We have our site set up so that folk join our group through a Civi profile which then sets up a Wordpress user account. This is as it should be. However we occasionally get registrations directly through the /wp-login.php form which bypass the additional data we want in civi. These are invariably spam registrations that need manually deleting.
We've experimented with plugins Theme My Login and WPS Hide Login but things get complicated without actually resolving the issue of preventing 'back door' registrations.
Is there a simple way to ensure registrations are via CiviCRM?