How to enable user registration, but don't allow any of those users to login?

Question

I want to use the user registration page to collect user data and use its email verification checking to filter out fake users. But the thing is I don't want these users to be able to login to the site. How can this be done in Drupal 7?

Note: So no login at all. I just want to use the registration system to send them an email to verify their account.

Answer 1

Question refinement

This is a pretty tricky question, especially the "... no login at all ..." part of it. IMO you have to allow at least somebody with some specific role to perform a login ... If you don't, then even an admin (or user/1) cannot login. Which also implies you can't just deny access to the login URL for everybody (how else would an admin perform a login?).

Proposed solution

Below is a solution to "kick everybody (except admins) out right after login, but only after you send such user an appropriate eMail".

Here is the rule (in Rules import format) that should answer your question:

{ "rules_redirect_to_logout_except_for_role_id3" : {
    "LABEL" : "Redirect to logout except for role ID3",
    "PLUGIN" : "reaction rule",
    "ACTIVE" : false,
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "user_login" : [] },
    "IF" : [
      { "NOT user_has_role" : { "account" : [ "account" ], "roles" : { "value" : { "3" : "3" } } } }
    ],
    "DO" : [
      { "mail" : {
          "to" : "[account:mail]",
          "subject" : "No login allowed",
          "message" : "You just completed a login to [site:name], located at [site:url].\r\n\r\nHowever, at this time we do not allow any login ...\r\n\r\nThanks anyway for validating some of your account data, such as your eMail ID.",
          "language" : [ "" ]
        }
      },
      { "redirect" : { "url" : "user\/logout" } }
    ]
  }
}

The rule will be triggered (Rules Condition) right after login was completed. For any user who does not have the role that matches "role id = 3" (= Rules Condition), aka for any user who is not an administrator, it will perform these Rules Actions (in the order specified):

1. Send an appropriate eMail to the user that completed the login (since the user is logged in, you have the user's eMail Id available as part of the user's account info).
2. Redirect to the page user/logout (= force the user to be logged out again).

If you have the Rules UI enabled, you can just import the above rule and adapt the value (=3) of the role id to fit your needs. With that you solved your question.

Obviously, you'd have to adapt the eMail subject and content to fit your needs. Possibly you may also want to use some other (or additional) role IDs that you want to allow to login anyhow.

With the above approach, all what's left to do to fully answer your question, is to create an inventory (a view?) of all users and check their last login date. Those accounts that were created X hours/days ago but for which no login was completed ever, are the fake users you're looking for (because the eMail ID they entered during registration was invalid, or such users didn't really want to get registered so they never confirmed their registration request via an appropriate, temporary, login).

Note: by default the rule is disabled (so don't forget to enable it also).

Answer 2

You could use Rules

Event: After saving a new account

Action: Block a user >> data selector: account

Answer 3

The Easiest way to do this is, go to admin/config/people/accounts and choose Visitors, but administrator approval is required and save.
by selecting this option user can register on site and by default they status set to blocked and if admin approve them , they can log in to site otherwise they can not login site(block user can not login to site). There is not need any additional Rules or Code.

Answer 4

Add a validation hook to your login form and make it fail.

/**
 * Implementation of hook_form_alter().
 */
function YOUR_MODULE_form_alter(&$form, $form_state, $form_id) {
    if ($form_id == 'user_login') {
       array_unshift($form['#validate'], 'YOUR_MODULE_login_form_validate');
    }
}

function YOUR_MODULE_login_form_validate($form, $form_state) {
    form_set_error('','Your user is not enabled to login');
}

This can be useful to you