So, you want to add members to your WordPress site but don’t want to bother with installing another plugin.
Fortunately, WordPress has a user registration mechanism built in just for this.
This guide covers how you can create custom user registration forms without a plugin, using this default WordPress feature.
Note: This guide covers WordPress’s built-in registration feature. If you want more field options or a form built for a specific use case, see our guide to creating a registration form with User Registration & Membership instead.
How the Default WordPress User Registration System Works
WordPress started as blogging software, where the only accounts anyone needed were the admin’s and maybe a few writers, all added manually.
As sites grew into communities and membership platforms, and multi-author projects, letting visitors create their own accounts stopped being optional.
WordPress has addressed this with a self-service sign-up system built in the core CMS.
The idea is simple: instead of an admin creating each account, a visitor fills out a form and becomes a registered user on their own.
The registration form lives at wp-login.php?action=register. In WordPress core, the registration form submission is actually handled by register_new_user(), which does the validation and sanitization, and that function calls wp_insert_user() internally.
However, the login form in WordPress doesn’t display the option for new users to register by default.
This needs to be enabled manually. Here’s how to turn it on.
Step 1: Enable the Membership (Self-Registration) Feature in WordPress
Head to your WordPress dashboard and go to Settings → General.
Scroll down until you see the Membership option, which is turned off by default. Click on the checkbox next to Anyone can register to enable it.
Right below it, you’ll see New User Default Role. Set this to whichever role new sign-ups should land in, Subscriber works for most sites.
Not sure which role fits your new sign-ups? See our breakdown of what each WordPress user role can do.
Scroll to the bottom and click Save Changes.
That’s it, registration is live. Your login page now shows a Register link for anyone who visits.
The login form will now display a Register link, alongside the Lost your password?
This link takes you to WordPress’s built-in registration form, at www.websiteurl.com/wp-login.php?action=register.
Two emails go out automatically once someone registers. You, as the admin, get notified every time someone new registers.
The new user gets a separate email with their auto-generated password, so they can log in right away.
Step 2: Add the Registration Link to Your Website Menu
Right now, the only way anyone finds your site’s registration page is by guessing the URL. We need to put it in the navigation menu instead.
Note: If your theme uses the Site Editor (Appearance → Editor), follow the steps below. If you’re on a classic theme, go to Appearance → Menus instead, and add the registration URL there as a Custom Link.
Go to Appearance → Editor → Navigation from your WordPress dashboard. This will show you the current navigation menu.
You can open the Edit Page List screen by selecting the navigation menu.
In the page editor screen, click on the header navigation and select Edit Navigation.
Click on the + icon and add the URL of the registration endpoint www.websiteurl.com/wp-login.php?action=register and hit Enter.
You can then rename the menu item. In the Link Text field, type whatever label fits your site, “Register,” “Sign Up,” “Create Account.”
Click Add to Menu, then drag it into place alongside your other menu items.
Click Save Menu.
Your Register link is now live in your site navigation, visible to anyone browsing your site.
Registration and login share the same wp-login.php base URL. If you’d rather not expose that default path at all, see our guide to changing your default WordPress login page URL.
Step 3: Monitor New Registration
Once your registration link is live, keep an eye on who’s signing up.
Go to Users → All Users in your dashboard. Every new registration shows up here, along with the role you set as default.
The default form has no spam protection, so expect some bot accounts alongside real ones, a username that’s a random string of characters, or an email from an obviously disposable domain, is usually one.
Select it and click Delete to remove it.
Checking in every so often, especially right after you add the link to your menu, keeps your user list from filling up with accounts that were never real people.
Beyond deleting spam accounts, WordPress gives you more control over your user list than the Users screen shows at a glance. Our guide to managing users in WordPress covers editing roles, resetting passwords, and adding users manually.
Limitations of the Default WordPress Registration Form
The built-in registration form covers the basics. Here’s where it stops.
Fixed Fields
WordPress collects a username and email, nothing else. Adding anything more, a phone number, a company name, means writing PHP that hooks into the registration process itself, touching your site’s user database directly. Get the validation wrong, and that’s a security risk, not just a missing field.
No Styling Control
The form uses WordPress’s default login-page look. Matching your theme means writing CSS and loading it specifically on that page, since the Customizer’s Additional CSS doesn’t reach it.
No AJAX
Submitting the form reloads the whole page. Inline submission needs custom JavaScript on top of everything else.
No Spam Protection
No reCAPTCHA, no honeypot, no rate limiting. A public registration link collects bot accounts as reliably as real ones.
Fixed Notification Emails
The admin alert and the new user’s password email go out automatically, and neither one’s wording, subject, or timing can be changed from settings.
One Form for the Whole Site
Every visitor registers through the same form, with the same fields. No separate form for, say, students versus instructors.
Custom code closes some of these gaps, but you’re maintaining that code and owning the security risk yourself.
A plugin like User Registration & Membership covers all of this out of the box, including unlimited registration forms — no separate option to enable, no per-form limit.
Wrapping Up
You’ve turned on WordPress’s built-in registration, added the link to your menu, and seen where the default form runs out.
For sites that need more, extra fields, spam protection, multiple forms, User Registration & Membership handles all of it without custom code. It’s free to start, with paid tiers for advanced features.
Get Started with User Registration & Membership →
Frequently Asked Questions
Is the built-in WordPress user registration form free?
Yes. It’s part of WordPress core, so you don’t need to buy or install any other plugin.
Does this work with any WordPress theme?
Yes. The registration form runs on WordPress core, not your theme, so it works the same way regardless of which theme you’re using.
Is the default WordPress registration form secure?
It’s safe to run, but it isn’t protected by default. There’s no reCAPTCHA, no rate limiting, and no email confirmation step, so accounts go live the moment someone submits the form. Once your registration link is public, expect some bot sign-ups alongside real ones, which is why checking Users → All Users regularly matters.
Should I use a plugin instead?
If you only need a basic sign-up form, the built-in feature is enough. If you need custom fields, spam protection, or more than one registration form, a plugin like User Registration & Membership gets you there without the extra setup work.