A user list full of strangers
Someone opens the Users screen and finds pages of accounts with random names and email addresses at odd domains. New ones arrive every day. The admin inbox fills with "new user registration" notifications. Some of the accounts have posted spam comments or forum entries. Genuine customers are hard to find among them, and the newsletter list is polluted with the same addresses.
Often the business did not realise registration was switched on at all.
Why bots sign up
| Why bots register | What it leads to |
|---|---|
| To post spam in comments, forums or profiles | Spam links appear on your site under your name |
| To test lists of stolen email addresses | Your site sends confirmation emails to strangers, harming your email reputation |
| To look for plugins that trust logged-in users | A vulnerable plugin can become a way into the site |
| Because registration is open by default in some setups | Anyone can make an account, with no reason to |
The route in is often not the one people check. WordPress's own "Anyone can register" setting might be off, while WooCommerce allows account creation on the My Account page, or a membership or forum plugin has its own form.
What the fake accounts cost
Every fake sign-up can trigger an email from your domain to an address that never asked for it, and enough of those can push your legitimate emails into spam folders. The database grows with junk, reports and customer lists become unreliable, and staff waste time sorting real from fake. If any plugin gives logged-in users more access than it should, each fake account is a potential foothold.
Fake accounts also distort anything you measure. Sign-up numbers look healthy while real customer growth is flat, and email campaigns report poor engagement because part of the list is bots that never open anything. Marketing decisions end up based on figures that include people who do not exist.
How we stop the sign-ups
- Find every registration route on the site: WordPress core, WooCommerce, membership, forum, learning or event plugins.
- Switch off the routes you do not need. Many sites only need accounts at checkout, or not at all.
- On the routes you keep, add bot filtering, such as Cloudflare Turnstile, honeypot fields and rate limits, which stop most automated sign-ups without puzzles for real people.
- Require email verification before an account becomes active, and hold suspicious patterns, such as disposable email domains, for review.
- Make sure new accounts get the lowest role, and check that no plugin grants extra rights to subscribers.
- Identify fake accounts by patterns such as no orders, no logins and suspicious domains, export them for your review and then remove them in bulk, with a backup first.
- Clean any spam content the accounts created, and remove their addresses from your mailing lists.
After the clean-up
The user list contains real people. New registrations come from customers, and notifications stop being noise. Your domain stops sending confirmation emails to strangers. And every account on the site has only the access its role needs.
Is this your site?
- The Users screen is full of accounts nobody recognises
- Registration notification emails arrive constantly
- Spam appears in comments, forums or profiles
- You are not sure why the site allows registration
- Your mailing list has addresses from strange domains
- Email deliverability has dropped for no clear reason