Description
MyNew Registration Lockdown enforces one centralized user-creation policy across WordPress. Instead of relying only on the public registration setting or a visible form, it evaluates user creation at the shared wp_insert_user() insertion layer.
The default policy blocks unauthorized account creation while allowing:
- Logged-in administrators with the
create_userscapability inside wp-admin. - WP-CLI user creation by a server operator.
- Explicitly authorized integrations through the documented
mnrl_is_user_creation_authorizedfilter.
The plugin also disables the default registration action, can disable multisite signups, records privacy-aware audit events, retains those events for a configurable period, and can send threshold-based email alerts.
No telemetry is collected. The plugin does not contact MyNew Technologies or any third-party service.
Documentation and support: https://mynewtechnologies.com/products/registration-firewall/
Installation
- Upload the
mynew-registration-lockdowndirectory to/wp-content/plugins/or install the ZIP through Plugins > Add New > Upload Plugin. - Activate the plugin.
- Open Settings > Registration Lockdown.
- Review the default authorization policy before deploying to a site that intentionally creates users through custom integrations.
FAQ
-
Does this merely hide the registration form?
-
No. It enforces policy at the user insertion layer used by WordPress core and most integrations.
-
Can administrators still create users?
-
Yes, by default, logged-in users with the
create_userscapability can create users from wp-admin. -
Can an integration be allowed?
-
Yes. Authenticate and authorize the integration, then return
truefrom themnrl_is_user_creation_authorizedfilter for that specific request. -
Does the plugin disable XML-RPC or remove REST routes?
-
No. Those interfaces may provide unrelated functionality. The plugin blocks unauthorized user creation without unnecessarily disabling entire subsystems.
-
What data is logged?
-
The plugin stores the request time, request channel, method, path, and user agent. IP, login, and email values are stored only as keyed SHA-256 hashes.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“MyNew Registration Lockdown” is open source software. The following people have contributed to this plugin.
Contributors
Translate “MyNew Registration Lockdown” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.2
- Replaced interpolated table identifiers with WordPress identifier placeholders.
- Documented intentional cache bypasses for retention cleanup and uninstall operations.
- Eliminated the remaining Plugin Check database warnings.
1.0.1
- Resolved Plugin Check findings for translation loading, global prefixes, translator comments, and request classification.
- Added short-lived object caching for dashboard aggregates and recent events.
- Improved database-query documentation and cache invalidation.
- Moved cleanup scheduling to activation and expanded uninstall cleanup.
- Added stronger PHPDoc and defensive result handling.
1.0.0
- Initial production release.
- Central user-creation policy gate.
- Administrator and WP-CLI authorization controls.
- Privacy-aware database audit log.
- Retention cleanup and threshold alerts.
- Settings and recent-events dashboard.