How do I turn off account creation?

Question

Recently I've been receiving many spammers creating an account on my website, which is quite basic and for which I don't need users create an account.

What would the likely URL that spam bots are finding be?
Is there a way to turn off account?

Answer 1

The answer given on How do I remove the user registration/login form? is relevant for this question too.

While it's technically possible to remove the login functionality, you shouldn't, because then your administrator could never log onto the site.

In order to remove the register functionality, you simply need to browse to admin/user/settings (for Drupal 6) or admin/config/people/accounts (for Drupal 7 and 8) and select the the "Only site administrators can create new user accounts" option.

Answer 2

You can disable the forms all together. In a custom module:

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  switch($form_id) {
    case 'user_login':
    case 'user_register_form':
      $form['#access'] = FALSE;
    break;
  }
}

Depending on your needs, you can either create a custom page and set the login block there, so you and other administrators can login, or install HybridAuth module to allow visitors to login and register new accounts only through social media 3rd parties.

Answer 3

As an additional step to the above you could change the default url path from /user login screen using "rename admin paths" module to something nobody would guess.

Eg, www.sitename/randomcombition/ < this way user's will have to know this url before they can even try logging in.

Answer 4

1. yourwebsite.com/user - this is the standard Drupal login URL (at least for 7) and bots find it routinely.

2. Remove visitor registration as described in Chapabu's answer