Email security for WordPress registrations

What it does

Fake registrations are a plague for stores and communities: burner addresses for coupon abuse, bot signups, throwaway accounts for spam. Two modules work together: verification decides whether an address is worth accepting, and the blocklist enforces your explicit deny list everywhere accounts and comments happen.

How it works

Verification runs a pipeline on every new address: syntax, an MX lookup to confirm the domain can actually receive mail, and a match against more than 27,300 known disposable-email domains (subdomains of known providers included, list community-maintained and filterable). Optionally block role accounts like admin@ and billing@, and enrich with Gravatar and Have I Been Pwned lookups. Those two are informational only and never block anyone.

DNS hiccups fail open by default, because a resolver outage should not stop real customers registering. Enforcement points cover WordPress and WooCommerce (including the modern block-based checkout), and the blocklist keeps full logs with import, export and statistics.

• Syntax, MX and disposable-domain checks on registration
• Optional role-account blocking (35 patterns, off by default)
• Gravatar and HIBP enrichment: metadata only, never blocking
• Fail-open on DNS errors by default
• Blocklist enforced at login, registration, resets, comments and WooCommerce
• Blocklist logs with import, export and stats