Answers.Body: <p>Here's how we resolved it. </p>
  
  <ol>
  <li>Installed Theme My Login with security option and checkbox to disable wp-login.php and ReCaptcha options.</li>
  <li>Deleted the ‘Register’ page that TML created and set up redirects for /register and for /login/\?action=register.* to go to the /join page that has the CiviCRM signup page.</li>
  </ol>
  
  <p>So, /wp-login.php brings up a 404 page not found, selecting register option opens the CiviCRM joining page. No spam registrations since doing this. Result!</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-09-19T12:36:58.063Z
Answers.LastActivityDate: 2017-09-19T12:36:58.063Z
Answers.UserDisplayName: Eric Booth
Answers.Body: <p>It looks like you could do the following:</p>
  
  <ul>
  <li>Disable registrations in WordPress entirely (<a href="https://stackoverflow.com/questions/22500466/is-there-a-way-to-disable-user-registrations-completely-in-wordpress">instructions in this SE question</a>), OR</li>
  <li>Add a WordPress hook implementation in a custom module which prevents WordPress registration via the regular methods (<a href="https://wordpress.stackexchange.com/questions/95300/hook-before-inserting-user-into-database">instructions in this SE question</a>), then</li>
  <li>Use that hook to ensure that only the CiviCRM registration flow is allowed. (Use variables unique to only the CiviCRM workflow or WordPress registration workflow to identify whether the user has followed the desired path, and reject otherwise.)</li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-11T13:12:01.423Z
Answers.Text: Thanks for the suggestions Chris. Disabling registrations in Wordpress through Settings also prevents CiviCRM profiles setting up accounts, so can't use that. I'm not keen to get into messing around with hooks but good to know that's an option. Hoping for a more mainstream and robust solution...
Answers.UserDisplayName: Eric Booth
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-11T20:09:38.393Z
Answers.Text: Ray's suggestion is a good one too - you could disable direct access to `wp-login.php`, perhaps via `.htaccess` or removing the file (but watch out for upgrades). There may be WP plugins that deliver some way of preventing user rego also?
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-10T04:13:51.627Z
Answers.LastActivityDate: 2017-05-10T04:13:51.627Z
Answers.LastEditDate: 2017-05-23T12:38:59.763Z
Answers.UserDisplayName: Chris Burgess
Answers.Body: <p>If you're not using /wp-login.php, is there any harm in just renaming it?</p>
  
  <p>We have problems with attacks pingback stuff, and since it's low utility for the victims, we just move the xmlrpc.php file to nope-xmlrpc.php, and that's the end of that.</p>
  
  <p>You might need to know the renamed file for the sake of admin logins, but it's a small price to pay for eliminating a nuisance like that without needing Akismet.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-15T14:33:08.177Z
Answers.Text: I think this is what plugins like WPS Hide Login are doing. Problem is that wp-login.php IS being used, by CiviCRM as part of the option to create a WP account when using a profile. Disabling it blocks all registrations.
Answers.UserDisplayName: Eric Booth
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-16T16:34:56.927Z
Answers.Text: So that's a common attack remediation strategy - CiviCRM should be configurable as to what the WP login path is?
Answers.UserDisplayName: Ray
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-11T18:59:05.630Z
Answers.LastActivityDate: 2017-05-11T18:59:05.630Z
Answers.UserDisplayName: Ray
Answers.Body: <p>I found the easiest solution was to hid the elements.</p>
  
  <pre><code> function custom_login_css() {
      echo "&lt;style&gt;
  
  #login &gt; p[id='nav'] { 
      color:transparent; 
  }
  
  body[class^='login login-action-login'] &gt; #login &gt; p[id='nav'] &gt; a:nth-child(1) {
      display:none !important;
  }
  
  body[class^='login login-action-lostpassword'] &gt; #login &gt; p[id='nav'] &gt; a:nth-child(2) {
      display:none !important;
  }
  &lt;/style&gt;";
  
  }
  add_action('login_head', 'custom_login_css');
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-08-12T18:57:31.960Z
Answers.Text: While this would prevent manual signups, I would have assumed it doesn't stop spambots, which don't rely on rendered HTML/CSS.  Has this worked well for you?
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-08-11T19:13:25.843Z
Answers.LastActivityDate: 2017-08-11T19:13:25.843Z
Answers.UserDisplayName: Mike Long
Body: <p>We have our site set up so that folk join our group through a Civi profile which then sets up a Wordpress user account. This is as it should be. However we occasionally get registrations directly through the /wp-login.php form which bypass the additional data we want in civi. These are invariably spam registrations that need manually deleting.</p>
  
  <p>We've experimented with plugins Theme My Login and WPS Hide Login but things get complicated without actually resolving the issue of preventing 'back door' registrations.</p>
  
  <p>Is there a simple way to ensure registrations are via CiviCRM?</p>
  
Tags: <wordpress><registration>
Title: Wordpress user registration only through CiviCRM
ThreadText: # Wordpress user registration only through CiviCRM
  
  (Asked by: username_0 on 2017-05-09)
  
  We have our site set up so that folk join our group through a Civi profile which then sets up a Wordpress user account. This is as it should be. However we occasionally get registrations directly through the /wp-login.php form which bypass the additional data we want in civi. These are invariably spam registrations that need manually deleting.
  
  We've experimented with plugins Theme My Login and WPS Hide Login but things get complicated without actually resolving the issue of preventing 'back door' registrations.
  
  Is there a simple way to ensure registrations are via CiviCRM?
  
  **Tags:** wordpress, registration
  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_0 on 2017-09-19. Score: 0 | Accepted answer
  
  Here's how we resolved it.
  
  1. Installed Theme My Login with security option and checkbox to disable wp-login.php and ReCaptcha options.
  2. Deleted the ‘Register’ page that TML created and set up redirects for /register and for /login/\?action=register.\* to go to the /join page that has the CiviCRM signup page.
  
  So, /wp-login.php brings up a 404 page not found, selecting register option opens the CiviCRM joining page. No spam registrations since doing this. Result!
  
  
  ---
  
  ### Answer by username_1 on 2017-05-10. Score: 2
  
  It looks like you could do the following:
  
  * Disable registrations in WordPress entirely ([instructions in this SE question](https://stackoverflow.com/questions/22500466/is-there-a-way-to-disable-user-registrations-completely-in-wordpress)), OR
  * Add a WordPress hook implementation in a custom module which prevents WordPress registration via the regular methods ([instructions in this SE question](https://wordpress.stackexchange.com/questions/95300/hook-before-inserting-user-into-database)), then
  * Use that hook to ensure that only the CiviCRM registration flow is allowed. (Use variables unique to only the CiviCRM workflow or WordPress registration workflow to identify whether the user has followed the desired path, and reject otherwise.)
  
  > **Comments:**
  > **username_0**: Thanks for the suggestions username_1. Disabling registrations in Wordpress through Settings also prevents CiviCRM profiles setting up accounts, so can't use that. I'm not keen to get into messing around with hooks but good to know that's an option. Hoping for a more mainstream and robust solution...  
  > **username_1**: Ray's suggestion is a good one too - you could disable direct access to `wp-login.php`, perhaps via `.htaccess` or removing the file (but watch out for upgrades). There may be WP plugins that deliver some way of preventing user rego also?  
  
  ---
  
  ### Answer by username_2 on 2017-05-11. Score: 1
  
  If you're not using /wp-login.php, is there any harm in just renaming it?
  
  We have problems with attacks pingback stuff, and since it's low utility for the victims, we just move the xmlrpc.php file to nope-xmlrpc.php, and that's the end of that.
  
  You might need to know the renamed file for the sake of admin logins, but it's a small price to pay for eliminating a nuisance like that without needing Akismet.
  
  > **Comments:**
  > **username_0**: I think this is what plugins like WPS Hide Login are doing. Problem is that wp-login.php IS being used, by CiviCRM as part of the option to create a WP account when using a profile. Disabling it blocks all registrations.  
  > **username_2**: So that's a common attack remediation strategy - CiviCRM should be configurable as to what the WP login path is?  
  
  ---
  
  ### Answer by username_3 on 2017-08-11. Score: 1
  
  I found the easiest solution was to hid the elements.
  
  ```
   function custom_login_css() {
      echo "<style>
  
  #login > p[id='nav'] { 
      color:transparent; 
  }
  
  body[class^='login login-action-login'] > #login > p[id='nav'] > a:nth-child(1) {
      display:none !important;
  }
  
  body[class^='login login-action-lostpassword'] > #login > p[id='nav'] > a:nth-child(2) {
      display:none !important;
  }
  </style>";
  
  }
  add_action('login_head', 'custom_login_css');
  
  ```
  
  > **Comments:**
  > **username_4**: While this would prevent manual signups, I would have assumed it doesn't stop spambots, which don't rely on rendered HTML/CSS.  Has this worked well for you?  
  
  ---
  
  