On one of our Drupal 7 sites (it's at v. 7.32) we're getting occasional 'bot based account creation requests. This is an information-only site where regular users will never log in, only administrators should be allowed to create accounts and only administrators and content creators can log in.
In Configuration under People "Who can register accounts?" is set to "Adminstrators only." Is that not sufficient to stop this from happening?
The accounts are being created but the admin email is being contacted to approve them, so these users are not actually able to log in, but we'd like to stop this account creation altogether.
Has anyone ever seen this?