How to Limit Bot Registration in WordPress (Code-Only Solutions: Math Verification, Honeypot, Rate Limiting)

Why Restrict Bot Registration?

WordPress's default registration lacks protection against automated bots (registration scripts), leading to spam accounts, promotional users, and even malicious accounts. This consumes server resources, pollutes the database, and poses security risks. This article introduces several code-only solutions, from simple to advanced, to help secure your site's registration process.

Method 1: Add a Math Verification (Alternative to CAPTCHA)

For environments where Google reCAPTCHA cannot be used, an effective alternative is to add a simple math question to the registration form. Humans can solve it easily, while bots struggle. Add the following code to your theme's functions.php file:

// 1. Generate and display math question on registration form
add_action('register_form', 'add_math_question_field');
function add_math_question_field() {
    $num1 = rand(1, 10);
    $num2 = rand(1, 10);
    $_SESSION['wp_math_answer'] = $num1 + $num2; // Store answer in session
    echo 'Security: ' . $num1 . ' + ' . $num2 . ' = ?';
    echo '';
}

// 2. Verify user's submitted answer
add_filter('registration_errors', 'verify_math_answer_on_registration', 10, 3);
function verify_math_answer_on_registration($errors, $sanitized_user_login, $user_email) {
    if (empty($_POST['math_answer']) || intval($_POST['math_answer']) !== $_SESSION['wp_math_answer']) {
        $errors->add('math_error', 'Error: Incorrect verification answer. Please try again.');
    }
    unset($_SESSION['wp_math_answer']); // Clear after verification
    return $errors;
}

Note: This example uses $_SESSION. Ensure your WordPress environment has session support enabled. Alternatively, use the Transients API combined with the user's IP to store the answer.

Method 2: Add a Honeypot Trap

Hide a form field (honeypot) from users. If it is filled, it indicates a bot and registration is denied. This is a lightweight and effective supplementary measure.

// 1. Add honeypot field (invisible to users)
add_action('register_form', 'add_honeypot_field');
function add_honeypot_field() {
    echo '
';
    echo 'Do not fill this field';
    echo '';
    echo '
';
}

// 2. Verify honeypot field
add_filter('registration_errors', 'verify_honeypot_on_registration', 10, 3);
function verify_honeypot_on_registration($errors, $sanitized_user_login, $user_email) {
    if (!empty($_POST['confirm_email'])) {
        $errors->add('honeypot_error', 'Bot detected: Registration denied.');
        error_log('Suspicious registration - honeypot triggered, IP: ' . $_SERVER['REMOTE_ADDR']);
    }
    return $errors;
}

Method 3: Limit Registration Frequency by IP

Limit the number of registration attempts from the same IP address within a short period to prevent brute-force registration.

add_filter('registration_errors', 'limit_registration_by_ip', 10, 3);
function limit_registration_by_ip($errors, $sanitized_user_login, $user_email) {
    $user_ip = $_SERVER['REMOTE_ADDR'];
    $transient_key = 'reg_attempt_' . md5($user_ip);
    $attempts = get_transient($transient_key);
    if ($attempts === false) {
        $attempts = 0;
        set_transient($transient_key, 1, HOUR_IN_SECONDS);
    } else {
        if ($attempts >= 3) {
            $errors->add('ip_limit_error', 'Error: Too many registration attempts. Please try again later.');
        }
        set_transient($transient_key, $attempts + 1, HOUR_IN_SECONDS);
    }
    return $errors;
}

Method 4: Enable Manual Review and Admin Approval

In the WordPress admin under Settings > General, after checking "Membership – Anyone can register," set the "New User Default Role" to a low-privilege role like "Subscriber." A stricter approach is to install a plugin like New User Approve, which requires manual admin approval for each registration.

Method 5: Disable or Rename the Default Registration Page

If you don't need public registration, the simplest method is to uncheck "Anyone can register" in Settings > General. If registration is needed for a specific group, use a plugin like WPS Hide Login to change the login/registration URL, reducing the chance of detection by generic bots.

Comprehensive Security Recommendations

• Combine Methods: Using "Math Verification + Honeypot + Frequency Limit" provides multiple layers of protection.
• Keep Updated: Ensure WordPress core, themes, and plugins are always up to date.
• Monitor Logs: Regularly check server error logs and user registration records to detect abnormal patterns.

By implementing these code-only methods, you can significantly enhance the security of your WordPress site's user registration process, effectively defending against automated registration attacks without relying on external services.