User registration forms
4 min read
The kind User registration creates a new WordPress user from a public form and saves the values of the chosen field groups for that user. Visitors get a Username, an Email and (optionally) a Password field on top of your own fields.
The New accounts card
Setting | Default | Notes |
|---|---|---|
Role | Subscriber | The role the new user gets. Help: "Only roles that cannot edit, publish or manage anything are offered." |
Password | The visitor chooses one | Or Email a link to set it. |
Register even when registration is off | off | Help: "Settings › General › "Anyone can register" normally decides. Turn this on to use only this form for sign-ups." |
If WordPress's Anyone can register setting is off and this switch is off, a warning in the editor says "Anyone can register" is off in Settings › General, "so this form shows "Registration is closed."".
Roles
A registration form can never hand out a powerful role. The role list contains only roles that have no capability that edits, deletes, publishes, uploads, manages, moderates, imports, exports, installs, reads private content or is an administration capability. On a default site that leaves Subscriber; a custom role (for example a shop's customer role) is offered when it only has read-type capabilities. Roles such as Contributor, Author, Editor and Administrator are never offered, and a form saved with one is refused: "Choose a role that cannot edit, publish or manage anything. Registration forms never give such roles."
Developers can narrow the list with the wpmcf/forms/registration_roles filter; roles it adds that are not safe are ignored.
Passwords
- The visitor chooses one: a Password box with the hint "At least 10 characters, mixing letters with numbers or symbols." The password must:
- have at least 10 characters,
- contain at least one letter and at least one number or symbol,
- not contain the username. Otherwise the visitor sees "Choose a password of at least 10 characters that mixes letters with numbers or symbols." Developers can change the rule with the
wpmcf/forms/password_is_strongfilter.
- Email a link to set it: no password box; the form says "We will email you a link to set your password." The account is created with a random password and WordPress sends its standard Login Details email with the link to set a password.
What visitors see
Situation | Result |
|---|---|
Registration open | The form: Username, Email, Password (or the email-link note), your fields, button Create account. |
Registration off and the switch off | "Registration is closed." Administrators also see a note on how to turn it on. |
The visitor is already logged in | "You are already logged in." (administrators also see "Visitors who are not logged in see the registration form here."). |
The form does not appear for logged-in users, so test it in a private window.
Checks and messages
Field | Message |
|---|---|
Username | "Enter a username using letters, numbers and . - _ @ only." / "This username is already taken." |
"Enter a valid email address." | |
Email already registered | "This email address cannot be used to register. If you already have an account, log in instead." The wording is the same for any refusal so the form does not reveal which addresses have accounts. |
Password | "Choose a password of at least 10 characters that mixes letters with numbers or symbols." |
On any error the form is shown again with the values (except the password) and a Your entry was not sent: list.
After registration
- The user is created with the chosen Role; their field group values are saved.
- The visitor is not logged in automatically. The default message is "Your account has been created." (or your Success message, or your Redirect to page, for example the login page).
- In The visitor chooses one mode WordPress sends no email by itself. In Email a link to set it mode the new user receives WordPress's Login Details email. The optional Email me about entries notification (to you) links to the new user's edit screen.
- There is no email confirmation and no approval step. Protect the form with spam protection, including a CAPTCHA, because registration forms attract bots.
Who can use it
Registration forms are open to everyone who is not logged in; Who can submit is not shown. Saving a registration form with a restriction through the API is refused: "Registration forms are for visitors who are not logged in, so everyone must be allowed to submit them."
Still stuck? Contact support