v1.3.2 — Block third-party registration notification emails

What's changed

Fixed

• Admin notification emails from third-party plugins are now suppressed.
  Some plugins send their own "New User Registration" admin email outside of WordPress's wp_new_user_notification() — before or independently of wp_insert_user(). In those cases the wp_new_user_notification_email_admin filter never fires (because user creation is already blocked at wp_pre_insert_user_data), so the email slipped through.

  A new pre_wp_mail filter (priority 1) now intercepts wp_mail() directly: if the recipient matches the site admin email and the subject contains a known registration keyword (rejestracja nowego / new user registration), the email is silently discarded. Emails sent by a logged-in admin with the create_users capability are not affected.

• wp_new_user_notification_email_admin priority bumped to PHP_INT_MAX — ensures no other plugin hooked at a higher priority can re-enable the notification after Registration Blocker suppresses it.

Upgrade notes

Drop-in replacement for 1.3.1 — no settings changes required.

v1.3.1 — Suppress registration notification emails

What's new

Two additional email suppression filters, closing a gap where the admin still received a "New User Registration" email even though the registration itself was blocked.

Problem

WordPress sends the "New User Registration" notification email after a successful wp_insert_user(). In most cases this email never arrives because wp_pre_insert_user_data prevents the insert. However, certain plugins (WooCommerce checkout flow, custom AJAX handlers) can invoke wp_new_user_notification() in a code path that partially bypasses the insert guard, causing the notification to fire even though no account was ultimately created.

Fix

• wp_new_user_notification_email_admin (priority 99) — suppresses the WordPress admin notification for any registration not initiated by a logged-in user with create_users capability. Admin-created accounts are unaffected.
• woocommerce_email_enabled_customer_new_account (priority 99) — suppresses the WooCommerce "New account" email for the same condition.

If notification emails persist after this update, the source is likely a form builder (Contact Form 7, WPForms, Gravity Forms) or a security monitoring plugin sending its own alerts. Check the email From: / X-Mailer headers to identify the sender.

v1.3.0 — Social login, directory & form builder registration blocking

What's new

New integrations

Nextend Social Login — blocks new account creation via Google, Facebook and X (Twitter) OAuth. Hooks into nextend_social_login_before_register_user (priority 1) before any database write occurs.

ListingPro (CridioStudio) — intercepts AJAX-based registration for vendors and listing authors (lp_register, lp_register_user, lp_vendor_register). Returns a JSON error response matching ListingPro's expected format.

CubeWP Forms — blocks registration forms built in the CubeWP form builder via AJAX hooks and the cwp_before_form_process filter.

Application Passwords blocking (WP 5.6+)

Non-administrator users can no longer create Application Passwords — neither from the profile screen nor via POST /wp/v2/users/{id}/application-passwords. Administrators are unaffected.

Log deduplication

The same masked IP address is now recorded at most once per 60 seconds, preventing a single bot from filling the entire 100-entry log with duplicate entries.

Improved log context

A new detect_registration_source() helper maps the current AJAX action to a plugin name. Direct wp_insert_user() calls intercepted by the low-level filter now show the correct source (e.g. "ListingPro") instead of the generic "wp_insert_user (direct)".

Bug fixes

• PHP 7.4 compatibility — mixed return and parameter type hints removed from rest_guard(). The mixed type hint requires PHP 8.0; the plugin declares Requires PHP: 7.4.

Upgrade notes

Upload the updated registration-blocker.php to wp-content/plugins/registration-blocker/. No database changes — no deactivation/reactivation needed.

v1.2.0 — Blokada wp_insert_user() direct calls

What's new

Added

• Low-level wp_pre_insert_user_data filter (priority 1) that intercepts any direct wp_insert_user() call from non-admins — catches form builders, membership plugins and custom code that bypass standard registration hooks. A WP_Error is returned before any database write occurs.
• New log label: wp_insert_user (direct) for attempts caught by this filter.

Fixed

• Registrations bypassing all standard hooks (resulting in an empty log) are now blocked at the lowest possible WordPress level.

Exempt from blocking (intentional)

• Updates to existing users
• Administrators with the create_users capability
• WP-CLI (migrations, imports)

Upgrade

Replace registration-blocker.php with the new version. No deactivation/reactivation required.