Put a gate on registration first, then study the mess. A WordPress language school site is a nice target because WordPress powers over 43% of all websites, so bots know where the doors are [source: W3Techs]. If fake “students” keep joining at 3:12 a.m., they are not eager to learn Spanish. They are probably automated scripts.
TLDR: Install and set up Advanced Google reCAPTCHA on your WordPress registration, login, and lost password pages. Then compare signups before and after. For example, if you had 180 new accounts in one night and only 7 opened a lesson, that is a big red robot flag. After adding reCAPTCHA, a normal school site might drop from 60 fake accounts per hour to 2 or 3 odd attempts.
Why bots pick on language school sites
Language schools often let students create accounts fast. That is good for real learners. It is also great for bots. They can create users, test stolen passwords, post spam, or clog your email system.
Honestly, it feels like inviting students to class and getting a bus full of tin cans with usernames.
Step 1: Add Advanced Google reCAPTCHA
The fastest fix is to protect the weak spots. Use the Advanced Google reCAPTCHA plugin. It adds Google reCAPTCHA checks to common WordPress entry points.
Start here:
- Install the plugin from the WordPress plugin directory.
- Create Google reCAPTCHA keys in your Google reCAPTCHA admin panel.
- Paste the site key and secret key into the plugin settings.
- Enable protection for registration, login, lost password, and comments.
- Test it in a private browser window.
If your school uses WooCommerce, an LMS, or a custom student form, test those pages too. Some forms may need extra setup. Annoying? Yes. Worth it? Also yes.
You can also run a quick check with this AI security audit for WordPress. Use it to spot weak points before the bots find them again.
Step 2: Watch for the fake student smell
Fake accounts often look “almost normal.” That is the trick. But they usually fail the human test.
Check your user list for these signs:
- Huge bursts: 40 accounts in 10 minutes is not a normal class signup.
- Odd hours: many accounts at 2 a.m. from countries you do not serve.
- Random names: “John Qxrt736” is not joining French A1.
- Disposable emails: free or strange domains repeat again and again.
- No lesson activity: accounts register but never start a course.
- Repeated IPs: many “students” come from the same address or range.
- Same browser data: identical user agents can mean one bot tool.
Real students behave messily. Bots behave in patterns. That is your clue.
Step 3: Compare before and after reCAPTCHA
Do not guess. Count.
Make a simple table. Nothing fancy. Use one week before the plugin and one week after.
- New accounts per day
- Failed registrations
- Login attempts
- Accounts that start a lesson
- Accounts using the same email domain
- Accounts from the same IP range
If signups fall by 85% but paid trials stay the same, great. You did not block real students. You blocked trash.
If signups fall by 85% and real enrollments also fall, your settings may be too strict. Try another reCAPTCHA type if the plugin offers it. Test on mobile too. Many students register from phones.
Step 4: Look at the speed of signup
A human needs time. They read. They mistype. They choose a course. They hesitate.
A bot does not care. It hits the form and moves on.
Red flags include:
- Form filled in under 2 seconds
- Many accounts from one IP in one minute
- No page views before registration
- No click on pricing, courses, or placement test
For a language school, that last one matters. A real learner often checks class levels. A bot does not wonder if it should take German A2 or B1.
Step 5: Use reCAPTCHA data as a clue
Google reCAPTCHA helps separate humans from bot traffic. Google explains that reCAPTCHA v3 can score interactions from 0.0 to 1.0, where lower scores are more suspicious [source: Google].
If you use a score-based setup, watch for low-score activity on registration pages. If you use a checkbox style, watch for failed or repeated challenges. Either way, the plugin gives you a useful wall. Your logs tell you who keeps headbutting it.
Step 6: Clean the class list
Once the gate is up, clean old junk accounts.
- Export your users before deleting anything.
- Filter accounts with no course activity.
- Remove obvious fake users in small batches.
- Block repeat email domains if they are pure spam.
- Force password resets if you saw login attacks too.
Do not delete paying students by accident. Check orders, lessons, certificates, and support tickets first.
Step 7: Build a tiny bot dashboard
You do not need a giant security room with flashing lights. A simple weekly check works.
Track these numbers:
- Registrations: normal, high, or ridiculous?
- Real activation rate: how many start a lesson?
- Top IPs: do the same ones return?
- Email patterns: are fake domains repeating?
- reCAPTCHA failures: are bots still knocking?
If the numbers spike again, check the plugin settings first. Then check any new form you added. New quiz form? New trial class form? New “download a brochure” form? Bots love fresh doors.
The simple rule: real students register, browse, learn, and ask questions. Bots arrive in herds, move too fast, and leave no learning trail. Put Advanced Google reCAPTCHA on the door. Then let the data tell you who belongs in class.