Stop WordPress registration spam
WordPress registration spam is mostly bots and throwaway inboxes, plus the odd person opening one account after another. The InlineShield plugin screens every new WordPress sign-up for bots, temp mail, VPNs and email aliases before the account is created, and refuses, holds or allows it according to your settings. No code to write.
Last updated
Install in four steps
- 01
Create a free InlineShield account and copy your API key and site key from the console's Setup page.
- 02
Download the plugin ZIP. In WordPress, go to Plugins › Add New › Upload Plugin, choose the ZIP, install it and click Activate.
- 03
Open Settings › InlineShield, paste your API key and site key, save, and click Test connection.
- 04
Optional, to hold accounts until you approve them: in the InlineShield console's Settings › Webhook, set the webhook URL to
https://<your-site>/wp-json/inlineshield/v1/webhook, then paste the webhook signing secret into the plugin's settings.
What the plugin protects
- The WordPress registration form (
wp-login.php?action=register). - WooCommerce My Account registration, and optionally accounts created at WooCommerce checkout. See WooCommerce.
The plugin adds InlineShield's browser check to those forms only, and checks the result on your server before WordPress creates the user. If the browser check didn't run, it screens the sign-up on the server instead.
You choose what happens
Allowed sign-ups go through. Blocked ones are refused with a neutral message. For sign-ups InlineShield wants reviewed, you pick one of three behaviours in Settings › InlineShield:
- let them sign up and flag the account (the default),
- let them sign up but block login until you approve them in the InlineShield review queue (needs the webhook secret), or
- refuse the sign-up.
You also choose what happens if InlineShield can't be reached: allow the sign-up (the default) or refuse it.
Each new user gets an InlineShield column on the Users screen with the verdict, risk score, recommended action and status. "Report fraud" and "Report legitimate" actions there send the real outcome back, which helps screening on your site.
For developers: withhold a bonus
Running a bonus or reward system? The plugin fires inlineshield_screened after each screened account is created, with InlineShield's recommended action. Here is how to skip the sign-up bonus for risky accounts:
add_action( 'inlineshield_screened', function ( $user_id, $decision ) {
if ( 'allow_no_bonus' === $decision['action'] ) {
update_user_meta( $user_id, 'my_signup_bonus_blocked', 1 );
}
}, 10, 2 );There is also a filter to change a decision before it is applied, an action for review decisions arriving by webhook, and a filter for the visitor's IP behind a trusted proxy. Not on WordPress? Use the REST API.
Frequently asked questions
Is the plugin free?
Yes, the plugin is a free download. It needs an InlineShield account for the API key and site key, and the Free plan includes 1,000 screenings a month.
Can I use it together with reCAPTCHA or Turnstile?
InlineShield doesn't replace or switch off a CAPTCHA plugin; it looks at different signals: the email address, the IP address and automation signals.
What do blocked users see?
A neutral message: "We couldn't create your account. Please contact support." It does not tell a bot what triggered the refusal.
What happens if InlineShield is down?
By default sign-ups are allowed, and the new account is stored with the verdict UNAVAILABLE so you can see it wasn't screened. You can choose to refuse sign-ups instead.
Where do I set the webhook?
In the InlineShield console under Settings › Webhook. The URL is https://<your-site>/wp-json/inlineshield/v1/webhook, and the signing secret goes into the plugin's settings.
Does it work behind Cloudflare or another proxy?
The plugin uses the connecting address and never trusts X-Forwarded-For by default. Behind a proxy you trust, a developer filter lets you pass the visitor's real IP.
Get your keys and install the plugin
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.