Control client registration in WHMCS: email verification and spam signups

An open registration form attracts bots that create fake client accounts, sometimes to test stolen cards or send spam through your contact forms. WHMCS gives you several controls to keep signups genuine without making life hard for real customers.

Before you start

• Administrator access to General Settings.
• Working email delivery so verification messages arrive; see SMTP setup.

Require email verification

1. Go to Configuration → System Settings → General Settings → Security (or Other).
2. Enable Email Verification for new clients.
3. Save.

New clients receive an email with a link to confirm their address. Until they verify, the client area shows a reminder. You can choose whether unverified clients may place orders – blocking orders until verification stops many fraud attempts but adds a step for real buyers.

Registration only with an order

Under General Settings → Ordering (or Other), enable Allow Client Registration only if you want visitors to register without buying. Many hosts disable stand-alone registration so accounts are created only through checkout, which removes most bot signups.

CAPTCHA

Enable CAPTCHA (Google reCAPTCHA v2/v3 or hCaptcha) on Registration, Checkout, Login and Contact forms under General Settings → Security. Invisible reCAPTCHA v3 keeps forms frictionless for humans.

Block disposable and abusive addresses

• Configuration → System Settings → Banned Emails: add disposable email domains you see in fake signups.
• Banned IPs: block IP addresses or ranges used for repeated abuse.
• A hook on ClientDetailsValidation can reject entire lists of disposable providers automatically.

Required fields

Requiring phone number and full address raises the effort for bots but also for customers. Keep what you need for invoicing, tax and domain registration; see order form setup.

Clean up fake accounts

1. Go to Clients → View/Search Clients and filter by status and no active services.
2. Review suspicious accounts (random names, disposable emails, no orders).
3. Close or delete them. Deleting is fine for accounts with no invoices; keep closed status where invoices exist.

Utilities → System → System Cleanup can remove inactive clients in bulk on some versions.

Troubleshooting

• Real customers never verify: verification emails land in spam – fix SPF and DKIM for the sending domain.
• Bots still register: CAPTCHA not enabled on all forms, or registration without orders is still allowed.
• Legitimate domain banned: remove it from Banned Emails.

Next steps

• Fraud protection.
• Security checklist.
• GDPR tools.