MyNew Registration Lockdown — MyNew Technologies
MyNew Technologies Security

MyNew Registration Lockdown

A centralized user-creation security policy for WordPress that helps prevent unauthorized account creation across supported registration and provisioning workflows.

View on WordPress.org Read Documentation
✓

One Policy. Multiple Entry Points.

Protect the user-creation workflow itself rather than relying only on a visible registration form or a single public-registration setting.

Version 1.0.2 Production release
GPL v2 or later Open-source licensing
No telemetry No usage data transmitted
Vendor neutral No theme dependency
Why it exists

Disabling public registration is not the same as establishing a complete account-creation policy.

WordPress provides a setting that controls standard public registration. Modern sites, however, may also include themes, plugins, integrations, importers, automation tools, REST endpoints, AJAX handlers, XML-RPC clients, and custom code capable of invoking WordPress user-creation APIs.

The common assumption

Administrators often assume that turning off “Anyone can register” means no new account can be created through any mechanism. That setting governs the standard public-registration experience, but it is not designed to function as a universal authorization layer for every custom provisioning workflow.

The engineering response

MyNew Registration Lockdown applies policy closer to the centralized WordPress user-insertion workflow. This creates a consistent control point for supported account-creation attempts while preserving authorized administrative operations and existing-user profile updates.

Security principle Protect the event that matters—creation of a new user record—rather than trying to identify every possible form, theme, endpoint, importer, or integration that may initiate it.
1

Centralized enforcement

Applies an authorization decision within the WordPress user-creation workflow.

2

Core registration interception

Reinforces the lockdown policy against the standard public-registration process.

3

Administrator authorization

Allows explicitly authorized administrative account-creation workflows.

4

WP-CLI controls

Supports configurable treatment of command-line user provisioning.

5

Multisite signup control

Provides optional restrictions for supported multisite signup workflows.

6

Privacy-conscious logging

Records security events using keyed hashes rather than retaining raw attempted identifiers.

7

Configurable retention

Allows administrators to define how long audit events remain stored.

8

Threshold alerts

Can notify administrators when blocked activity exceeds a configured hourly threshold.

9

Recent-event reporting

Provides administrative visibility into recently blocked account-creation attempts.

Technical architecture

How the policy is applied

Multiple request channels may ultimately converge on WordPress user-creation functions. MyNew Registration Lockdown places its authorization decision within that centralized workflow using the wp_pre_insert_user_data filter.

Public registration
REST endpoints
AJAX handlers
XML-RPC integrations
Plugins and themes
Import and provisioning tools
Authorization Policy New user or existing user?
Authorized context or blocked request? wp_pre_insert_user_data
Permit approved creation
Preserve profile updates
Block unauthorized creation
Record security event
Evaluate alert threshold
Apply retention policy
Documentation

Installation and configuration

Install the plugin through the WordPress administrative interface, activate it, and review the security policy before enabling it on a production site.

1

Install

Upload and install the plugin ZIP through Plugins → Add New → Upload Plugin.

2

Activate

Activate MyNew Registration Lockdown from the installed plugins screen.

3

Configure

Open Settings → Registration Lockdown and review each authorization, logging, retention, and alert option.

4

Test

Verify permitted administrator workflows and confirm that unauthorized account creation is blocked as expected.

Recommended deployment process

  • Install first on a staging or test environment.
  • Document every legitimate process that creates user accounts.
  • Test administrative, importer, membership, LMS, commerce, and automation workflows.
  • Confirm existing-user profile updates continue to operate normally.
  • Review audit events before enabling threshold notifications.
  • Maintain a current recovery path and administrative backup account.

Configuration areas

  • Master lockdown status
  • Administrator-created users
  • WP-CLI-created users
  • Core registration interception
  • Multisite signup restrictions
  • Audit logging and retention
  • Notification threshold and recipient
  • Data-removal behavior during uninstall
Developer integration

Authorize a verified provisioning workflow

Developers can use the plugin’s authorization filter to permit a trusted integration after that integration has independently authenticated and validated its request.

Authorization filter

The example below illustrates the intended pattern. The external workflow must establish its own authentication, authorization, integrity checks, and replay protections before returning an authorized decision.

add_filter( 'mnrl_is_user_creation_authorized', function ( $authorized, $userdata ) { if ( $authorized ) { return true; } return defined( 'MY_VERIFIED_PROVISIONING_REQUEST' ) && MY_VERIFIED_PROVISIONING_REQUEST && current_user_can( 'create_users' ); }, 10, 2 );
Do not authorize a workflow solely because a request includes a predictable parameter, action name, URL, or user-controlled value. Authorization should depend on a verified and trusted security context.
Privacy and security

Designed to minimize unnecessary data exposure

The plugin does not require telemetry, license validation, remote assets, or an external API service.

Area Implementation Status
Telemetry No product-usage telemetry is transmitted to MyNew Technologies. Not used
External API calls The core plugin does not depend on an external API for enforcement. Not required
Remote assets Administrative assets are packaged locally with the plugin. Local
License validation The Community Edition does not require remote license activation. Not required
Audit identifiers Security events use keyed hashes instead of storing raw attempted email, login, or IP values. Privacy conscious
Retention Administrators can define how long audit events are retained. Configurable
Frequently asked questions

Operational guidance

Does this replace the standard WordPress registration setting?

The plugin reinforces account-creation policy beyond the standard public-registration setting. Administrators should still configure native WordPress registration options appropriately.

Will it block existing users from updating their profiles?

The policy is designed to distinguish new-user creation from updates to existing users so ordinary profile updates can continue.

Can administrators still create users?

Yes, when the administrator authorization option is enabled and the current user has the required capability.

Can a trusted importer or integration create users?

Yes. Developers may authorize a verified provisioning workflow through the documented filter after implementing appropriate authentication and authorization controls.

Does the plugin depend on a specific theme or third-party plugin?

No. The architecture is vendor neutral and does not depend on a named theme, membership platform, commerce system, or other third-party product.

Does it send data to MyNew Technologies?

The Community Edition does not include telemetry and does not require an external API connection for its core security policy.

Should I test it before using it on production?

Yes. Any plugin that controls account creation should be tested against every legitimate registration, provisioning, importer, automation, and administrative workflow used by the site.

Need help before you deploy?

Our team can walk through configuration, staging tests, or a verified-integration filter for your environment.

Email Support Community Support
Security software reduces risk but cannot guarantee that every account-creation path, third-party integration, custom implementation, compromised administrator session, database-level modification, or future WordPress behavior will be controlled in every environment. Maintain layered security, tested backups, strong administrator authentication, least-privilege access, and ongoing monitoring.
MyNew Registration Lockdown
Developed by MyNew Technologies
Version 1.0.2 · GPL v2 or later · No telemetry