Spam trap in the registration form
Adds a hidden field to the wp-login.php registration form that bots fill in and people never see. Those registrations are refused.
<?php
add_action(
'register_form',
static function () {
echo '<p class="snipfire-hp" aria-hidden="true" style="position:absolute;left:-9999px;height:0;overflow:hidden">'
. '<label>Leave this empty <input type="text" name="snipfire_hp_company" value="" tabindex="-1" autocomplete="off"></label></p>';
}
);
add_filter(
'registration_errors',
static function ( $errors ) {
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Registration form, checked by WordPress.
if ( ! empty( $_POST['snipfire_hp_company'] ) ) {
$errors->add( 'snipfire_spam', __( '<strong>Error:</strong> Registration failed. Please try again.' ) );
}
return $errors;
}
);
In these packs
- Login and security extras: Limit login attempts, email-only logins, a registration spam trap and more hardening.