User registration (max length, not to insert until verification completed)

[vairafiq]

Directorist version

v7.8.3

Environment

No response

Description

User complaint: My database is being flooded by a spammer. They will never be verified but still, 100 fake users in a day is horrible

Steps to reproduce

..

Isolating the problem

• I have reproduced this bug in localhost.
• This bug happens with a default WordPress theme active (eg. 2021, 2022 etc).

[RabbiIslamRony]

@Armanul46

[RabbiIslamRony]

Confirmed—the requested protections are not fully implemented. Registration currently has minimum username-length validation but no maximum-length rule, and the WordPress user is inserted before email verification is completed. This issue should remain open.

[RabbiIslamRony]

Implemented in #2952. The PR defers frontend WordPress user creation until the email token is verified, stores only hashed pending credentials and HMAC tokens, adds transactional one-time verification with expiry and rate limits, preserves legacy verification compatibility, and enforces the 4–60 character username boundary across both frontend registration paths.