Trusted WordPress tutorials, when you need them most.
Beginner’s Guide to WordPress
25 Million+
Websites using our plugins
Years of WordPress experience
WordPress tutorials
by experts

How to Stop Spam Registrations on your WordPress Membership Site

Editorial Note: We earn a commission from partner links on WPBeginner. Commissions do not affect our editors' opinions or evaluations. Learn more about Editorial Process.

Do you want to stop spam registrations on your WordPress membership site?

Spam registrations are a common nuisance for site owners who run membership sites or allow users to register and become members of their websites.

In this article, we will show you how to stop spam user registrations on your WordPress membership site.

How to stop spam registrations on your WordPress membership site

Why Do Spammers Register On Your Site in the First Place?

Unfortunately, spammers are looking for easy access points to get your way into your site. They often go about making spam accounts on less secure websites using spam bots and other automations.

This allows spammers to collect your email address and try to distribute their phishing links, designed to distribute malware to other members.

And if there’s a vulnerability in a plugin from your site, it could be easier for spammers to exploit that if they can log into your dashboard.

Unfortunately, the default WordPress registration process doesn’t provide many anti-spam mechanisms, which is why you’ll need third-party tools in most cases.

The good news is that if you use a form builder for your site’s user registration, you can deploy the same strategies you would for contact form spam.

That being said, we’ll give you some ways to stop these spam bots in their tracks by ensuring all submissions are from real people. You can click on any of the links below to jump to a method you want to use.

Method 1: Turn on Email Activation for User Registration

One of the easiest and most efficient ways to deal with spam registrations is using a form builder with an email activation feature.

Email activation is a feature that automatically sends out a verification link for every new account that’s created on your WordPress site. Real users must click on the email confirmation link to complete the signup.

WPForms is the best form builder plugin on the market, with a variety of spam defense features. It comes with a User Registration Addon that allows you to create custom registration forms.

However, to access the user registration addon and the email activation feature, you will need a Pro License to access the user registration addon. WPBeginner users can use this WPForms Coupon to get 50% off their purchase.

The first thing you need to do is install and activate the WPForms plugin. For more details, see our step by step guide on how to install a WordPress plugin.

Upon activation, you need to visit WPForms » Settings page to verify your license key. You can get this key from your account on the WPForms website.

Verify key

After verification, you need to visit WPForms » Addons page. Scroll down to locate ‘User Registration Addon.’

You need to click on the Install Addon button.

Install addon

Next, you need to create a user registration form. Go to WPForms » Add New page.

Provide a title for this form and then find the user registration form template. Click on ‘Use Template.’


This will launch the Form Builder with a user registration form template. You can edit the fields by clicking on them.

You can also drag and drop fields to rearrange them.

User registration form in WPForms form builder

Next, you need to click on the ‘Settings’ panel. This is where you can configure form notifications, confirmation, and user registration settings.

Click on the ‘User Registration’ tab to continue.

On this page, you can map the form fields to your WordPress user registration fields.

Scroll down and check the box next to the ‘Enable User Activation’ option. This will reveal a dropdown menu where you can select the User activation method.

Enable user activation in WPForms

WPForms uses two creative ways to prevent spam registrations on a WordPress site. You can choose to send a verification email to each user so that they can confirm their registration.

Alternatively, you can require admin approval for each registration on your WordPress site.

Choose the option that best suits your needs and click on the ‘Save’ button to store your form settings.

Save user registration form

You can now add this form to any page on your WordPress site and then use that page as your user registration page.

Simply click the ‘Embed’ button up top.


Then, click on the ‘Select Existing Page’ option.

Here, you’ll get to choose which page you want to embed the WordPress registration form into.

Embed in a page WPForms

Select the page from the dropdown menu.

Then, click on the ‘Let’s Go!’ button.

Embed user registration form in WPForms

You’ll be taken to the page editor in WordPress. You can edit the page as needed.

When you’re ready to publish the page with the embedded user registration form, click ‘Publish.’


Visit your website to see your spam-proof user registration form.

Depending on your user activation settings, the plugin will either require users to verify their email address or an admin will have to manually approve each user registration on your site.

Note: If you have trouble with your WordPress emails sending to your users, be sure to check out WP Mail SMTP to be sure they make it to your users’ inboxes.

Method 2: Adding a reCAPTCHA Field to Your User Registration Form

One simple way to block spambots from getting through is to use reCAPTCHA. This is a free Google service that helps protect websites from spam by distinguishing between automated bots and human users.

It’s a more advanced version of the CAPTCHA method.

To add reCAPTCHA v3 to your forms, head over to WPForms » Settings in your WordPress dashboard. Then, click on the ‘CAPTCHA’ tab.

Captcha tab in WPForms

Next, you want to select ‘reCAPTCHA’ and make sure that the ‘Checkbox reCAPTCHA v2’ option is enabled.

This will force new users to check a box that proves they’re human.

reCaptcha in WPForms

WPForms will ask you for a Site Key and a Secret Key. You can get this information by heading over to Google’s reCAPTCHA setup page.

When you’re on the Google reCAPTCHA page, go to ‘v3 Admin Console.’


At the top of the page, you should see an option to create a new reCAPTCHA for your site.

Go ahead and click the ‘+’ button on your corresponding site.

Add reCaptcha

You’ll be taken to a screen where you will register your WordPress website. Type in a name under ‘Label,’ which is used for internal reference and won’t be visible to others.

After that, choose the ‘Challenge v2’ option and the ‘I’m not a robot Checkbox’ underneath that.

Register a new reCaptcha

From there, type in your website’s domain name in the ‘Domain’ field.

Finally, just click the ‘Submit’ button.

Submit new reCaptcha

Now, you’ll see a page with the site key and the secret key for your website.

Simply copy this information.

Copy site key and secret key

Head back to the WPForms settings page and paste the information into the ‘Site Key’ and ‘Secret Key’ fields.

Once you’ve done that, hit the ‘Save Settings’ button.

Paste site key and secret key

From there, go to WPForms » All Forms in your WordPress admin area.

Choose the user registration form you want to add the reCAPTCHA to and select ‘Edit.’

Edit user registration form

Doing this will now open up the form builder.

Then select the ‘reCAPTCHA’ button in the left side panel.

reCaptcha button

You should see a message appear telling you that your Google Checkbox v2 reCAPTCHA has been enabled.

Click ‘OK.’

reCaptcha enabled

To confirm that it’s there, you’ll see the ‘reCAPTCHA Enabled’ verification at the top right corner of your form.

When you’re done, remember to save your changes by clicking the ‘Save’ button.

Save form

Method 3: Use Custom CAPTCHA to Prevent User Registration Form Spam

Sometimes, you may want to use a custom captcha instead of reCAPTCHA. That’s because some users have privacy concerns since it involves interacting with Google’s servers.

WPForms Pro comes with a custom CAPTCHA addon allowing you to create a question-based CAPTCHA, typically in the form of a math equation, to block user registration form spam.

All you have to do is go to WPForms » Addons in your WordPress admin area. Then, find the Custom Captcha Addon, and click on the ‘Install Addon’ button.

Custom captcha addon

After it’s installed, go to WPForms » All Forms.

Find the user registration form you want to add the custom CAPTCHA to and click ‘Edit.’

Edit user registration form in WPForms

In the left side panel menu, find the ‘Captcha’ button under ‘Fancy Fields’ and drag it over to your form.

By default, the field shows a random math question.

Custom captcha button

You can also customize the questions to visitors to challenge users to enter the correct answers.

For example, sometimes, in job or membership applications, you may want to include a keyword that you want users to mention in the form. This shows that they read through the application and aren’t blindly submitting forms through copy and paste.

Click on the ‘Custom Captcha’ field within your form builder to make edits. In the left-hand menu, go to the ‘General tab.’ Select Question and Answer under the ‘Type’ dropdown. Then, just add any questions you’d like.

Question and answer in WPForms

If you decide on the ‘Question and Answer’ format, make sure to include a few different questions. That way, WPForms can rotate those questions randomly, so it’s more difficult for spambots to predict.

If you choose the ‘Math’ option, then WPForms will automatically generate random math questions to make it less predictable.

Math question for CAPTCHA

Once you’re done, save your changes up top.

Now, you have a custom CAPTCHA button that can easily prevent new spam user accounts.

Save button in WPForms

Method 4: Enable the WPForms Anti-Spam Token

There are many security advantages to you when using WPForms. For one, WPForms has a built-in anti-spam protection feature that verifies a token for each submission.

Spam bots can’t detect this token and, therefore, won’t be able to submit the form. Since the token is embedded into the HTML, it doesn’t affect the user experience.

Every new form automatically has this feature enabled. If you want to check for yourself, navigate to the ‘Settings’ panel. Then click on the ‘Spam Protection and Security’ tab. You should see that the ‘Enable anti-spam protection’ is toggled on.

Anti-spam token

Method 5: Connect Your Form to Akismet

Akismet is a popular spam-filtering plugin designed to combat comments and form submission spam on websites. It assesses the submission for signs of spam, including spammy keywords and links to suspicious websites.

If you’re already using the Akismet plugin, you can connect it to WPForms. This ensures your user registration forms get the same spam protection that you also have in your blog comments.

Go to the forms you want to filter spam for and head to Settings » Spam Protection and Security.

From there, you can toggle on the ‘Enable Akismet anti-spam protection’ option.

Enable Akismet

Note: If you haven’t connected your WordPress site to your Akismet account, you won’t be able to see this integration in the WPForms form builder.

Method 6: Block Specific Email Addresses on Your User Registration Forms

Not all spam registrants will be bots. You may get spam submissions from humans as well. Sales agents and scammers are often lurking on websites trying to solicit their products.

CAPTCHAs won’t work against humans, which is why you’ll need to analyze the common types of spam you get and choose the appropriate method.

One way to deal with solicitors is to create a ‘denylist’ of email addresses so that those visitors with that email address can’t create a new account on your WordPress site.

With WPForms, you can create an allowlist and denylist for each form.

When you’re in the form builder, just navigate to the ‘Fields’ panel.

Then simply select the ‘Email’ block from within your user registration form. Under the ‘Advanced tab,’ you’ll see an ‘Allowlist / Denylist.’

In the dropdown menu, you can choose ‘Denylist.’

Denylist in WPForms

In the box below, you can type in all of the email addresses you want to block from registering an account on your form.

The great thing about this feature is that you can simply type a complete email address or use an asterisk to create a partial match. Then, simply separate the email addresses by using a comma.

Denylist emails

Method 7: Restrict User Registration by Country and Keywords

If you notice that your forms are targeted from a specific country or often contain specific keywords, WPForms offers various filters to block those entries.

The country filter accepts or denies submissions from specific countries. To activate and add countries to deny, you can go to the ‘Settings.’

Then, you just click the ‘Spam Protection and Security’ tab and make sure the ‘Enable country filter’ is on.

Select ‘Deny’ from the dropdown menu and add all the countries that you want to deny user registrations from.

Country filter in WPForms

That said, country filtering may not be the best option for online stores. For instance, if you own a WooCommerce store, any customers in the blocked countries won’t be able to access their accounts.

Method 8: Use Dedicated Anti-Spam Plugins

If you aren’t using WPForms to create new accounts, you may need dedicated anti-spam plugins. In that case, there are other options on WordPress that can add additional layers of spam protection for your user registration forms.

The Stop Spammers Security plugin is a reliable tool that gives you a lot of control over how you want to filter spambots.

The first thing you need to do is install and activate the plugin. For more details, see our step by step guide on how to install a WordPress plugin.

Once activated, Go to Stop Spammers » Protection Options. Stop Spammer Security is a powerful WordPress plugin that aggressively monitors your website for suspicious spam activity.

Stop Spammers plugin options

The default settings on this page will work for most websites. However, you can uncheck a few of them if you feel lots of legitimate users are unable to log in.

You can even block users from specific countries if you wish. Once you’re done, click on the ‘Save Changes’ button to store your settings.

Save changes in Stop Spammers plugin

The plugin uses a number of spam prevention techniques. It uses HTTP Referrer and Header requests to verify that a user is genuinely accessing your website.

It also checks against Akismet API for known spamming activity. The plugin also maintains a list of bad hosts known for tolerating spam activity and blocks them.

Under Stop Spammer » Block Lists, you can block IP addresses, emails, and spam words.

Stop Spammers blocked list

The great thing about this plugin is that default settings have just about most spam defenses already activated.

That means there’s not much you need to do other than to install the plugin and test to see if it’s working.

Method 9: Stop Spam Registrations Using Sucuri


At WPBeginner, we use Sucuri to protect our website against spammers and other security threats.

Sucuri is a website security monitoring service. It blocks hackers, malicious requests, and spammers from accessing your site or injecting any malicious code.

For more details, check out how Sucuri helped us block 450,000 WordPress attacks in 3 months.

Alternative: MalCare is another powerful security plugin that comes with a bot protection feature.

We hope this article helped you stop spam registrations on your WordPress membership site. You may also want to read out the ultimate WordPress security guide or check out the best WordPress security plugins to protect your site.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.

Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. See how WPBeginner is funded, why it matters, and how you can support us. Here's our editorial process.

Editorial Staff

Editorial Staff at WPBeginner is a team of WordPress experts led by Syed Balkhi with over 16 years of experience in WordPress, Web Hosting, eCommerce, SEO, and Marketing. Started in 2009, WPBeginner is now the largest free WordPress resource site in the industry and is often referred to as the Wikipedia for WordPress.

The Ultimate WordPress Toolkit

Get FREE access to our toolkit - a collection of WordPress related products and resources that every professional should have!

Reader Interactions

37 CommentsLeave a Reply

  1. Syed Balkhi says

    Hey WPBeginner readers,
    Did you know you can win exciting prizes by commenting on WPBeginner?
    Every month, our top blog commenters will win HUGE rewards, including premium WordPress plugin licenses and cash prizes.
    You can get more details about the contest from here.
    Start sharing your thoughts below to stand a chance to win!

  2. Jiří Vaněk says

    I am deploying and gradually launching the MemberPress plugin. After my experiences with a discussion forum where I struggled with spam (and am still partially fighting it), I was really worried that I might end up with spam registrations again. So, thank you for the very detailed guide and the methods that will hopefully help me avoid spam this time. MemberPress and user registrations are important for me to build a community, but spam is a problem. Thanks for the great tips.

  3. Ahmed Omar says

    A crucial guide on putting a halt to spam registrations on WordPress membership sites!
    Your insights into CAPTCHA implementation and user registration settings are golden. A technical suggestion: combining these strategies with Anti-Spam Plugin can provide an extra layer of defense.
    Thanks for addressing this headache-inducing issue

  4. Travis says

    If I activate the Stop Spammers Plugin does it make sense to also have the Akismet plugin active or is this redundant?

  5. Aniekan Etop says

    Please what should I do to gain access back to my blog’s admin area if ‘Stop Spammers plugin’ logs me out

  6. smaqsood says

    are you sure wpforms pro version is needed?. i see user registration and spam protection is included in basic version of wpforms… please confirm from your side before i buy basic version. i don’t want to spend $200 for pro version to stop spam.

  7. Matt says

    What about recaptcha by Google? I thought they would have this down but the headache continues!

    Thanks for the advice. Your site has become by go-to.


  8. matin gholami says

    hi there, are U sure SUCURI protects my website???
    I always had 2 spam registration per day, but after installing sucuri I have 5 spam registration every day :|
    is there any better way to stop spam registration?? TNX

  9. Dan Awontis says

    Great post, as always. Theory and practice together, easy to read, to understand and to implement. But without promoting any company, I’d suggest.

  10. Ishtiak says

    Can this plugin prevent visitors from registering with sensitive usernames like ‘Admin’, ‘admin’, ‘administrator’ etc?

  11. Blake says

    So, I think I have a bunch of spam subscribers–like 400 out of 400 subscribers to my blog–but what I can’t figure out is WHY I have them.

    What does a spam subscriber get? They’re not leaving comments. So what would be the purpose of subscribing to a random WordPress blog?

      • Blake says

        Thank you. I have done this.

        I still don’t understand WHY they do it, though. What do they get out of creating user logins for my site? They’re not leaving comments, after all.

      • Blake says

        And now, having done this, I don’t know what I got out of it.

        So what if they all have new passwords? Is there a way I can tell whether they’re real? Should I just deleted everyone?

        • Chiara says

          Hey Blake,
          I’m in the same situation and I was looking for answers. I’m glad that at least I’m not the only one with this problem. The option I found was to disable registration for users. But since I’m looking to sell an online course I’ll need to find alternative ways to let user register. And by the way, I was wondering exactly the same thing: WHY do they register? If anyone has an answer he will make 2 people happy :)

    • Caren Pretorius says

      I’ve learned the hard way. They gather information, especially emails. A light went on for me and I have more control over the register spam problem now. I’ve added a field under users on dashboard and made it a requirement. The bots can’t get past the register page without filling out this field.

      • ReidGuy says

        I had this thought as well, I was planning on giving it a go, but first thought I would give Google a try to see if there were any plugins that could help. This is probably the best way to stop the spam bots.

  12. Md Abul Bashar says

    Can you help me please? how can i block specific word when visitor want to register in my site, then go to my site register page, then normally register, but i want to some word block, example: if i block “Admin” word. when visitor want to register in my site and he/she try registration username “Admin” then show error “Admin username is not allow for register in this site”.
    so please help me.

  13. Rashed khan says

    Hello Admin and everyone,

    I have already your article and comment.Wow, I got the lot of thinks from there. This article and every comment is very helpful.However, I want to add something, and recently I just released the membership plugin in the wordpress repository who is called “rs-members”. Before developing I just studied existence all membership wordpress plugin.I got many problems from the those.As a result; I just tried to include many useful features.Without programming skill any guys can easily maintain this plugin. I hoped this plugin will be helpful fill up your all demand. Guys you can visit my “rs-members” from wordpress repository.

    Thank you gentleman for patiently reading.

  14. Shanna says

    This was a great find as I’m putting together a membership site. Thank you! However, as I was about to install it and was reviewing the FAQs I read at the bottom that he no longer has time to maintain the plugin in. See the thread here on…

    I’m going to install it anyway, hopefully his hard work and dedication can be carried on by equally dedicated plugin programmers in the wp space.

  15. Theo says

    Great blog post. This is just what I desperately needed. I’ve been receiving a barrage of sign ups from spammers for some months now. Hopefully this will bring that to a minimal.

  16. Duane Reeve says

    I’ve installed the WangGuard Plugin to help with Spam User Registrations. It’s the only such plugin I know that also helps clean out your database of ‘Sploggers’ (Spam Users), as well as blocking new Spam User Registrations.

    WangGuard is FREE for personal use, but does require an API key. It is available on the WP Repository, or from Wanguard Website, where you need to sign-up for your API key anyway. There are too many features to mention here, but it may be a consideration for others looking to resolve Spam User issues.

  17. Steve Lamb says

    Just installed this plugin on our membership site. Hopefully, it helps cut back some of the SPAM registrations we’ve been receiving. We’re receiving on average around 100 SPAM registrations per day using fake Gmail addresses.

  18. RethaGroenewald says

    What about spammers that have already registered. Will this plugin pick them up as well?

      • RethaGroenewald says

        I have installed this plugin. Any ideas how do I get rid of spam user before this plugin was installed?

      • Steve says

        Any advice on how to get rid of existing spam sign ups would be helpful? I don’t really want to delete all users and ask them to signup again. Thanks for the post though.

        • Editorial Staff says

          No real easy way.

          One option would be to send an email blast to every user. If user does not open the email, then send it to them again. Then after the second try (everyone who never opened this email) gets deleted. You can write a SQL query to delete only the accounts that have specific email addresses tied to it.

        • Rakesh Luthra says

          The only “realistic” way of removing the existing SPAM user accounts is by using User Spam Remover plugin whereby you can remove all user accounts that have not been used within last X days

  19. Albert Albs says

    This is good plugin. But Expecting feature from “Growmap Anti Spambot Plugin”. Like: “Confirm you are not a spammer”. Is it possible in this plugin?

Leave A Reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.