Currently I’m using a workaround – for “real” users that I want to allow to login, I set them as a different user role. Then I set an automatic login redirect for all [User Role = Subscriber] to [ /wp-login.php?action=logout ], and add a code in functions.php to remove the logout confirmation:
add_action('check_admin_referer', 'logout_without_confirm', 10, 2);
function logout_without_confirm($action, $result)
{
/**
* Allow logout without confirmation
*/
if ($action == "log-out" && !isset($_GET['_wpnonce'])) {
$redirect_to = isset($_REQUEST['redirect_to']) ? $_REQUEST['redirect_to'] : 'url-you-want-to-redirect';
$location = str_replace('&', '&', wp_logout_url($redirect_to));
header("Location: $location");
die;
}
}
Source: https://wordpress.stackexchange.com/questions/67336/how-to-log-out-without-confirmation-do-you-really-want-to-log-out
This works as a simple honeypot, and any non-authorised Google logins get force logged-out.
But preferably I’d like to prevent auto-registration altogether. Appreciate any help, thanks.
-
This reply was modified 11 months, 2 weeks ago by Michael Kwan.