Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
By default Drupal enables account creation (with verification)
This is no longer adequate since you will quickly get flooded by many, many, many spam accounts.
If you are going to enable anonymous account creation you need to set up several contrib modules to protect your site before you enable them.
Steps to reproduce
Install Drupal fresh.
Proposed resolution
Set account creation to Administrators only by default.
Remaining tasks
None
User interface changes
N/A
API changes
N/A
Data model changes
N/A
Release notes snippet
The default value of the "Who can register accounts?" setting has changed from "Visitors, but administrator approval is required" to "Administrators only" for any new sites built with either the "Standard" or "Minimal" installation profiles.
Issue fork drupal-3453676
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3453676-make-who-can
changes, plain diff MR !8363
Comments
Comment #2
mandclu commented+1 for this idea. Providing the most secure option as the default makes sense.
Comment #3
cilefen commented+1
Comment #4
dww+1. I have to do this on every site I set up. Admin-only should be the default until folks opt-in to something more permissive.
Comment #6
nicxvan commentedI updated the minimal test to match new defaults.
Comment #7
nicxvan commentedComment #8
dwwThanks!
-Derek
Comment #9
nicxvan commentedComment #10
lauriiiThis feature to some extent goes together with the Comment module because this way you can get your username verified. I still think it makes sense to disable this behavior by default because usually if you want to accept registrations on the site, that's would be an explicit decision. It seems fine to require an extra step for that, given that there's likely couple of other extra steps you'd have to take in order to avoid getting tons of spam accounts.
Comment #11
gábor hojtsyI agree with Lauri and others above. Unfortunately the internet became a place where you need to set up extensive protections to even attempt to enable user registration publicly. :/ Most of those don't come with core so you may be in for some nasty surprises before you may have a chance to set up the tools to avoid it.
Comment #12
alexpottAdded a review comment to the MR - we need to add a positive assertion to the test now that we changed an assertion to a negative one.
Comment #13
nicxvan commentedI addressed @alexpott's feedback, I'll create a change record, I didn't see anyone say it's necessary, but I suspect it will be.
Comment #14
nicxvan commentedCR created.
Comment #15
dwwBack to RTBC.
Thanks,
-Derek
Comment #16
alexpottCommitted b719931 and pushed to 11.x. Thanks!
Comment #19
gábor hojtsyComment #21
ressaThanks for making this change, adding an older issue, suggesting the same thing, back in 2016.
Comment #22
ressaI suggested #3558703: Add account creation check in the great Security Review module.