Disable User Registration in WordPress: Settings, WP-CLI and Enforcing It

This article is a localized edition of the Japanese original. Read the Japanese original

To disable user registration in WordPress, go to Settings → General in the admin area and, under "Membership", uncheck "Anyone can register" and save. The registration screen at wp-login.php?action=register then stops working, and anyone who opens it is redirected to wp-login.php?registration=disabled.

On a fresh WordPress install this box is unchecked from the start. If you are getting spam registrations, either it was turned on at some point or a plugin has its own registration form. This article covers changing the setting, checking it with WP-CLI, locking the setting, and other things worth checking.

Method 1: Disable it in the admin area

1. Log in as an administrator and open Settings → General.
2. Under "Membership", uncheck "Anyone can register".
3. Click Save Changes at the bottom of the screen.

"New User Default Role" on the same screen is the role given to users who register. Even with registration disabled, keep it set to Subscriber (the reason is explained in a later section).

After saving, open https://example.com/wp-login.php?action=register while logged out (or in a private browser window). If you are redirected to the login screen with a notice such as "User registration is currently not allowed.", registration is disabled.

Method 2: Check and change it with WP-CLI

The setting is stored in the users_can_register option. 1 allows registration and 0 disallows it.

# Check the current value
wp option get users_can_register

# Disable registration
wp option update users_can_register 0

# Check the default role for new users and set it to subscriber
wp option get default_role
wp option update default_role subscriber

This is handy when checking several sites at once or when you cannot get into the admin area.

Method 3: Lock the setting (so it cannot be turned back on in the admin area)

On sites with several administrators, or sites where settings have been tampered with before, locking the value in code means registration stays off even if someone checks the box in the admin area. So that it keeps working when you change themes, put a PHP file in wp-content/mu-plugins/ (create the folder if it does not exist).

wp-content/mu-plugins/disable-registration.php:

<?php
/**
 * Plugin Name: Lock user registration off
 */

// Always treat users_can_register as 0
add_filter( 'pre_option_users_can_register', '__return_zero' );

// Always treat the default role as subscriber
add_filter( 'pre_option_default_role', function () {
    return 'subscriber';
} );

The pre_option_{option_name} filter decides the value returned before the database value is read. The database value itself does not change, so deleting this file restores the original setting. Files in mu-plugins load automatically and cannot be deactivated from the plugin list in the admin area.

Note that wp-config.php has no constant for stopping registration. Constants such as DISALLOW_FILE_MODS prohibit editing files or adding plugins and have nothing to do with user registration.

On Multisite

On Multisite, registration is decided for the whole network. In Network Admin → Settings, under Allow new registrations, choose Registration is disabled and save. This item does not appear in Settings → General of individual sites.

What to check even with registration disabled

Is the default role “Subscriber”?

One attack technique is to tamper with the settings somehow, turn registration on, and set "New User Default Role" to Administrator. Even with registration disabled, if default_role is anything other than subscriber, suspect tampering and review the administrator accounts and recently added plugins.

Registration through the REST API is not possible

Creating a user through the WordPress core REST API (/wp-json/wp/v2/users) requires the capability to create users (create_users). Visitors who are not logged in cannot register through the REST API, so you do not need a separate countermeasure just for the REST API.

Registration forms in plugins

"Anyone can register" controls the WordPress core registration screen. Plugins like the following may have their own registration forms and settings, so check those as well.

• WooCommerce: Under "Accounts & Privacy" in its settings, you decide whether customers can create an account during checkout or on the "My account" page.
• Membership and form plugins: Check that pages carrying a registration form or shortcode are not still published.

If you do not know which plugin is creating users, compare the registration times of recent users with the URLs receiving POST requests at those times in the access log.

Spam users who already registered

Users who registered before you disabled registration remain. List recent registrations to review them.

wp user list --role=subscriber --fields=ID,user_login,user_email,user_registered --orderby=registered --order=DESC

Back up the database before deleting anything, confirm that no real members or customers with order history are mixed in, and then delete them under Users in the admin area.

Keeping registration but stopping only the notification emails

If you want to keep accepting registrations but stop the email the administrator receives for every new registration, use the filters added in WordPress 6.1.

<?php
// Do not send the new user registration notification to the administrator
add_filter( 'wp_send_new_user_notification_to_admin', '__return_false' );

// To also stop the notification to the registered user (the link to set a password)
// Normally leave this on, because the user could not set a password
// add_filter( 'wp_send_new_user_notification_to_user', '__return_false' );

The notification to the user contains the link for setting a password. If you stop it, registered users cannot log in, so normally you stop only the notification to the administrator.

Summary

• Unchecking "Anyone can register" in Settings → General disables user registration, and the registration screen redirects to registration=disabled.
• With WP-CLI, wp option update users_can_register 0 does the same thing.
• To keep it from being turned back on in the admin area, lock it with pre_option_users_can_register in a mu-plugin. wp-config.php has no dedicated constant.
• Keep the default role at Subscriber, and also check the settings of registration forms in plugins such as WooCommerce.

Related articles

• How to get email alerts for WordPress login attempts
• What to do when WordPress confirmation emails do not arrive

References: Settings → General (WordPress.org documentation), wp_new_user_notification() (WordPress Developer Resources)

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)