Skip to content

Early-bird lifetime licence: $199 once, for the first 200 buyers only. See the offer

Spam trap in the registration form

Adds a hidden field to the wp-login.php registration form that bots fill in and people never see. Those registrations are refused.

  • Type PHP
  • Runs Everywhere (runs as WordPress loads)
  • Category Security
  • Tested with WordPress 7.1
PHP
<?php

add_action(
	'register_form',
	static function () {
		echo '<p class="snipfire-hp" aria-hidden="true" style="position:absolute;left:-9999px;height:0;overflow:hidden">'
			. '<label>Leave this empty <input type="text" name="snipfire_hp_company" value="" tabindex="-1" autocomplete="off"></label></p>';
	}
);
add_filter(
	'registration_errors',
	static function ( $errors ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Registration form, checked by WordPress.
		if ( ! empty( $_POST['snipfire_hp_company'] ) ) {
			$errors->add( 'snipfire_spam', __( '<strong>Error:</strong> Registration failed. Please try again.' ) );
		}
		return $errors;
	}
);

In these packs

Move your snippets over this afternoon.

Importing changes nothing until you switch over, and your old shortcodes keep working.