Skip to content

Knowledgebase

Restricting public registration in a Multisite network

wordpress, domains-dns

Control whether visitors can create network user accounts or new subsites through Multisite registration settings. Choose the narrowest registration model that suits your service, then test the public registration route and any plugin-provided forms.

01 Decide what should be permitted

Multisite distinguishes user registration from site registration. A private agency network may allow neither, while a publishing community may allow approved users without allowing them to create sites. Record who approves access and how unwanted registrations will be handled before enabling an open signup process.

02 Apply the network policy

  1. Open Network Admin > Settings > Network Settings as a Super Admin.
  2. Review the Registration Settings options and choose whether registration is disabled, users may register, logged-in users may create sites, or both are allowed.
  3. Review registration notifications, permitted or banned email domains, and reserved site names where relevant.
  4. Save the settings and test the registration page from a logged-out browser.
  5. Test a normal existing user's ability to create a site if that is part of the selected policy.

Will disabling registration remove existing users?

No. Registration controls future signup through the applicable workflow. Existing accounts and site memberships need a separate access review. Do not bulk-delete users as a substitute for closing registration, because they may own content or have legitimate membership on another subsite.

Why can a plugin still create accounts?

A membership, commerce or integration plugin may have its own account-creation workflow and permissions. Review those settings independently and test the actual public forms. Network registration settings are not a complete inventory of every system capable of adding users.

03 Prevent avoidable abuse

Use appropriate verification and rate controls for an intentionally public registration service. Monitor new accounts and sites for abuse and keep notification mail deliverable. Do not treat an email-domain allowlist as proof of a person's identity or authority to administer a site.

04 Verify the final experience

Check that legitimate users understand how to request access when open signup is closed. Confirm that administrators can still add approved users through the intended workflow and that password reset remains available. Keep a record of the selected policy and review it when new plugins introduce registration, checkout or community features.

Was this answer helpful?

Need a little more help?

Our support team can help you find the next step.

Contact support