Registration Blocker WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA
Block user registration site-wide — WordPress core, WooCommerce, BuddyPress, REST API and more.
Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/schlebek/registration-blocker/archive/refs/heads/master.zip🔒 Registration Blocker
Block user registration at every level — WordPress core, WooCommerce, BuddyPress, REST API and more.
Overview
Most "disable registration" solutions only toggle the native WordPress option — leaving every third-party plugin free to create accounts through its own forms and APIs. Registration Blocker closes all of those gaps simultaneously: it hooks into 12+ integration points and blocks new user creation at the filter, form, REST, and XML-RPC levels.
Blocked attempts are logged locally with masked IPs, visible from a clean admin dashboard.
Features
🛡️ Multi-layer blocking
| Layer | What is blocked |
|---|---|
| WordPress Core | register_post hook, users_can_register option, /wp-login.php?action=register |
| URL matching | Redirects /register, /registration, /signup, /sign-up, /rejestracja slugs |
| WooCommerce | My Account & Checkout registration forms |
| BuddyPress / BuddyBoss | Signup page and form submission |
| Ultimate Member | Registration form and page |
| ProfilePress | Registration form submission |
| MemberPress | mepr_allow_new_user_registration filter |
| Paid Memberships Pro | Guest registration (existing users can still change plans) |
| Restrict Content Pro | rcp_registration_is_open filter |
| bbPress | User registration capability |
| User Registration (WPEverest) | Form and user action |
| REST API | POST /wp/v2/users for non-admins + user enumeration via GET /wp/v2/users |
| XML-RPC | wp.newUser and wp.registerNewBlog methods |
🔐 Security
- Forces
users_can_register = 0to the database on activation - Validates redirect URL against the site domain — no open redirects
- Masks IPs in logs (last IPv4 octet / last two IPv6 groups hidden)
- Blocks user enumeration via REST API for non-administrators
- Singleton with
__cloneand__wakeupprotection
📊 Admin interface
- Stats cards — blocked attempts today / last 7 days / total
- Integration grid — live detection of which plugins are active
- Blocked attempts log — masked IP, integration, identifier, timestamp
- CSV export of the full log
- Admin bar indicator — visible on every screen
- Dashboard widget — quick summary on WP home screen
Screenshots
| Admin page | Dashboard widget |
|---|---|
| Stats, integration status, and blocked attempts log | Today / 7-day / total counters with recent entries |
Requirements
| Minimum | |
|---|---|
| WordPress | 5.9 |
| PHP | 7.4 |
| Database | MySQL 5.6 / MariaDB 10.0 |
Installation
From WordPress admin
- Go to Plugins → Add New Plugin
- Search for Registration Blocker
- Click Install Now, then Activate
Manual upload
- Download the latest
.zipfrom Releases - Go to Plugins → Add New Plugin → Upload Plugin
- Upload the zip, then Install Now and Activate
Via WP-CLI
wp plugin install registration-blocker --activateNo additional configuration is required. Registration is blocked immediately on activation.
Configuration
Go to Settings → Blokada rejestracji.
| Option | Default | Description |
|---|---|---|
| Block message | Rejestracja jest wyłączona. |
Shown to users who try to register via forms |
| Redirect URL | Site homepage | Where to redirect users visiting registration pages. Must be on the same domain. |
FAQ
Does this prevent admins from creating users?
No. Users with create_users capability can still create accounts via WP Admin or the REST API.
Does it break WooCommerce guest checkout?
No. Guest checkout stays available — only account creation is disabled.
Where is the log stored?
In wp_options (key: rb_blocked_log), up to 100 entries. No data is sent externally.
What happens on deactivation?
The plugin intentionally does not restore users_can_register — you decide when to re-enable registration.
What happens on uninstall?
All options (rb_message, rb_redirect_url, rb_blocked_log) are deleted from the database.
Changelog
See CHANGELOG.md for a full history.
Contributing
Bug reports and feature requests are welcome via GitHub Issues.
Please use the provided issue templates.
License
Releases
4 releases.
These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.