Recently I've been receiving many spammers creating an account on my website, which is quite basic and for which I don't need users create an account.

What would the likely URL that spam bots are finding be?
Is there a way to turn off account?

4 Answers 4


The answer given on How do I remove the user registration/login form? is relevant for this question too.

While it's technically possible to remove the login functionality, you shouldn't, because then your administrator could never log onto the site.

In order to remove the register functionality, you simply need to browse to admin/user/settings (for Drupal 6) or admin/config/people/accounts (for Drupal 7 and 8) and select the the "Only site administrators can create new user accounts" option.

  • You also need to clear the cache for it to take affect.
    – ProGrammar
    Commented Feb 18, 2019 at 16:30

You can disable the forms all together. In a custom module:

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  switch($form_id) {
    case 'user_login':
    case 'user_register_form':
      $form['#access'] = FALSE;

Depending on your needs, you can either create a custom page and set the login block there, so you and other administrators can login, or install HybridAuth module to allow visitors to login and register new accounts only through social media 3rd parties.


As an additional step to the above you could change the default url path from /user login screen using "rename admin paths" module to something nobody would guess.

Eg, www.sitename/randomcombition/ < this way user's will have to know this url before they can even try logging in.

  • Not sure how useful URL obfuscation really is
    – John Cogan
    Commented Jun 20, 2019 at 10:13
  1. yourwebsite.com/user - this is the standard Drupal login URL (at least for 7) and bots find it routinely.

  2. Remove visitor registration as described in Chapabu's answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.