Reject Registrations Submitted Too Fast
Stamps the WordPress registration form with a signed time and refuses sign-ups sent within a few seconds of loading it, which stops most registration bots.
Opens WPIDE on
Code
$wpide_reg_min_seconds = 5;
add_action( 'register_form', function () {
$time = (string) time();
printf( '<input type="hidden" name="wpide_reg_ts" value="%s">', esc_attr( $time . '.' . wp_hash( 'reg-ts-' . $time ) ) );
} );
add_filter( 'registration_errors', function ( $errors ) use ( $wpide_reg_min_seconds ) {
$stamp = isset( $_POST['wpide_reg_ts'] ) ? sanitize_text_field( wp_unslash( $_POST['wpide_reg_ts'] ) ) : '';
$parts = explode( '.', $stamp, 2 );
$valid = 2 === count( $parts ) && ctype_digit( $parts[0] ) && hash_equals( wp_hash( 'reg-ts-' . $parts[0] ), $parts[1] );
if ( ! $valid || time() - (int) $parts[0] < $wpide_reg_min_seconds ) {
$errors->add( 'wpide_too_fast', '<strong>Error:</strong> Please take a moment and try again.' );
}
return $errors;
} );Notes
Real people need a few seconds to type a username and email; raise the minimum if bots adapt.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.