I’ve had the same problem for a number of months when after getting hundreds of spam registrations. I tried renaming the register path and installed extra anti-spam plugins too. Eventually I decided to just disable registrations completely thinking that would end the problem.
However, I still get around 10-20 spam registrations on some days by people (bots?) that don’t need any registration page to be able to register on my site. There exists no page or legitimate means on my site to register but still they do. Apparently, people say the spammers can exploit WordPress security loopholes to register directly without a registration form.
I would be grateful if someone could explain what these loopholes are and why I can’t prevent registrations. At the moment the default registrations are set to ‘Pending’ with only very minimal rights so they need to be approved before they can actually post anything visible. Still I have to continually manually delete these spam registrations where they soon outnumber the small group of 50 legitimate members.
I’ve looked at T-P’s links and already have Askimet installed (free version) and doubt if the no-bot-registration would fix the problem as it’s aimed at adding questions to the registration process to thwart bots – which I don’t have.
It’s possible that blocking spam registrations with .htaccess is something worth looking into but that’s going to be a whole new learning curve for me. It would work if the bulk of IP addresses of the spammers are closely related.
Though I’m still not sure why if I don’t want registrations WordPress just can’t stop this happening? Especially if there are ways of blocking particular IP addresses from registering!
