A user registration form lets visitors create an account on your WordPress site. Membership sites, online courses, community forums, and WooCommerce stores all need one, because an account lets a visitor save progress, track orders, join discussions, or access members only content.
WordPress already has registration built in. The core software can create user accounts, send password emails, and assign roles, all without a plugin. The built in form is plain, though, and it lives on the default login page. This guide shows you how to turn on the built in registration first, then build a custom form with extra fields using a small code snippet.
You will learn three things. First, how to enable registration in Settings and add a register link to your menu. Second, how to build a custom form with a shortcode, a security nonce, and the wp_insert_user function. Third, how to pick the right default role and stop spam accounts before they fill your user list. No plugin is needed for any of it.
What does the built-in WordPress registration do?
WordPress core includes a complete user system. When registration is turned on, a visitor can create an account with a username and an email address, and WordPress sends them a link to set a password. The new account gets the default role you choose, such as Subscriber, and the user can then log in through the standard login page at yoursite.com/wp-login.php.
The built in system also handles password resets, profile editing, and role permissions. A Subscriber can read content and edit their own profile, but cannot publish posts or change settings. That is exactly what most membership and community sites need. If you are unsure which role fits each kind of member, read our guide to WordPress user roles explained before you open registration, because the wrong default role can give new users more access than you intended.
How do I enable user registration in WordPress?
Enabling registration takes less than a minute. Go to Settings, then General, in your WordPress dashboard. Tick the checkbox labelled “Anyone can register”. Below it, choose the default role for new users from the dropdown. For most sites, Subscriber is the safe choice, because it gives the least access. Save the changes, and registration is live.
Before you save, think about what new users should be able to do on your site. A blog that only needs commenters can use Subscriber. A store might need Customer, which WooCommerce adds when it is active. Never choose Administrator, Editor, or Author as the default role, because anyone on the internet could then create a powerful account. You can change the default role at any time in the same settings screen.
Once registration is on, the default form appears on the login page. Under the login fields, WordPress shows a “Register” link that takes visitors to the registration page. That page works, but it looks plain and it cannot collect extra details such as a phone number or a company name. That is why most site owners replace it with a custom form on a normal page.
How do I add a registration link to my menu?
Visitors will not find your registration page unless you link to it. The simplest way is to add a “Register” item to your main menu. Go to Appearance, then Menus, and open the Custom Links section. Add a link to yoursite.com/wp-login.php?action=register with the label “Register” or “Join Us”, then save the menu. The link now appears in your header for every visitor.
If you build a custom form later in this guide, point the menu link at that page instead, for example yoursite.com/register. A dedicated register page looks more professional than the default login screen, and you can add your own heading, benefits, and design around the form. If your login page itself needs a better look, our guide to customize the WordPress login page without a plugin shows how to style it with code.
How do I build a custom registration form with code?
A custom form is a shortcode that prints a form on any page and creates the user when the form is submitted. Add the code below to your child theme functions.php file or with the Code Snippets plugin, then place the shortcode [vu_register_form] on your register page. The form asks for a username, an email address, and a password, and it checks a security nonce before creating anything.
function vu_register_form_shortcode() {
if ( is_user_logged_in() ) {
return '<p>You are already logged in.</p>';
}
$output = '';
if ( isset( $_POST['vu_register_submit'] ) ) {
if ( ! wp_verify_nonce( $_POST['vu_register_nonce'], 'vu_register' ) ) {
return '<p>Security check failed. Please try again.</p>';
}
$username = sanitize_user( $_POST['vu_username'] );
$email = sanitize_email( $_POST['vu_email'] );
$password = $_POST['vu_password'];
$user_id = wp_insert_user( array(
'user_login' => $username,
'user_email' => $email,
'user_pass' => $password,
'role' => 'subscriber',
) );
if ( is_wp_error( $user_id ) ) {
$output .= '<p>' . $user_id->get_error_message() . '</p>';
} else {
$output .= '<p>Account created. You can now log in.</p>';
}
}
$output .= '<form method="post">';
$output .= wp_nonce_field( 'vu_register', 'vu_register_nonce' );
$output .= '<p><label>Username<br><input type="text" name="vu_username" required></label></p>';
$output .= '<p><label>Email<br><input type="email" name="vu_email" required></label></p>';
$output .= '<p><label>Password<br><input type="password" name="vu_password" required></label></p>';
$output .= '<p><input type="submit" name="vu_register_submit" value="Create Account"></p>';
$output .= '</form>';
return $output;
}
add_shortcode( 'vu_register_form', 'vu_register_form_shortcode' );Three parts of this code deserve attention. The nonce is a one time security token that proves the form was submitted from your own site, which blocks forged requests from other websites. The sanitize functions clean the username and email before they reach the database, which blocks harmful input. The wp_insert_user function is the official WordPress way to create a user, and it handles password hashing, validation, and the welcome email automatically.
Test the form while logged out, because a logged in admin sees only the “already logged in” message. Open a private browser window, visit your register page, fill in the form, and submit it. Then check Users in your dashboard to confirm the new account exists with the Subscriber role. If you see an error about the username or email already existing, that means WordPress validation is working, and you should try a different username.
How do I add extra fields to the registration form?
Many sites need more than a username, email, and password. A course site might want a full name, a community site might want a display name, and a business directory might want a company name. Add the extra input to the form HTML, then save its value with update_user_meta after wp_insert_user creates the account.
For example, add a text input named vu_full_name to the form, then after the user is created, call update_user_meta with the new user id, the key vu_full_name, and the sanitized value from the form. WordPress stores the value in the user meta table, and you can show it on the user profile or in the members area later. Keep extra fields to a minimum, though, because every extra field lowers the number of visitors who finish the form. Ask only for what you truly need at signup, and collect the rest later in the profile.
Always validate extra fields on the server, never only in the browser. A required attribute in HTML is easy to bypass, so check the submitted value in PHP and show an error if it is empty or invalid. For the official functions used here, see the developer documentation at developer.wordpress.org.
How do I choose the right default role for new users?
The default role decides what a brand new account can do before you review it. Subscriber is right for blogs, membership sites, and communities where members only read content and comment. Customer is right for WooCommerce stores, because it lets buyers view orders and manage their address. A forum plugin may add its own role, such as Participant, which is right for discussion boards.
Never let self registered users create content until you trust them. If a site lets new users publish posts, spammers will use it to publish links within hours. Start with the lowest role, then upgrade trusted members by hand in Users. You can also change the role in the wp_insert_user array in the code above.
How do I stop spam registrations?
An open registration form attracts bots. The first sign is a flood of accounts with strange usernames and email addresses from free providers. You can slow them down with three simple measures. First, add a CAPTCHA or a honeypot field to the form, which blocks most automated submissions. Our guide to add Google reCAPTCHA to WordPress without a plugin shows the code method. Second, require email confirmation before the account can log in, so fake addresses never become active accounts. Third, check your user list every week and delete accounts that never log in.
Another useful measure is to block disposable email domains in your validation code, and to limit how many accounts can register from one IP address in a short time. If spam still gets through, consider manual approval, where new accounts stay inactive until an admin approves them. It is more work, but it is the strongest defence for a small community site. A fast host also helps against bot floods, so keep your hosting solid with our web hosting guide.
What should happen after a user registers?
A new user who lands on a blank dashboard feels lost. Send them somewhere useful instead. After registration, redirect them to a welcome page, a getting started guide, or their course dashboard. Our guide to redirect users after login in WordPress shows how to send each role to a different page, so subscribers land on the members area while customers land on the shop.
Also send a clear welcome email that explains what the account unlocks and where to start. Include a link to the login page and a way to contact support, because that single email turns a bare account into a real member.
When is a plugin the better choice?
The code method in this guide is free, light, and perfect for a simple form with a few fields. A plugin is better when you need conditional fields, file uploads, payment at signup, or an approval workflow with email templates. If you are not comfortable editing PHP, use a form plugin or ask a developer to add the shortcode for you. Whichever route you choose, keep the form short, keep the default role low, and test it while logged out before you share the link.
Frequently asked questions
Does WordPress have a built-in registration form?
Yes. WordPress core includes registration, and you turn it on in Settings, then General, by ticking “Anyone can register”. The built in form lives on the login page and collects only a username and an email address. For a styled form on your own page, use the shortcode method in this guide.
Can I add a registration form in WordPress without a plugin?
Yes. Enable registration in Settings, then add the shortcode from this guide to your child theme or Code Snippets and place [vu_register_form] on a page. The code uses wp_insert_user and a security nonce, so it creates real WordPress accounts with no plugin installed.
What is the safest default role for new users?
Subscriber is the safest default for most sites, because it lets new users read content and edit their own profile, but not publish posts or change settings. WooCommerce stores should use Customer instead. Never use Administrator, Editor, or Author as the default role for self registration.
How do I stop spam accounts from registering?
Add a CAPTCHA or honeypot field to the form, require email confirmation before login, and review your user list weekly to delete accounts that never log in. For a small community, manual approval of new accounts is the strongest option, even though it takes more of your time.
Last updated: November 2026.
