Subject: Bot accounts registering despite reCAPTCHA v2 and spam protection

Hi,

For the past few weeks I have been getting automated-looking user registrations on my website, recently several per day. The usernames are random strings of letters, and the accounts have no forum activity.

The accounts appear both in wpForo → Members and in WordPress → Users, where their role is Subscriber.

My current settings are:

• WordPress Settings → General → Anyone can register is enabled.
• wpForo Enable User Registration is enabled.
• wpForo email confirmation is enabled.
• wpForo Google reCAPTCHA v2 Checkbox is configured with API keys.
• reCAPTCHA is enabled for both the wpForo Registration Form and WordPress Registration Form (as well as login/reset forms).
• wpForo Spam Control is enabled.
• Ban user when spam is suspected is enabled.
• Advanced and IP-based Flood Protection are enabled.
• Akismet is installed and active.

Nevertheless, bot-looking accounts are continuing to be created.

I also have WooCommerce and the plugin Login & Register Forms – Popup, Slider, Profile & WooCommerceinstalled, so I am wondering whether the registrations might be bypassing the wpForo registration form through another WordPress registration endpoint.

Could you please advise me how to determine which registration route these accounts are using, and whether there is a way in wpForo to confirm that reCAPTCHA is actually being executed and validated when these accounts are created?

I am not a developer, so if you need me to check something, I would appreciate step-by-step instructions.

Thank you!