2026年11月12日

How to Require Admin Approval for New User Registrations in WordPress

This article is a localized edition of the Japanese original. Read the Japanese original

If you want a WordPress site where "anyone can register, but nobody can log in until an administrator approves them", WordPress core has no such feature. You add it either with a plugin that provides approval or with a small piece of code that tracks a pending status.

This article covers checking the standard settings, the setup flow with a plugin (New User Approve), and the notification emails and spam registrations that tend to cause problems in day-to-day use. The information is as of October 2026. Building it yourself in code is explained in detail in How to build an admin-approved membership registration flow in WordPress.

How standard WordPress registration works

Standard WordPress registration works like this.

When you check "Anyone can register" under "Membership" in Settings → General, a registration link appears on the login screen (wp-login.php)
When a visitor registers with a username and email address, they receive an email with a link to set their password, and the administrator receives a new-registration notification
Once the user sets a password, they can log in right away

In other words, by default users can log in before an administrator has reviewed them. To require approval, you need a mechanism that stops pending users at step 3, when they log in.

On the same screen, also check "New User Default Role". Normally set it to "Subscriber". If it is set to "Administrator" or "Editor", simply registering creates a user who can change posts or site settings.

On a multisite network, registration works differently: accounts are activated through a link in a confirmation email (wp-activate.php). This article assumes a single site.

Choosing a method

Method	When it fits
A plugin dedicated to approval (New User Approve and others)	You want to keep the standard registration screen and only add an approval step
A membership plugin (Ultimate Member, User Registration & Membership and others)	You need more registration form fields, paid memberships or content restriction
Your own code	You do not want another plugin, or you want fine control over approval conditions

Some membership plugins also have a setting that puts new registrations into an "awaiting admin approval" state. Whether it is available in the free version differs by plugin and version, so check each plugin's description before installing it. The rest of this article uses New User Approve, which adds approval to the standard registration screen, as the example.

Requiring approval with New User Approve

New User Approve is a plugin distributed on WordPress.org that specializes in approving new registrations. According to its official description, it works like this.

When a new user registers, the administrator receives a notification email
When the administrator approves or denies the registration, the user is told the result by email
Approved users can log in; pending and denied users cannot
Users who existed before the plugin was installed are automatically treated as approved
The approval status can be changed later

Steps

Back up your site before you start
In the admin area, go to Plugins → Add New Plugin, search for "New User Approve", install it and activate it (the WP-CLI command is shown after these steps)
Under Settings → General, check that "Anyone can register" is checked and that "New User Default Role" is "Subscriber"
While logged out (in another browser or a private window), register with a test email address
Check that the administrator receives the notification email and that the test user cannot log in before approval
On the approval screen the plugin adds to the admin area, approve the test user, then check that the approval email arrives and that the user can now log in
When you are done, delete the test user

If you use WP-CLI, you can also do step 2 with this command.

wp plugin install new-user-approve --activate

Settings such as the message shown to pending users, and the names of screens, can change between plugin versions. Auto-approval with invitation codes and auto-approval of email addresses on specific domains are features of the paid version (Pro).

Make sure notification emails arrive

An approval workflow depends on email arriving: "the new-registration notice to the administrator", "the password-setup email to the user" and "the approval or denial notice". WordPress's default sending method (the PHP mail() function) can end up in spam or not arrive at all.

Before you start, route outgoing mail through an authenticated sending service with an SMTP plugin or similar, and confirm that a test email arrives. How to choose a plugin is explained in WordPress SMTP plugins compared.

Administrator notifications go to the "Administration Email Address" under Settings → General. Make sure it is an address you actually check.

Dealing with spam registrations

With approval in place, bots that register still cannot log in, but pending users pile up and each one triggers a notification email. Adding the following measures to the registration screen saves you review work.

Add a CAPTCHA (reCAPTCHA, Cloudflare Turnstile and so on) to the registration form. Many security and membership plugins can add one to the login and registration screens
Regularly delete denied users and users left unapproved for a long time. This also helps you avoid keeping personal data (email addresses) you do not need
When you no longer need to accept registrations, uncheck "Anyone can register"

Roles and records after registration

For approved users, pick the smallest role that does the job from the standard roles (Subscriber, Contributor, Author, Editor, Administrator). If the standard roles are not enough, you can create custom roles with a plugin that edits capabilities. New User Approve also includes a role editor.

If you want to keep a record of who registered and approved when, use an activity log plugin that records actions in the admin area.

Summary

WordPress core has no registration approval feature. By default, a registered user can log in as soon as they set a password
Keep "New User Default Role" set to "Subscriber"
To add only approval to the standard registration screen, use New User Approve; if you also need forms or membership features, use a membership plugin; for fine control, write your own code
Approval depends on notification emails arriving. Set up SMTP and send a test email first
Reduce the work caused by spam registrations with a CAPTCHA and by regularly deleting denied or abandoned users

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)