Justin Parr

<h3>Update: 6/2015</h3>
<p>Changed e-mail token and math problem confirmation logic.  Previously, everything happened all at once, and the user would get prompted mutliple times for the math problem.<br />
Now, the user must answer the math problem first, before the e-mail token is sent.  Once the math problem is correctly answered within the session, it isn’t asked again.  The user must now enter the correct token, which results in successful registration.<br />
SPECIAL THANKS TO OLEG M. FOR HELPING ME IDENTIFY, FIX, AND TEST THE ERROR!!</p>
<h3>Update: 5/2015</h3>
<p>Added E-mail confirmation token.  Prevents registration until user enters a token sent via e-mail.</p>
<h3>Features:</h3>
<ul>
<li>Prevent users from registering, if their IP or e-mail address is listed in the “Comments” blacklist (Settings..Discussion)</li>
<li>E-mails user a 4-digit token, and requires the user to enter the token in order to register.</li>
<li>Users must solve a simple math problem (Add two one-digit numbers).</li>
<li>Places user IP address in “Website” field.</li>
</ul>
<p>This is a super-simple user registration spam countermeasure.  I searched for a plugin that was SIMPLE and EFFECTIVE.  I looked at quite a few plugins that promised the desired effect, but were either cumbersome, or included too many unneeded or unwanted features.  Likewise, there are some very simple plugins that are less-than-effective.</p>
<h3>This plugin is VERY simple:</h3>
<p>If the user’s IP or e-mail address is listed in the “Discussion” comments blacklist, it prevents the user from registering.  This functionality should really be built in to WordPress, so, you’re welcome.</p>
<p>When the user registers, they are presented with a simple math problem – adding a 3-digit number to a 1-digit number.  99% of the “user reg spam” is based on bots being able to attack the basic WordPress registration form.  By adding even a simple math problem, most bots will fail, removing your site as a target of opportunity.  Criminals go after what’s easy – if you make it slightly more difficult for them, they will go after someone else.</p>
<p>Once the user solves the math problem, they are sent a 4 digit token via e-mail, and must enter that token to continue registration.</p>
<p>Finally, knowing the location from where your users register allows you to more effectively evaluate and block the source.  This plugin adds the user’s IP address (at the time of registration)  to the “Website” field.</p>
<p>Go to http://whois.arin.net to find out who they are.  If you decide to block the IP,  add the IP address, part of the IP address, or e-mail domain to the “Discussion” comments blacklist, and ANY user registrations from an IP address matching that pattern will be blocked.</p>
<h3>Configuration</h3>
<h3>To Configure the Plugin:</h3>
<p>NOTE:  NO CONFIGURATION IS REQUIRED.  This plugin is fully-functional using the default values.</p>
<p>In the Plugins page, click “Settings” underneath the “JP User Registration Blacklist” plugin.</p>
<ul>
<li>
<p>Seed:  This value determines how the answer to the math problem is masked.  Periodically change this, to keep the spammers and criminals at bay.  The initial value is randomly-generated.</p>
</li>
<li>
<p>Failed Math Response:  Error message displayed to the user, if they fail to correctly solve the math problem.</p>
</li>
<li>
<p>Rejected IP or E-mail:  Error message displayed to the user, if their IP or e-mail is blocked.  Keep this simple and generic, to keep them from knowing why they are being blocked.</p>
</li>
<li>
<p>Form field name for math problem:  This field name contains the user’s answer to the math problem.  Periodically change this, to keep the bots away.  The initial value is randomly-generated.</p>
</li>
</ul>
<h3>To Block an IP address</h3>
<ol>
<li>In the WordPress Dashboard, go to “Settings…Discuss”</li>
<li>To block all or part of an IP address, add it on its own line to “Comments Blacklist”</li>
<li>To block all or part of an e-mail address, add it on its own line to “Comments Blacklist”</li>
<li>Click “Save”<br />
(For more details, see Examples)</li>
</ol>


JP User Registration Blacklist

Prevent User Registration Spam, and Track New User IP address

Rolf Allard van Hagen

<p><a href="https://wordpress.org/plugins/jetpack/" rel="ugc">Jetpack</a> adds powerful features, but sometimes we don’t want them all… This light-weigth but effective plugin brings additional control over Jetpack.</p>
<h4>Features</h4>
<ol>
<li>Blacklist / remove individual Jetpack modules.</li>
<li>Optionally prevent module auto-activation on connection or after an upgrade.</li>
<li>Optionally run Jetpack “unplugged”, without a WordPress.com connection.</li>
<li>Single site and Multisite compatible.</li>
</ol>
<h4>Examples</h4>
<p>In most use cases, a carefully considered combination of Jetpack modules can be a really good thing. But not always is much consideration being done beforehand. Or site admins just don’t know all the implications…</p>
<ul>
<li>Using Jetpack on a network? Then network incompatible WAF (Web Application Firewall) module should be blacklisted to prevent accidental activation!</li>
<li>Do you already use a light box provided by your theme or another plugin? Then blacklist the Carousel module to prevent accidental activation.</li>
<li>Or you’re running a Multisite and do not want any admins monitoring uptime with the Monitor module just to call you every time their site is briefly inaccessible?</li>
<li>Offer your own backup service? Backlist VaultPress if you do not care for VaultPress competition.</li>
<li>You’re running a school network and sites are managed by minors who are not allowed to sign up for an account at WordPress.com? Then use the Jetpack Offline Mode option to allow usage of modules that do not require a connection.</li>
</ul>
<p>Any one of Jetpack’s modules can bring overlapping or even conflicting functionality. In such cases, being able to prevent (accidental) activation is a good thing.</p>
<h4>Single site and Multisite</h4>
<p>Although the original idea arose on a multisite installation, Module Control for Jetpack is developed for both single and multisite installations.</p>
<p>On <strong>multisite</strong>, it can only be network activated and allows global rules for Jetpack on all sites. At this point it also allows per-site changes by Super Admin only. Jetpack itself can, but does not need to be network activated. In that case, activate Jetpack on the main site and then network-activate Module Control.</p>
<p>For <strong>single site</strong> installations, plugin settings can be locked down by adding <code>define('JETPACK_MC_LOCKDOWN', true)</code> to wp-config.php for complete security. This can be useful to prevent other admins being able to reactivate blacklisted modules.</p>
<h4>Development</h4>
<p>The project can be forked and or contributed to on <a href="https://github.com/RavanH/jetpack-module-control" rel="nofollow ugc">Github</a>.</p>
<p>All contributions — be it in the form of feature requests, bug reports, translations or code — are welcome!</p>


Module Control for Jetpack

This plugin fits perfectly with my needs.  For example when installing the Jetpack's gallery in a client's website I prefer not to setup a wordpress.com account just for that.



Very useful

Tames the beast known as Jetpack. Jetpack just seems to be getting worse all the time... This plugin works pretty good at getting some control back over it.
Thanks, Ravan

Tames the beast

like the fact that you can ban(blacklist) features in jetpack! Very good considering that jetpacks tends to do what it wants on your website.

JP User Registration Blacklist vs Module Control for Jetpack