WordPress registration enabled
What this means
This refers to a potential misconfiguration where the default WordPress registration feature is left open, allowing anyone to register and create an account on the site.
Why this is a problem
If this is unintended and/or not carefully managed, attackers can register accounts attempting to impersonate trusted individuals, edit or interact with the site in unintended ways, such as leaving comments against articles and posts.
How to check if the problem is there
Check WordPress Settings:
- Log into the WordPress Admin Panel.
- Navigate to Settings > General.
- Look for the option “Anyone can register” under “Membership.”
How to fix this
If you have determined that user registration is not required for your website, then disable this setting by following the steps below:
- Log into the WordPress Admin Panel.
- Navigate to Settings > General.
- Uncheck the option “Anyone can register” under “Membership.”
- Save changes.
- Go to Users > All Users to check if there are unauthorised or spam accounts.
If you require users to access your site for collaboration purposes, consider adding users via an invite instead of allowing self-registration. More information on this can be found on the WordPress site.
In addition to this, consider implementing the following controls:
- if registration is necessary, set the new user default role to the lowest permission level.
- enable CAPTCHA for registration, to prevent bots from registering.
- ensure your WordPress site is always kept up to date to ensure the registration system is free of vulnerabilities