Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/mmyhamid/wp-anti-spam-registration/archive/refs/heads/main.zipUser registration with email verification to reduce spam post
Anti-Spam User Registrations
A lightweight WordPress plugin that prevents spam registrations by requiring email confirmation before account activation.
Includes automatic cleanup, SMTP email delivery, and front-end notices.
✨ Features
- Requires users to confirm their email before activation.
- Assigns new users a temporary Pending role until confirmed.
- Sends confirmation link via secure email.
- Automatically deletes unconfirmed accounts after 7 days.
- Configurable SMTP (via PHPMailer).
- Redirects users to homepage after login.
- Front-end notices for success/failure.
- Option to limit multiple registrations from the same IP.
📥 Installation
$phpmailer->isSMTP(); $phpmailer->Host = 'mail.yourdomain.com'; // ✅ Your SMTP server $phpmailer->SMTPAuth = true; $phpmailer->Port = 587; // ✅ Use 587 (TLS) or 465 (SSL) $phpmailer->Username = 'info@yourdomain.com'; // ✅ Your full email address $phpmailer->Password = 'your_smtp_password'; // ✅ Your SMTP password $phpmailer->SMTPSecure = 'tls'; // or 'ssl' $phpmailer->From = 'info@yourdomain.com'; // ✅ Must match your email $phpmailer->FromName = get_bloginfo('name');
👉 Security Tip: Instead of hardcoding your SMTP password, add this line in wp-config.php:
define('ASR_SMTP_PASS', 'your_smtp_password');
And in the plugin code, it will use:
$phpmailer->Password = defined('ASR_SMTP_PASS') ? ASR_SMTP_PASS : 'your_email_password';
- Email Deliverability
To make sure emails land in Inbox (not Spam):
Add SPF, DKIM, and DMARC DNS records for your domain.
Always use an email address that belongs to your domain (e.g., info@yourdomain.com).
Avoid free emails like Gmail/Yahoo for sending.
- Other Configurations
Pending Role: Users are given the Pending role until they confirm.
Auto-Delete: Unconfirmed users are deleted after 7 days.
IP Limit: Max 3 registrations per IP within 24 hours (editable in code).
Redirect: After login, all users are redirected to the homepage.
🚀 Usage
A new user registers → plugin marks them as Pending.
User receives a confirmation email with a link.
After clicking the link:
Account becomes active.
User is redirected to the Set Password page.
Success notice is displayed on the homepage.
After login, users are always redirected to the homepage.
🗑 Cleanup
The plugin automatically deletes unconfirmed accounts older than 7 days.
This is handled via a daily scheduled event (WordPress cron job).
💡 Notes
Emails may take a few seconds to arrive depending on your SMTP server.
If no emails arrive, check your error log or enable WP_DEBUG to see SMTP errors.
Tested on WordPress 6.x+.
📜 License
This plugin is released under the GPL-2.0+ License