Sign-ups

A shop that lets customers register, or a membership site, fills up with accounts nobody will ever use. Machines make them: each one sends a welcome email to an address somebody made up, uses up your mail allowance, and sits in your customer list.

Settings → Sign-ups → Screen new sign-ups for bots turns them away, with no puzzle for anybody to solve and nothing sent to another service. Three checks, all on your own server:

• A field only a machine fills in. The sign-up form carries one extra field, placed off the edge of the screen, hidden from screen readers and skipped by the Tab key. A person never sees it. A machine that fills in every field it finds fills it in, and is turned away;
• A form sent back too fast, or too late. The form carries the time it was drawn, signed with your site's own secret. Sent back in under three seconds is faster than a person types an email address; more than a day later is a copy of the form somebody kept. A form with no time, or an altered one, was not drawn by your site;
• A limit per address. Sign-ups from one address in an hour, three by default, from 1 to 20. The next one is refused until the hour is up. An account is counted when it is made, so a sign-up something else turned away uses up nobody's hour.

The field and the clock get the same sentence, We could not create the account. Wait a moment and try again. It does not say which of the two it was: telling a machine that tells it what to change, and a person caught by the clock is put right by waiting a moment. The limit says what it is, We could not create the account, because too many were made from this connection this hour. Try again later., because waiting a moment does not put that right.

Where it works#

Checkout gets the limit and nothing else, so a customer paying for an order is never stopped by a field or a clock. The limit does apply there, and when it refuses the account, WooCommerce does not place the order: the customer sees the limit's sentence and can order again once the hour is up, or without an account where your shop allows that. With the default of three, that is the fourth new account from one address in an hour. A shop whose customers share one connection (an office, a school, a mobile network) can raise the number to 20. The classic checkout and the block checkout are both covered.

A form another plugin or your theme draws and handles itself, which sends its sign-ups through WordPress's or WooCommerce's own registration (a login and sign-up popup, say), is held to the limit only: it never had the field or the time. The exception is a form that posts to wp-login.php itself. A request there without the field and the time is what a machine sends, so it is turned away, and a theme's sign-up popup that posts to wp-login.php without drawing WordPress's register_form hook has every sign-up turned away with it. The Who has tried → Sign-ups tab shows them, with the form was sent back too soon, too late, or not from this site; switching the screening off, or having the popup fire the hook, puts it right. A WooCommerce My Account form a theme has redrawn is covered as long as it keeps WooCommerce's woocommerce_register_form hook, which almost every theme does, because WooCommerce's own privacy text hangs off it. One that leaves it out has every sign-up turned away; the Who has tried → Sign-ups tab says so, and switching the screening off puts it right.

Who is never refused#

Trusted addresses, anybody using the way back in, a signed-in administrator, anybody signed in who may make accounts (an administrator, or a shop manager adding a customer, which WooCommerce allows them), and WP-CLI. Accounts made in wp-admin, over the REST API by somebody who may make accounts, from WP-CLI or by a scheduled job are not counted against the address either: nobody visiting made them.

Seeing what it did#

Each sign-up turned away is a row in Who has tried, under its own Sign-ups tab, saying which check turned it away and what was typed as the username (or the email address, where the shop makes the username up). The download and wp login-security log --outcome=signup follow the tab. The Dashboard says Sign-ups turned away this week in a week when there were any. Rows are kept for as long as the rest of the log, and only while Record every attempt is on; with it off nothing is written, and the checks and the limit still work.

Let in on a Sign-ups row starts that address's count again, for a school or an office that made several accounts at once. Let everybody back in starts every count again.

New sites and existing ones#

A site that installs the plugin now has the screening on. A site that already had the plugin keeps taking sign-ups exactly as before, because the screening can refuse a sign-up that is accepted today. Its Dashboard offers Screen new sign-ups for bots under Worth doing next, with Switch it on and Not now, while anybody can sign up there through a form it covers. Either answer is final; the switch in Settings works at any time.

On a network, each site answers for itself. A site added to the network after this version is a new site, so it has the screening on, while the sites that were there before read it off until somebody switches it on for them.

What it does not cover#

• The network sign-up page. A Multisite network sends WordPress's registration to wp-signup.php, which this does not screen. A shop's My Account form on a network site is covered. On a site where the network page is the only way to sign up, the Sign-ups panel says so.
• A machine working through many IPv6 addresses. The limit counts each address on its own, as the sign-in limit does, and one IPv6 connection can hand out a great many. The field and the clock still apply.
• Forms other plugins draw and handle themselves, such as Ultimate Member, WPForms or Gravity Forms. Their own anti-spam settings are the ones to use there.
• A register page served from a page cache keeps working for a day. After that its time is too old and a sign-up from it is turned away until the cache is refreshed. WooCommerce's My Account page is not cached by the usual caching plugins.
• If your site sends a strict Content-Security-Policy that refuses inline styles, the extra field shows on the form, labelled Leave this field empty. People leave it empty and nothing else changes.
• It does not check whether an email address is real, and it does not stop a person making an account by hand.