Signup Shield
Stops the wp-signup.php bot flood dead. No captcha, no paid service, no false positives on real people.
What it does
Loads before everything else and refuses the request at the earliest possible point.
Generated for you, so most attempts never reach PHP at all.
Ready-made ConfigServer (CSF) regex rules to ban repeat offenders at the network edge.
Drop-in rules for servers running mod_security.
Copy-paste Cloudflare expressions for the last layer.
A dashboard widget showing exactly what was blocked and when.
If you run WordPress Multisite, you already know the problem: bots hammer wp-signup.php thousands of times a day, filling your database with junk accounts and your logs with noise.
Signup Shield blocks them in layers — a must-use plugin that never loads for a bot, an .htaccess rule that rejects the request before PHP starts, firewall regex rules, and optional edge rules. On our own network it logged over 16,800 blocked hits in the first three days, with no legitimate registration ever touched.
Specifications
| Blocks | wp-signup.php, wp-activate.php, xmlrpc registration |
|---|---|
| Layers | mu-plugin, .htaccess, CSF, ModSecurity, edge |
| Requires | WordPress 6.0+, PHP 7.4+ |
| Multisite | Fully supported |
Questions about this product
Do real users ever get blocked?
No. The rules target the signup endpoints specifically, and registration by an invited or admin-created user is untouched.
Do I need all the layers?
No. The mu-plugin alone stops the flood; the rest is for people who want the traffic gone before it reaches PHP.