How to filter spam membership registrations on WordPress

List every place that can create an account: the default WordPress registration page, your membership checkout, a custom registration form, WooCommerce checkout, and any REST or API-based signup flow. Protecting one form does not automatically protect the others.

Check a new account after registering through each route. Record whether it is created immediately, requires payment, or waits for email verification. This tells you where the filter must run.

Go to Settings > General. Clear Anyone can register if the site does not need public WordPress accounts. If public registration is required, leave the default role as Subscriber, unless your membership system deliberately assigns another restricted role. WordPress documents this setting as the control for self-service account creation.

Do not rely on hiding the registration link. Bots can submit directly to the registration endpoint, and a membership checkout may use a completely different form.

Enable the anti-spam controls provided by the form or membership plugin that actually processes the signup. Common choices are a honeypot, reCAPTCHA or another CAPTCHA, email verification, and a submission time or rate limit. Use a low-friction option first, then add a visible challenge if automated signups continue.

A CAPTCHA on the WordPress login page will not necessarily protect a separate membership checkout. Test the public form while logged out, and confirm that a legitimate user can still register.

For the default WordPress registration form, a developer can reject suspicious submissions with the registration_errors filter. WordPress runs this validation before saving the user; returning an error prevents the account from being created. Use it for rules such as a blocked email domain, a missing honeypot value, or an invalid verification token.

Put the code in a small custom plugin or a child-theme integration, not in WordPress core. The filter only covers the registration process that calls it, so custom membership forms need their own documented validation hook. Do not use user_register for rejection because that hook runs after the user has been created.

Turn on rate limiting in the membership system, firewall or hosting layer if one address is sending repeated attempts. Keep failed-registration logs long enough to identify patterns, but avoid blocking whole countries or common email providers unless your audience permits it.

Review Users for accounts with no completed membership, disposable-looking addresses or repeated identical names. Delete confirmed spam accounts in batches, and check whether the account has created content, orders or other data before deletion. The WordPress Users screen supports searching, filtering by role and bulk deletion.

If fake signups are your main problem and you use, or are prepared to use, Paid Memberships Pro, install its Akismet Integration for Spam Protection add-on alongside Akismet. In WordPress, go to Memberships > Add Ons, install and activate the integration, then configure Akismet under Settings > Akismet Anti-Spam. The add-on has no separate settings and checks PMPro checkout submissions against Akismet’s spam filters.

For an additional layer, open Memberships > Settings > Security and enable PMPro checkout spam protection or reCAPTCHA as appropriate. Flagged PMPro checkouts can be blocked before payment, including free registrations. Test one genuine signup and one deliberately rejected address before switching the site back to normal traffic.