Letting visitors register on your WordPress site: roles, bots and the risks

WordPress & CMS·· 29 views· 2 min read

The short answer: WordPress can let anyone create an account (Settings > General, “Anyone can register”). It only makes sense if the site needs accounts (a members area, a shop, a forum). On a presentation site it is opening a door to bots: leave it off.

If you need it, what to set

Setting Recommendation
New user default role Subscriber (the lowest). Never “Editor” or “Administrator”: see Which role to give.
Against bots A captcha on the registration form and e-mail confirmation: A captcha on the WordPress login.
Against account spam Manual approval of new accounts, or a plugin that filters them: Fake sign-ups.
What data to ask for The minimum: e-mail and name. Every extra detail is your responsibility: Personal data protection.
Who sees what Subscribers must not access the site’s administration; check they only see their profile.

Switching on and controlling, step by step

1 Decide whether you really need it. If the answer is “so customers can see their orders”, the shop handles that, not the general registration.
2 Switch it on under Settings > General: “Anyone can register” and choose the “Subscriber” role.
3 Add the captcha and the e-mail confirmation before publicising the registration page.
4 Review the new accounts every week (Users) and delete the suspicious ones: Protecting the WordPress login.
5 If it is too late and the site filled with fake accounts, switch registration off, delete the subscribers you do not know (with a backup) and change the default role.
Too many accounts are a real risk. A bot can create thousands of accounts, fill the database and test plugin flaws against them. And if the default role is badly chosen (an “Editor”), anyone can write on your site. Confirm the role before opening registration.
For real members areas, use a solution of its own, instead of the general registration: Which plan for a membership site.

Already have strange accounts on your WordPress and want help? Open a ticket with the address.

Open a support ticket

SEE ALSO

Adding a WordPress user, and which role to give them

Putting a captcha on the WordPress login

Fake orders and spam sign-ups in WooCommerce: how to stop them

Protecting the WordPress login: three steps in order of effect

RECOMMENDED PRODUCT

WordPress hosting

One-click install, updates handled, and speed that holds up. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

WordPress & CMS 1,402 How to install WordPress in a few clicks You don't have to download WordPress, create a database and upload files by hand. The installer in cPanel does all of it...
WordPress & CMS 1,251 Common WordPress errors: white screen, critical error and how to find the cause The site stopped opening and shows a blank white screen, or the line «There has been a critical error on this website»....
WordPress & CMS 775 Cannot get into the WordPress dashboard: the six usual causes The site opens, but the admin dashboard does not. Either it asks for the password in an endless loop, or it says the det...
WordPress & CMS 735 How to remove WordPress from a domain, without leaving anything behind You want WordPress off a domain, because the installation broke, because you are starting over, or because the site is b...
WordPress & CMS 1,149 Protecting the WordPress login: three steps in order of effect WordPress’s login address is the same on every site in the world: /wp-admin and /wp-login.php. That means any automated...
WordPress & CMS 27 XML-RPC in WordPress: what it is and whether to switch it off The short answer: xmlrpc.php is an old WordPress file that lets outside programs publish to your site. Most sites no lon...