I think we've all had the experience of putting up a site and forgetting to turn off the "visitors can create accounts" setting... and getting spam user creation or worse.

I suggest that we change the default to "only administrators can create accounts" on admin/config/people/accounts. The attached patch does that.

What I did: Installed a new Drupal site

What I expected: I would be in complete control of the website (and the only user) until I configured it otherwise.

What happened instead: A thousand spambots found the site and created bogus users.

Comments

rfay’s picture

Patch dropped again.

dave reid’s picture

Status: Needs review » Closed (duplicate)