Two settings in WordPress decide whether strangers can create accounts on your site and what power those accounts get. They sit next to each other on Settings → General, they are easy to overlook, and on most business websites the right answer is to leave the first one switched off.
People usually come looking for the WordPress user registration settings for one of two reasons. Either a stream of odd new “Subscriber” accounts has started appearing under Users, or they are setting up a shop, course or members area and need customers to sign up. Both situations are covered below, along with the one combination of settings you should never allow.
Where to find the WordPress user registration settings
Log in as an administrator and open Settings → General. About halfway down you will find:
- Membership, with a single checkbox labelled Anyone can register.
- New User Default Role, a dropdown of roles. Recent versions list Subscriber, Contributor and Author, plus any extra roles added by plugins such as WooCommerce, and leave Administrator and Editor out.
These are the only core controls for public sign-ups. There is nothing about registration under Users itself, which is why people often cannot find them.
On a WordPress multisite network the switch is somewhere else: the network administrator controls registration from the network’s own settings screen, and individual sites do not show the Membership checkbox.
What “Anyone can register” actually does
When the box is ticked, the WordPress login page gains a Register link, and the registration form at /wp-login.php?action=register starts working. Anyone who fills in a username and email address gets an account straight away, with an email inviting them to set a password. The site admin email receives a notice about each new user.
When the box is unticked, that form refuses new accounts and says registration is not allowed. Nothing else changes. You, as an administrator, can still add people yourself from Users → Add User (Add New User or Add New on older versions); our guide to creating a new user account in WordPress walks through that.
The role a self-registered person receives is whatever New User Default Role says. On a fresh installation that is Subscriber, which can log in, edit their own profile and do nothing else in the dashboard.
Does your site need open registration?
Ask a simple question: does any visitor need their own login to use your site? For a typical small-business website, a brochure of services, a blog and a contact form, the answer is no. Your enquiry forms work without accounts, and comments can be left without one too, depending on your Discussion settings.
| Type of site | Anyone can register | Default role |
|---|---|---|
| Service business, brochure site, blog | Off | Subscriber (unused, but keep it safe) |
| WooCommerce shop | Usually off; WooCommerce handles customer accounts | Subscriber; WooCommerce gives shoppers the Customer role itself |
| Membership, course or community site | Depends on the plugin; check its documentation | Subscriber or the plugin’s own member role |
If a site was built from a theme demo or by a previous developer, the checkbox is sometimes ticked for no reason anyone remembers. Turning it off on a site that never used it does no harm.
Turning off public sign-ups
- Go to Settings → General.
- Untick Anyone can register.
- Check that New User Default Role shows Subscriber.
- Scroll down and click Save Changes.
- Open your login page in a private browser window and confirm the Register link has gone.
If the Register link is still there after saving, a plugin may be supplying its own sign-up form. Look through your plugins for anything related to membership, login customisation or social login, and check its settings.
Cleaning up spam registrations
Bots find open registration forms quickly, and most of the accounts they create are never used. A Subscriber can do very little, so they are more nuisance than danger, but they clutter the user list and fill your inbox with notifications. Once registration is closed, clear them out:
- Go to Users → All Users and click Subscriber in the row of role filters above the list.
- Look at the email addresses and the Posts column. Spam accounts tend to have random names, throwaway email domains and zero posts.
- Tick the accounts you are sure about, choose Delete from the Bulk actions menu and click Apply, then confirm.
Go slowly if real people also have Subscriber accounts, such as newsletter readers or past customers. When in doubt, leave the account and look at it again later. If you do need registration to stay open, a form-protection plugin with a CAPTCHA or honeypot field cuts down on automated sign-ups.
Never make Administrator the default
Older versions of WordPress let you pick Administrator or Editor as the default role. Recent versions keep both out of the dropdown unless one of them is already the saved setting, so if you open this screen and see Administrator or Editor selected, someone or something chose it. Change it to Subscriber and save. With registration open, either role would let a stranger sign up and take control of your site.
Hiding the choice in the dropdown does not stop it being set another way. Attackers who find a weakness in a plugin sometimes use it to change exactly these two settings, switching on registration and setting the default role to Administrator, then sign up as an admin through the normal form. So it is worth glancing at this screen now and then, even if you are sure you never touched it. If you find it changed, or find an administrator you did not create, read our guide on what an unknown admin user in WordPress means before deleting anything, because the account may be the visible part of a bigger problem.
For the difference between Subscriber, Contributor, Author and the rest, see what each WordPress user role can do.
Shops and membership sites
A WooCommerce store needs customer accounts, but it does not need the core checkbox for that. WooCommerce has its own account options under WooCommerce → Settings, including whether customers can create an account at checkout and on the My Account page. Those accounts get the Customer role. You can keep Anyone can register off and still let shoppers sign up through WooCommerce, which avoids a second, unprotected sign-up route on wp-login.php.
Membership, course and forum plugins vary. Some provide their own registration page and work with the core checkbox off; others expect it to be on. Read the plugin’s documentation, set the default role to the plugin’s member role or Subscriber, and make sure the sign-up form you actually use has spam protection.
These choices are part of the bigger question of who should have an account on your site at all, which our guide to WordPress user management covers, alongside the rest of our WordPress owner’s guide.
Frequently asked questions
Will turning off registration remove the accounts that already exist?
No. Unticking the box only stops new people signing up through the WordPress registration form. Every existing account keeps working with the same role and password. If you want to remove old or spam accounts, you have to delete them yourself from the Users screen after checking that none of them belong to real customers or staff.
Can I approve new registrations before they get access?
Not with core WordPress. An account created through the registration form is active as soon as the person sets a password. If you need a manual approval step, several plugins add one, holding new accounts as pending until an administrator approves them. Membership plugins often include something similar in their own sign-up process.
Why do I still get new user emails after turning registration off?
Something else is creating the accounts. Common sources are WooCommerce checkout, a membership or course plugin, a social login plugin, or a form plugin with a user registration feature. Look at the role of the new accounts for a clue, then check that plugin’s settings. If none of those explain it, treat the new accounts as suspicious.
Can a Subscriber account harm my site?
On its own, very little. A Subscriber can log in, see a nearly empty dashboard and edit their own profile. The risk comes when a plugin has a security flaw that any logged-in user can trigger, which is one more reason to keep registration closed when you do not need it and to keep plugins updated.
If spam accounts keep appearing with registration switched off, or your default role has changed without explanation, our WordPress bug fixing service can trace where the sign-ups are coming from and close the route.
Next in this series: See Who Changed What in WordPress: Logs for Staff
