Turn Off User Registration If You Do Not Use It

What this check and mySites.guru tool looks at on your site

This check reads the Allow User Registration setting from your Joomla Users component configuration and flags sites where public self-registration is switched on.

It is a single setting with an outsized effect, because it decides whether reaching the “authenticated” state a lot of security advisories treat as a mitigating factor is trivial or genuinely difficult. That is why it sits in this section rather than being treated as a minor content-management preference.

Lowering the bar for every other flaw

Joomla ships with user registration enabled by default, and most sites never actually need it. If nobody is meant to sign up for an account on your site, an open registration form is doing nothing for you except sitting there as an attack surface.

The more serious cost only shows up when a vulnerability is disclosed in one of the extensions running on your site. A meaningful share of Joomla extension vulnerabilities require the attacker to be logged in before the flaw can be exploited, because that is treated as a mitigating factor when the severity is scored. These are usually not admin-only flaws. They typically need nothing more than the lowest-privilege Registered user group, the group anyone who self-registers lands in by default. A stored cross-site scripting bug that only a logged-in user can trigger, or a privilege-escalation flaw that lets a Registered user promote themselves further, both rely on the same assumption: that reaching “logged in” is itself some kind of obstacle.

With registration closed, that assumption holds. The attacker needs valid credentials for an account that already exists, which means compromising a real user first. With registration open, it does not hold at all. Anyone can create an account in seconds through the same public form your genuine visitors would use, and immediately meet the “authenticated” requirement the vulnerability was scored against. A flaw that looked like a lower-severity finding on paper, because it assumed some difficulty in reaching an authenticated session, becomes trivially reachable by anyone with a web browser.

Spam is the everyday cost, and it compounds the security one. Automated signup bots find open registration forms within days of a site going live, and every account they create is one more row in your Users table, one more email address that may later be used to test stolen password lists against your login form, and, if any part of your site lets logged-in users post comments or content, one more source of spam that has to be moderated or cleaned up after the fact.

Off, unless visitors genuinely need accounts

Public user registration is switched off unless your site genuinely needs visitors to create their own accounts, for example a forum, a membership area, or e-commerce checkout. If you are not sure whether anyone actually uses it, that itself is usually the answer.

A quick way to check is to look at your Users list, sorted by registration date. A steady trickle of accounts with generic-looking usernames or email addresses from free providers, none of whom have ever logged a second time, is a strong sign registration is doing nothing for you except accumulating spam accounts. Genuine visitors who register for a reason tend to come back and use the account; bots register once and never return.

Some extensions run their own registration or membership system independently of Joomla’s core Users component, for example certain e-commerce or forum extensions with their own account tables layered on top of Joomla’s. This check looks at Joomla’s own Allow User Registration setting specifically. If your site uses one of those extensions, check its own registration settings separately; turning off Joomla’s core registration does not necessarily affect a third-party system running alongside it.

How to fix it

Turning registration off does not remove any accounts that already exist. It only stops new ones being created through the public form. If you suspect the accounts you already have include spam signups, review the Users list separately once registration is closed, rather than assuming closing the form has retroactively cleaned anything up.

1. Log in to https://yoursite.com/administrator and go to Users > Options.
2. Under the Component tab, find Allow User Registration.
3. Set it to No.
4. Save & Close.
5. If you need registration for a specific purpose but want to restrict who can use it, look at Joomla’s registration group settings and any membership or access-control extension you already have installed, rather than leaving the default form open to the entire internet.

What mySites.guru does about it

We check this setting on every snapshot and flag it where registration is open. This is one of the checks with a one-click fix: once you confirm you do not need public registration, we can turn it off for you, and apply the same fix across every connected Joomla site in your account at once rather than site by site.