In reply to H Dwight Hunsberger.

Henry's advice below is prudent. You could pay your hosting company to give you more protection that they should be giving you anyway, but in this case it sounds more like a configuration issue. If the means of registration is not inhibited in anyway, you can and will be visited by bots.

Heck, the host I am on only has about four hundred customers total, and using a free plugin to monitor that kind of activity, I get twenty attempts a day to log in as me. Forget signups, that could really be bad. But that's not hacking. That's a jerk playing pretend in a very real way.

There's nothing you can use that's free and self-hosted that will protect you from these things out of the box, but there's also nothing you have to do that costs money that cannot at least help if not outright mostly fix the situation.

I was on a site last year that was holding a design contest, but it was only for the United States. The people were upset because they had 8000 form submissions, but only 2000 contestants. Turned out a lot of automated submissions were going through their very short signup form that had no reCAPTCHA or even a hidden field to trick bots. Also, in their settings, there was no sending out of an activation link or anything. You just instantly were able to log in.

So they asked their host to block traffic from the source (eastern Europe) and since nobody outside of the country cared about the contest either, nobody complained and they got maybe two dozen fake signups a day afterwards instead of several hundred. When they added reCAPTCHA it stopped.

I can appreciate your concern, but all hope is not lost; just be mindful and put feelers out there for help. The worst anyone can say is no and the platform is one of the nicer ones out there for normal people to get stuff done on.