Introduction

The Email and Domain Blocking feature allows you to prevent registrations from specific email addresses or entire domains. This is essential for blocking spam registrations, disposable email services, and known problematic users.

Blocking rules are easy to configure and take effect immediately across both WordPress and WooCommerce registration forms.

Why Block Emails and Domains?

Email and domain blocking helps protect your site from:

  • Spam registrations – Mass account creation from disposable email services
  • Bot attacks – Automated registration attempts from known spam domains
  • Problematic users – Prevent specific users from creating new accounts
  • Temporary email services – Block domains like 10minutemail, guerillamail, etc.
  • Corporate/competitor domains – Restrict registrations from specific companies
Use Case Example

If you notice multiple spam registrations from emails ending in @example.com, you can block the entire @example.com domain to prevent future registrations from that source.

How Email Blocking Works

When a user attempts to register with a blocked email or domain:

  1. User fills out the registration form with their email address
  2. Upon form submission, the plugin checks the email against your blocklist
  3. If the email or domain matches a blocked entry, registration is rejected
  4. User sees a customizable error message
  5. No account is created, and no data is stored

The validation happens server-side, ensuring security even if JavaScript is disabled.

Configuring the Blocklist

Setting up email and domain blocking is straightforward:

Step-by-Step Configuration

  1. Navigate to Settings → Safe Registration
  2. Find the Email/Domain Blocklist field under General Settings
  3. Enter email addresses or domains you want to block
  4. Use commas to separate multiple entries
  5. Click Save Changes
Instant Effect

Changes take effect immediately. No cache clearing or additional configuration needed.

Blocking Syntax and Examples

The plugin supports two types of blocking entries:

1. Specific Email Address

Block individual email addresses:

  • spam@example.com – Blocks this exact email
  • user123@test.com – Blocks this specific user

2. Entire Domain

Block all emails from a domain using the @ symbol:

  • @example.com – Blocks all emails ending in @example.com
  • @test.com – Blocks all emails from test.com
  • @disposable-email.com – Blocks disposable email service

Multiple Entries

Separate multiple emails or domains with commas:

  • @example.com,@test.com,spam@bad.com
  • @10minutemail.com,@guerrillamail.com,@tempmail.com
Important

Use commas without spaces between entries. The format should be: entry1,entry2,entry3

Common Domains to Block

Here’s a list of popular disposable email services you might want to block:

  • @10minutemail.com
  • @guerrillamail.com
  • @mailinator.com
  • @tempmail.com
  • @throwaway.email
  • @temp-mail.org
  • @fakeinbox.com

Example Blocklist

Copy this into your Email/Domain Blocklist field to block common disposable email services:

@10minutemail.com,@guerrillamail.com,@mailinator.com,@tempmail.com,@throwaway.email,@temp-mail.org,@fakeinbox.com
Pro Tip

Start with a small blocklist and expand it based on actual spam patterns you observe. Blocking too many legitimate services may frustrate real users.

Customizing Error Messages

When a blocked email is used, the user sees an error message. You can customize this:

Setting Custom Error Message

  1. Go to Settings → Safe Registration
  2. Scroll to the Error Messages section
  3. Edit the Email/Domain blocklist error message field
  4. Default: “Your email not allowed from registration! Try using another email address.”
  5. Click Save Changes

Example Custom Messages

  • “This email address is not allowed. Please use a different email.”
  • “Registrations from this email domain are not permitted.”
  • “Please use your personal or work email address to register.”
  • “Temporary email addresses are not accepted. Please use a permanent email.”
Best Practice

Keep error messages professional and helpful. Explain why the email is blocked and suggest an alternative action.

Testing Your Blocklist

To verify email blocking is working correctly:

Test Process

  1. Add a test email or domain to your blocklist (e.g., @test.com)
  2. Save the settings
  3. Log out of WordPress
  4. Visit your registration page
  5. Attempt to register with a blocked email (e.g., user@test.com)
  6. Verify you see the custom error message
  7. Try registering with a non-blocked email to confirm normal registrations work
Expected Behavior

Blocked emails should show your custom error message and prevent account creation. Non-blocked emails should allow normal registration.

Best Practices

Strategic Blocking

  • Monitor first, block later – Observe spam patterns before adding domains
  • Use domain blocking wisely – Blocking entire domains is powerful but can block legitimate users
  • Regular review – Periodically review your blocklist and remove outdated entries
  • Document your blocks – Keep notes on why specific domains were blocked

User Experience

  • Clear messaging – Explain why an email is blocked
  • Suggest alternatives – Tell users what type of email to use instead
  • Test thoroughly – Ensure legitimate emails aren’t accidentally blocked

Security Considerations

  • Combine with reCAPTCHA – Email blocking alone won’t stop all bots
  • Update regularly – New disposable email services appear frequently
  • Don’t rely solely on blocking – Use as part of a comprehensive security strategy

Limitations and Considerations

What Email Blocking Can’t Do

  • Can’t block new disposable services – Spammers constantly create new domains
  • Can’t prevent VPN/proxy use – Blocking is email-based, not IP-based
  • May block legitimate users – Some users genuinely use disposable emails for privacy

Complementary Features

For comprehensive protection, combine email blocking with:

  • CSRF Protection – Prevents cross-site attacks
  • Google reCAPTCHA – Stops automated bot registrations
  • Email Verification – Ensures email addresses are valid and accessible

Managing Your Blocklist

Adding New Entries

  1. Identify spam sources from your user registration logs
  2. Add the email or domain to the blocklist field
  3. Use commas to separate from existing entries
  4. Save changes

Removing Entries

  1. Open the Settings → Safe Registration page
  2. Edit the Email/Domain Blocklist field
  3. Remove the email or domain (and its trailing comma)
  4. Save changes

Clearing the Entire Blocklist

  1. Delete all content from the Email/Domain Blocklist field
  2. Save changes
  3. All email addresses will be allowed (subject to other security checks)

Troubleshooting

Legitimate emails being blocked

  • Check if the domain is in your blocklist
  • Verify the syntax (ensure proper use of @ for domains)
  • Remove overly broad blocking rules

Blocked emails still getting through

  • Ensure you saved the settings after adding entries
  • Check that both WordPress and WooCommerce protection are enabled
  • Verify the syntax matches the examples above
  • Clear any caching that might serve old forms

Error message not displaying

  • Verify you’ve set a custom error message in settings
  • Check theme compatibility with WordPress error display
  • Test with a default WordPress theme to isolate the issue