We have our site set up so that folk join our group through a Civi profile which then sets up a Wordpress user account. This is as it should be. However we occasionally get registrations directly through the /wp-login.php form which bypass the additional data we want in civi. These are invariably spam registrations that need manually deleting.

We've experimented with plugins Theme My Login and WPS Hide Login but things get complicated without actually resolving the issue of preventing 'back door' registrations.

Is there a simple way to ensure registrations are via CiviCRM?

4 Answers 4


It looks like you could do the following:

  • Disable registrations in WordPress entirely (instructions in this SE question), OR
  • Add a WordPress hook implementation in a custom module which prevents WordPress registration via the regular methods (instructions in this SE question), then
  • Use that hook to ensure that only the CiviCRM registration flow is allowed. (Use variables unique to only the CiviCRM workflow or WordPress registration workflow to identify whether the user has followed the desired path, and reject otherwise.)
  • Thanks for the suggestions Chris. Disabling registrations in Wordpress through Settings also prevents CiviCRM profiles setting up accounts, so can't use that. I'm not keen to get into messing around with hooks but good to know that's an option. Hoping for a more mainstream and robust solution...
    – Eric Booth
    May 11, 2017 at 13:12
  • Ray's suggestion is a good one too - you could disable direct access to wp-login.php, perhaps via .htaccess or removing the file (but watch out for upgrades). There may be WP plugins that deliver some way of preventing user rego also? May 11, 2017 at 20:09

If you're not using /wp-login.php, is there any harm in just renaming it?

We have problems with attacks pingback stuff, and since it's low utility for the victims, we just move the xmlrpc.php file to nope-xmlrpc.php, and that's the end of that.

You might need to know the renamed file for the sake of admin logins, but it's a small price to pay for eliminating a nuisance like that without needing Akismet.

  • I think this is what plugins like WPS Hide Login are doing. Problem is that wp-login.php IS being used, by CiviCRM as part of the option to create a WP account when using a profile. Disabling it blocks all registrations.
    – Eric Booth
    May 15, 2017 at 14:33
  • So that's a common attack remediation strategy - CiviCRM should be configurable as to what the WP login path is?
    – Ray
    May 16, 2017 at 16:34

I found the easiest solution was to hid the elements.

 function custom_login_css() {
    echo "<style>

#login > p[id='nav'] { 

body[class^='login login-action-login'] > #login > p[id='nav'] > a:nth-child(1) {
    display:none !important;

body[class^='login login-action-lostpassword'] > #login > p[id='nav'] > a:nth-child(2) {
    display:none !important;

add_action('login_head', 'custom_login_css');
  • 1
    While this would prevent manual signups, I would have assumed it doesn't stop spambots, which don't rely on rendered HTML/CSS. Has this worked well for you? Aug 12, 2017 at 18:57

Here's how we resolved it.

  1. Installed Theme My Login with security option and checkbox to disable wp-login.php and ReCaptcha options.
  2. Deleted the ‘Register’ page that TML created and set up redirects for /register and for /login/\?action=register.* to go to the /join page that has the CiviCRM signup page.

So, /wp-login.php brings up a 404 page not found, selecting register option opens the CiviCRM joining page. No spam registrations since doing this. Result!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.