1

I am using a Profile to create WordPress users when contacts become members and this works fine, except that I have to have "Membership: Anyone can Register" allowed in WordPress Settings > General

This means that anyone out there on the internet can register from the login page (or possibly with some bots). How can I stop this, while still allowing the creating of accounts for new members?

I'm using WP 5.1.1 and CiviCRM 5.11.0

  • Can you set the Profile on the membership page to be used to create the account (you can in Drupal) and then channel all users via that screen? – petednz - fuzion Mar 28 at 4:24
  • 1
    @peternz that was what I was doing, but in WordPress that requires turning on a more general facility in WordPress that leaves a standard address able to create users. – Mick Kahn May 10 at 16:46
1

The CiviCRM WordPress Member Sync plugin can help you do this. It will auto-create a WordPress user when a Membership has been successfully created via a Contribution page.

  • It looks like OP is already doing this. They're asking about how to restrict WordPress user creation to ONLY Memberships created via a Contribution page. – Thaeli Apr 28 at 6:14
  • How do you know they're already using the plugin I mention? – Christian Wach Apr 29 at 8:31
  • "I am using a Profile to create WordPress users when contacts become members" - so the WordPress users are already being created, and the question appears to be about how to make it so the ONLY way to create a WordPress user is through Civi. – Thaeli Apr 29 at 15:32
  • If you have a way to use the CiviCRM WordPress Member Sync plugin to prevent allowing the creation of WordPress accounts via any other method, it would be great if you could edit your answer to say how to do that. (For instance, if you mean that this plugin will create the WordPress users correctly even if "Anyone can Register" is set to "no" - that would be useful information along with how to do it.) – Thaeli Apr 29 at 15:39
  • 2
    @Christian Wach is correct. I was not previously using his plug in. Now I am and I have what I need for now and has the added benefit of automatically changing the role when they stop being members which makes it easier to restrict functionality to members only. – Mick Kahn May 10 at 16:51
1

You'll need to redirect the WordPress signup page (usually to your "become a member" page, though it doesn't have to be) so that there's no way to get to the standard WordPress account creation flow. This can be done at the web server level or via a redirects plugin.

You will need to redirect /wp-login.php?action=register to your alternate URL.

  • Whilst @christian Wach's solution is better for me now, this may also be a useful option. Previously I also wanted accounts being created when non-members booked events so I'd have to have used the other route enabling "Anyone can Register". But trying it out, I don't think it will work. I'm not an expert, but I think that the redirect only works on the bit of the URL before the question mark. And you can't just redirect that or you loose the whole login function. – Mick Kahn May 10 at 18:09
0

Google Recaptcha will do wonders to stop the bots from registering. There are also some honeypot plugins out there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.