How do I stop spam registrations?
Turn off registration if you don't need it (Users → Options). Otherwise add a CAPTCHA and require admin approval for new accounts.
Why bots register
Bots look for open registration forms to create accounts for spam or to probe for weaknesses. Joomla's registration is off by default, so if you get spam accounts, it was turned on.
Steps
- Don't need registration? Go to Users → Manage → Options and set Allow User Registration to No.
- Need it? Set New User Account Activation to Self (email confirmation) or Administrator (you approve every account).
- Turn on a CAPTCHA: enable the Captcha - Invisible reCAPTCHA plugin (with your keys), then choose it under Global Configuration → Site → Default Captcha.
- Delete existing spam accounts in Users → Manage (filter by never-activated or never-logged-in).
Good to know
- Keep New User Registration Group on Registered: never let new accounts join a group with administrator access.
Sources
- User Registration – Joomla User Guide
- Joomla 4 to 5 Planning and Upgrade Step by Step – Joomla User Guide
