registration date. Add the WooCommerce customer report and the server logs for the form’s address. Then ask the question that I think people ask far too rarely: do you even need registration? If your store supports guest checkout, just untick „Anyone can register” in Settings > General. Problem solved.

Safeguards customers never see: honeypot, fill-in time, limits

The best bot protection for a registration form is the kind the customer has no idea about. A honeypot is a hidden field. People can’t see it, so only a bot fills it in, and that submission goes straight to the bin. Timing works in a similar way: a form sent a split second after the page loads probably wasn’t typed by a living person. Who types that fast? Nobody. Here’s a set that doesn’t add a single click for the buyer:

• a hidden trap field (honeypot),
• a minimum time between opening and submitting the form,
• a limit on registrations from one IP address within a set time,
• blocking disposable email domains.

CAPTCHA is the second line of defence, not the first. And ideally an invisible one, with no puzzles. Classic image grids with pedestrian crossings annoy people and can kill a purchase or an event sign-up halfway through.

Email verification at registration: how to set it up without losing customers

The rule is simple: an account becomes active only after the link in the email is clicked. A bot with a fake address will never click it. The message itself should be short and clear, with a visible button, an option to resend the link and a sensible expiry time. But be careful: in a store, don’t block the purchase until confirmation. Let people finish the order and leave activation for later. Otherwise you lose sales by your own hand. Then there’s deliverability, which few people think about at the start. If WordPress sends mail without properly configured SMTP and domain records, the link will land in spam or never arrive at all. Real customers get hurt, not bots.

A custom form instead of the default one: a less predictable target for registration form bots

You move registration from wp-login.php to a regular page on your site, where you decide how the form looks and works. You can do this with the Custom User Forms PRO plugin. The [custom-register-form] shortcode shows the registration form on a page of your choice, and [custom-login-form], [custom-password-lost-form] and [custom-password-reset-form] handle login, password recovery and password reset. For developers there’s also the cuf_notification_new_user hook, which sets where and which notifications go out after an account is created. For example, to an administrator who reviews new registrations. Oh, and a bonus: a custom form is easy to match to the rest of the site, so customers don’t suddenly land on an unfamiliar system screen.

How do you clean up existing fake accounts step by step?

Backup first. At the end, check the content assigned to the accounts you’re deleting. In between, take it calmly, one step at a time:

1. Make a full backup of the database.
2. Filter out accounts with no orders and no logins.
3. Manually review a sample of the results to confirm they are bots.
4. Delete in batches, not all at once.
5. Check that the accounts you’re deleting have no posts, comments or orders assigned.

Be careful with real customers who bought as guests or simply haven’t logged in for a long time. In the filter they look very similar. After the cleanup, watch new registrations for a few weeks. Only then can you see which safeguard is really doing the job.

All in all, the recipe is short: invisible traps, email address confirmation and a custom form instead of the default registration page. If you’re a busy admin, go in this order. First the honeypot and limits, because they don’t get in customers’ way at all. Then email verification. And the database cleanup at the very end, once the flow of new ghost accounts has clearly dropped.

Frequently asked questions