Using Fluent Auth registration for more secure WooCommerce registration?
I have a customer whom I am helping with her WooCommerce shop. Yep I wanted to use FluentCart but this is a Norwegian shop with special needs something that WooCommerce offers. Anyhow. She is getting a lot of registrations made by fake new customers. So I am thinking I can use FluentAuth to help create a more secure signup form. I do not yet have any ideas on how to accomplish this. Any ideas?
Thank you.
Paal Joachim Romdahl Spammy Accounts can be registered in many ways:
- Automated scripts that fill out the visible /my-account /account /wp-register registration form.
- Scripts that bypass the front-end entirely by sending data directly to backend addresses (REST API, XML-RPC).
I suggest to use FluentAuth features (or a custom code snippets) to make the registration form hostile to bots.
You can:
- Enforce Email Verification and it will require users to click a link in an email to activate their account. This can blocks registrations made with fake/non-existent email addresses (make sure this is OK with the business goal and UX).
- Block the channels that bots use to bypass the form entirely and Disable XML-RPC - this is a legacy protocol frequently targeted for brute-force attacks and is rarely needed for modern WooCommerce setups.
- Disable Application Passwords if the client is not using external apps (like mobile apps) to access the site data.
- Restirct REST API User Creation/Enumeration by blocking unauthenticated public access to the user endpoint.
- *Implement Registration Rate Limiting the number of new user registrations allowed from a single IP address within a short period if possible and needed (ex: max 3 per hour) - this would require some custome snippet I guess since it is not available out of the box AFAIR (this could be a nice fAuth new feature)
You could also try to block IPs but it might be hard to block them (you can block ASNs with CF WAF if needed and if it is justified). Just review logs and use IP blocking features to manually or automatically block IP ranges associated with persistent spam attempts.
ps. You should also take care of the native WP Registration form so spammers wont abuse it. But if you disable users registration in WP then you need to somehow (just verify the whole current process before disabling user registration feature) create user account after purchase has been made - it shouldnt be a problem but check the process on a staging site..
WordPress controls user registration in two places, and we must manage both:
WordPress Core Setting (Settings > General):
This controls the generic registration link typically found on the standard login page (/wp-login.php).
Disable: "Anyone can register" (it should be unchecked) - this blocks random spam registrations that arent tied to a purchase.
WooCommerce Setting (WooCommerce > Settings > Accounts & Privacy):
This controls account creation specifically during the checkout process.
To ensure accounts are only created when a customer makes a purchase, configure your WooCommerce settings as follows:
Enable this setting: Allow Account Creation During Checkout
This instructs WooCommerce to use the customers billing email and details to programmatically generate a new WordPress User account when the order is placed.
Disable Guest Checkout with setting "Allow customers to place orders without an account" (if needed) to ensure that every customer is forced to either log in or create a new account to complete the transaction, tying every purchase to a user entity
btw: I wish we could see in fAuth option to charge $x for a new account registration and user would be forced and redirected to fCart to pay $1 as a verification fee so all our WP users would be verified since day 1 not only shop customers.
Mat Thank you Mat!
I am going through it.