Spam User Registrations: How to Stop Fake Sign-Ups

Every account on your website is a key cut for somebody. For a customer, it opens a single drawer: their own order history, their address, their password. For a bot, the same key is a way into the building, and an open registration form is a locksmith that cuts one for anyone who asks.

That is the whole problem with spam user registrations. You open the Users screen in WordPress, or the Customers list in WooCommerce, and find dozens or hundreds of accounts you never expected. Random strings for names. Email addresses at domains you have never heard of. All registered in bursts at odd hours. Nobody bought anything, and nobody ever logged in again.

This is a reference for the owner who has just noticed: where these accounts come from, what the people behind them want, and how to close the doors without locking out real customers.

What spam registrations look like from your side

The symptoms are mundane, which is exactly why they get ignored.

A Users list you do not recognise. Under Users in the WordPress dashboard, the newest accounts carry names like "qhxbtrw", or a plausible first name followed by a string of numbers.
New user registration emails. The wordpress.org documentation lists user registration among the notifications sent to your site's administration email address. If they stopped bothering you months ago, someone filtered them into a folder.
A WooCommerce Customers list full of people with no orders.
Bounce messages and spam complaints you cannot explain, sometimes flagged by your email provider rather than spotted by you.

None of this breaks the site, which is why it sits there for months. The damage is quieter.

The three doors bots walk through

On a typical small business WordPress site, accounts get created in three places. Each has its own setting, and closing one does nothing to the other two.

Door	Where the setting lives	Who genuinely needs it open
WordPress membership	Settings, General, Membership	Membership sites, private client areas
WooCommerce accounts	WooCommerce, Settings, Accounts and Privacy	Shops selling subscriptions or offering order history
Plugin registration forms	Inside each form, membership or course plugin	Courses, member directories, trade price lists

WordPress runs roughly four in ten websites, according to W3Techs, which is exactly why bots know where its sign-up forms live.

Door one: the WordPress Anyone can register box

WordPress has a single checkbox under Settings, then General, labelled Membership. The wordpress.org documentation describes it plainly: tick it "if you want anyone to be able to register an account on your site." Directly beneath sits the New User Default Role, which decides what powers every new account receives. The valid choices run from Subscriber all the way up to Administrator.

Two things go wrong here. Themes, demo content and old tutorials sometimes leave the box ticked on sites that never needed it. And occasionally the default role gets changed during some one-off task and is never changed back. Open registration combined with a default role of Editor or Administrator is not a spam problem. It is a hand-over of your website to whoever finds the form first. If I were auditing a site moving onto new hosting, this is one of the first screens I would open.

Door two: WooCommerce customer accounts

WooCommerce runs its own account system on top of WordPress. Its Accounts and Privacy settings, as documented on woocommerce.com, separately control account creation during checkout, after checkout, and through a registration form on the My Account page. Bots love that last one: a standalone form with nothing to buy and nothing to slow them down.

Guest checkout lives on the same screen. With it enabled, shoppers can pay without creating an account at all. One exception matters: WooCommerce notes that customers still need an account to purchase subscriptions.

Door three: plugins with their own sign-up forms

Form builders, membership plugins, course platforms, event plugins and forums often ship their own registration forms, and those forms create WordPress users independently of the core checkbox. You can untick Membership, feel safe, and still be collecting spam accounts through a "Join our community" form a plugin added two years ago. Each one has to be found and verified on its own.

Three separate doors, three separate settings. Closing one leaves the others open.

What the bots actually want

Owners tend to assume spam registrations are harmless noise. Some are. The rest fall into three categories that are anything but.

They want your website to send email for them

Every form that sends a welcome email or a password setup link is, to an attacker, a free email cannon pointed at whatever address gets typed in. The Swiss National Cyber Security Centre warned about exactly this in February 2026, describing a rise in subscription bombing: attackers submit a victim's address to real sign-up and contact forms on legitimate websites until their inbox floods. The aim, the NCSC explained, is often to bury one important message, a fraud alert or a transaction confirmation, while an account is emptied somewhere else. Because "the emails originate from legitimate servers around the world," ordinary spam filters struggle to stop them.

Your website is one of those legitimate servers. And the victim, drowning in welcome emails they never asked for, does the only thing they can. They mark yours as spam.

That has a cost you will feel. Google's email sender guidelines tell senders to keep their user-reported spam rate below 0.1% and never let it reach 0.3%. At a small site's modest volume, it does not take many complaints to push your reputation the wrong way. The next message to land in a customer's junk folder is their order confirmation, or the quote they asked you for on Monday. The customer does not blame a bot. They assume you never replied.

They want a foot in the door for logged-in vulnerabilities

This is the one that worries me most, because it stays invisible until the day it does not. Security advisories for WordPress plugins often say a flaw requires the attacker to be authenticated with "subscriber-level access or higher." Owners read that and relax, because surely nobody can log in to their site. With registration open, anybody can. Subscriber is the lowest role WordPress has, and it is exactly what a spam account gets.

A real example from this summer. Spain's national cybersecurity centre, INCIBE-CERT, published an advisory on 28 July 2026 for CVE-2026-15992, a flaw in the WP Password Policy plugin up to and including version 3.7.1. Missing authorisation checks let authenticated users with subscriber-level access or higher escalate their privileges, as far as the administrator role. It was rated high severity, 8.8 out of 10. On a site with registration closed, exploiting it needs a stolen password first. On a site with registration open, it needs a sign-up form and about thirty seconds.

That pattern repeats across the plugin ecosystem, which is why I keep coming back to the point made in our look at why WordPress plugin vulnerabilities surged and what most hosts did about it: the raw number of flaws matters less than how many of them your configuration makes reachable. Open registration quietly converts a long list of needs-a-login bugs into needs-nothing bugs.

They want your data to look like their data

The least dramatic motive lasts longest. Spam accounts pollute your customer count, your mailing list if registration ticks a newsletter box, and your analytics if sign-ups count as conversions.

Many also carry a real person's email address, typed in during a bombing run. That person never dealt with you, yet your database holds their address, which sits awkwardly with GDPR's principles of data minimisation and storage limitation. Deleting obvious spam accounts is good practice; for anything less clear-cut, check the Data Protection Commission's guidance or ask your solicitor. The wider picture is in our complete guide to WordPress security and backup for Irish websites.

Does your website need public sign-ups at all?

Most do not. A brochure site for a plumber, a solicitor, a café or a consultancy has no reason to let strangers create accounts, because nothing sits behind a login that a visitor would want.

Shops are more nuanced. Accounts give returning customers their order history and a faster checkout; guest checkout gives you the sale without one. Most small shops are best served by keeping account creation tied to a real purchase and dropping the standalone registration form.

Then there are sites where accounts are the product. Consider a composite case built from a common pattern: a music school in Westmeath adds student logins so families can download practice sheets for the new term. Within a fortnight of September enrolment, the admin inbox is full of registration notices from addresses nobody recognises, while two parents ring to say their own welcome emails never arrived. The school does need accounts. It does not need an unguarded form that hands one to anyone. The answer is not closing the door. It is putting someone on it.

Closing the doors in five steps

Verify the core setting. In WordPress, go to Settings, then General, untick Anyone can register unless you genuinely need it, and confirm the New User Default Role is Subscriber (or Customer on a WooCommerce shop).
Audit WooCommerce accounts. Under WooCommerce, Settings, Accounts and Privacy, enable guest checkout, switch off the My Account registration form unless customers actually use it, and keep the option that sends new users a password setup link.
Find the plugin doors. List every plugin that can create users (forms, memberships, courses, events, forums) and either turn off its registration feature or add a challenge step and email confirmation before any account is created.
Clean up with a backup first. Take a manual backup, sort users by registration date, and remove accounts with no orders and no logins; WooCommerce's Retain inactive accounts setting can automate this from then on.
Watch for a fortnight. Keep registration notifications going to an inbox someone reads, and verify the Users screen weekly until the new accounts stop.

For sites that must stay open, the Swiss NCSC's advice to website operators is a sensible baseline: protect every public form with a challenge, limit sign-ups per IP address over time, and require the challenge to pass before any confirmation email goes out.

One warning on step four. If any users you select own posts or pages, WordPress asks what to do with that content before deleting them. Spam accounts own nothing, so if that question appears, a real staff account has slipped into the selection. Stop and look.

Verify the settings, clean the list, then keep watching for a fortnight.

What hosting can and cannot do about it

Be clear about where responsibility sits, because this is a place where hosting marketing tends to oversell.

A properly run platform should do four things here. Block sources that hammer the server with repeated abuse. Scan files for malware, so that if an escalation does succeed and someone plants code, it gets found rather than left to run. Keep nightly backups with a fast restore, plus a snapshot before risky changes, so a clean-up that goes wrong can be rolled back. And provide a staging environment, so you can change registration and checkout settings on a copy and verify the purchase flow before you deploy to production.

That is the standard. Web60 meets it with fail2ban intrusion prevention, server-level hardening, automatic malware scanning, nightly backups with one-click restore, automatic pre-update snapshots and one-click staging, all running on sovereign Irish infrastructure built to keep a small business site secure. When something looks wrong, the support team you reach is based in Ireland and made up of real people.

Where the server stops

Now the limitation, because it matters. No server can tell whether a sign-up from an ordinary home broadband connection is a customer or a bot. Modern registration bots rotate through thousands of addresses and fill forms at human speed, so intrusion prevention, which works by spotting repeated abuse from the same source, will not reliably catch them. Malware scanning finds what an attacker leaves behind, not the account they used to get in. Whether your site lets strangers create accounts is a decision made in your settings, and only you can make it.

When a bigger platform makes sense

A genuine concession: if you run a large membership business taking thousands of real sign-ups a day, with a team whose job is fraud, enterprise managed hosts offering dedicated bot management suit that workload better. That is not most businesses. For the café, the trades business or the small shop, the fix is a checkbox, a settings screen and an hour of tidying, on hosting that catches what gets through. And if you are starting from scratch, Web60's AI builder puts a full WordPress site live in under a minute for €60 a year, so you begin with only the doors you choose to open.

The upshot

Spam registrations look like clutter, and that is how they survive. Behind the clutter sits a form that can send email in your name to people who never asked for it, and a login that turns needs-an-account vulnerabilities into open ones.

The fix is rarely technical. Decide whether your site needs public accounts. Close the doors it does not need, and put a challenge and email confirmation on the ones it does. Then clean the list with a backup taken first and keep reading those notification emails. Do that, and the next stranger on your Users screen will be someone who actually wants to buy from you.

Frequently Asked Questions

Why are strangers registering on my WordPress website?

Almost always bots. They look for open registration forms so they can send email through your site (often as part of an attack on someone else's inbox), gain the low-level login that some plugin vulnerabilities require, or simply plant junk data. Real customers rarely register without buying something.

Is it safe to delete spam user accounts in WordPress?

Generally yes, if the accounts have no orders and no content. Take a manual backup first, sort users by registration date, and verify you are not including staff or genuine customers in the selection. If WordPress asks what to do with content owned by the users you are deleting, stop and look before confirming.

Should I turn off Anyone can register in WordPress?

If your site has no members' area, client portal, course or forum, yes. The setting lives under Settings, then General, Membership. While you are there, confirm the New User Default Role is Subscriber, never Editor or Administrator.

Do customers need an account to buy from my WooCommerce shop?

Not unless you sell subscriptions, which WooCommerce says require an account. With guest checkout enabled, customers can pay without registering, and you can still offer account creation during or after checkout to those who want an order history.

Will a CAPTCHA stop spam registrations?

It stops most automated sign-ups, and the Swiss National Cyber Security Centre recommends protecting all public forms with one, particularly before any confirmation email is sent. Determined attackers can sometimes get past challenges, so combine it with email confirmation and a limit on sign-ups per address rather than relying on it alone.

Spam User Registrations on Your Website: Who They Are and How to Stop Them