v1.3.0 — Social login, directory & form builder registration blocking

What's new

New integrations

Nextend Social Login — blocks new account creation via Google, Facebook and X (Twitter) OAuth. Hooks into nextend_social_login_before_register_user (priority 1) before any database write occurs.

ListingPro (CridioStudio) — intercepts AJAX-based registration for vendors and listing authors (lp_register, lp_register_user, lp_vendor_register). Returns a JSON error response matching ListingPro's expected format.

CubeWP Forms — blocks registration forms built in the CubeWP form builder via AJAX hooks and the cwp_before_form_process filter.

Application Passwords blocking (WP 5.6+)

Non-administrator users can no longer create Application Passwords — neither from the profile screen nor via POST /wp/v2/users/{id}/application-passwords. Administrators are unaffected.

Log deduplication

The same masked IP address is now recorded at most once per 60 seconds, preventing a single bot from filling the entire 100-entry log with duplicate entries.

Improved log context

A new detect_registration_source() helper maps the current AJAX action to a plugin name. Direct wp_insert_user() calls intercepted by the low-level filter now show the correct source (e.g. "ListingPro") instead of the generic "wp_insert_user (direct)".

Bug fixes

• PHP 7.4 compatibility — mixed return and parameter type hints removed from rest_guard(). The mixed type hint requires PHP 8.0; the plugin declares Requires PHP: 7.4.

Upgrade notes

Upload the updated registration-blocker.php to wp-content/plugins/registration-blocker/. No database changes — no deactivation/reactivation needed.