How to stop fake account signups on WooCommerce

A guide for store owners. Updated October 13, 2026. Settings are named as in WooCommerce 11.

You open your customer list and find hundreds of accounts you've never heard of: random letters at throwaway email addresses, all made in the middle of the night, none with an order. That's bots, and they're not doing it for fun.

Why bots make fake accounts

• Welcome coupons. If new customers get a discount, every new account is another discount.
• Reviews. Unless reviews are limited to people who bought the product, an account is enough to post them.
• Card testing. On many stores a signed-in customer can save a card under My Account, Payment methods. Saving a card checks it with your payment provider, so a fake account can test stolen cards without placing an order.
• Spam and email damage. Every signup sends a welcome email, often to addresses that don't exist or to someone who never asked. Enough bounces and complaints hurt how well your real emails get delivered.

1. Close the doors you don't use

In WooCommerce, go to Settings, Accounts & Privacy:

• Account creation, On "My account" page. This is the open signup form bots use most. If customers only need an account to see their orders, untick it: they can still make one when they buy.
• Account creation, After checkout (recommended) lets a real customer turn their order into an account with one click, after they've paid. Bots don't pay, so it's the safest way in.
• Checkout, Enable guest checkout (recommended). Keep it on: fewer reasons to make an account at all.

In WordPress, go to Settings, General and untick Anyone can register unless you run a membership site. A shop doesn't need WordPress's own signup page; WooCommerce has its own.

And in WooCommerce, Settings, Products, tick Reviews can only be left by "verified owners", so an account alone can't post reviews.

2. Add a honeypot to the signup form

A honeypot is a field people can't see but bots fill in. In a small plugin or your theme's functions.php:

add_action( 'woocommerce_register_form', function () {
	echo '<p style="position:absolute;left:-9999px" aria-hidden="true"><label>Leave this empty '
		. '<input type="text" name="hp_website" tabindex="-1" autocomplete="off"></label></p>';
} );

add_filter( 'woocommerce_registration_errors', function ( $errors ) {
	if ( ! empty( $_POST['hp_website'] ) ) {
		$errors->add( 'hp', 'Sorry, something went wrong. Please try again.' );
	}
	return $errors;
} );

It stops simple bots. Better ones read the form and skip hidden fields, so it works best together with the next two steps.

3. Refuse throwaway email addresses

add_filter( 'woocommerce_registration_errors', function ( $errors, $username, $email ) {
	$domain = strtolower( substr( strrchr( $email, '@' ), 1 ) );
	if ( in_array( $domain, array( 'mailinator.com', 'yopmail.com', 'guerrillamail.com' ), true ) ) {
		$errors->add( 'throwaway', 'Please use an email address you can read.' );
	}
	return $errors;
}, 10, 3 );

Add the domains you see in your own fake accounts. There are thousands of throwaway services, so a short list catches the common ones, not all.

4. Limit signups from one address

Real customers make one account. A limit like 3 new accounts an hour from one internet address stops a flood without bothering anyone, but it needs a plugin or a firewall rule: WooCommerce has no setting for it. Make sure it doesn't count accounts made while placing an order, or a busy office or café Wi-Fi could cost you a sale.

5. Clean up the accounts already there

Go to Users and filter by the Customer role. Fake accounts usually share a pattern: random names, throwaway domains, made within minutes of each other, and no orders. Before deleting any, check under WooCommerce, Customers that they have no orders, and delete in small batches.

Or: one setting

Ropeline Pro's signup protection does steps 2 to 4 for you. WordPress's signup page and WooCommerce's My Account form get an invisible honeypot and a timing check (a form filled in faster than a person can type is a bot). Every signup, at the classic checkout and the checkout block too, is checked against a list of throwaway email services. And one address can make 3 new accounts an hour (1, if other Ropeline stores reported it), never counting accounts made while placing an order. Most real customers never notice any of it.