Allow list
Only these domains may register.
Saved list
- helio-works.com
- helio-partners.eu
- j.abara@helio-works.com listed
- ops@mail.helio-works.com subdomain
- j.abara@gmail.com not listed
WordPress · WooCommerce · BuddyPress · five more
A throwaway address should never reach your user table.
Decide which email domains may register. Everything else is refused at the form.
Restrict Email Domain holds one rule set for the whole site: an allow list, or a block list. Every registration path on the site is checked against it, from the WordPress form to WooCommerce checkout to BuddyPress signup, and the visitor is told the address is not accepted while they are still typing it.
Version 2.2.0 · Eight registration paths · Annual or lifetime
How it works
One rule set. You either name who gets in, or name who does not.
The plugin keeps a single allow list and a single block list for the whole site. Fill the allow list and only those domains register. Leave it empty and the block list does the work instead. Fill both and the allow list wins, which the plugin tells you plainly in its own configuration check rather than letting you guess.
Block list
These domains are refused, everything else registers.
Saved list
- *.tempmail.io
- .tk
- guerrillamail.com
- nina@ashgrove.org not blocked
- x7@inbox.tempmail.io wildcard
- signup@free-reg.tk extension
What you can write in a list
- Exact domain
-
helio-works.comThat domain, and by default its subdomains too. - Wildcard
-
*.tempmail.ioAnything under a host you do not trust. - Extension
-
.tkA whole top level domain, or an academic suffix like .ac.uk. - Single address
-
audit@gmail.comThe email whitelist, which overrides every domain rule above.
Subdomains are included on purpose: listing helio-works.com also
admits mail.helio-works.com. One checkbox turns that off when you
want exact matches only, and a second makes matching case sensitive if you have a
reason to want it.
Coverage
Eight ways onto your site. The same rule guards all of them.
Most domain filters only see the WordPress form, which is rarely the door people actually use. This one hooks the validation step of every registration path below, so a rule you set once applies at checkout and at community signup without a second plugin or a second list to keep in sync.
-
WordPress
The standard registration form, plus multisite signup.
registration_errors -
WooCommerce
My Account registration and the account created at checkout.
woocommerce_registration_errors -
BuddyPress
Community signup, including the Nouveau AJAX form.
bp_signup_validate -
Ultimate Member
Registration forms and the AJAX submit behind them.
um_registration_validation -
MemberPress
Signup and the membership checkout form.
mepr_validate_signup -
Paid Memberships Pro
Level checkout and the account page.
pmpro_registration_checks -
Restrict Content Pro
Registration and profile updates.
rcp_form_errors -
WP-Members
Registration fields and user updates.
wpmem_register_validate_fields
Each integration switches itself off when its plugin is not installed, so nothing runs that does not need to. A table in the plugin's Tools tab shows which of the eight it has detected and at what version, which is the quickest way to confirm a form is really covered.
After it is live
You can see what it stopped, and test a rule before you trust it.
Every refused attempt is written to its own table with the address, the domain, which form it came from, the IP and the time. Filter by date range, by source or by domain, page through it fifty rows at a time, and export the result as CSV. Old entries are deleted on a daily schedule after however many days you choose, thirty by default, so the table does not grow forever. Turn on notifications and each block also lands in your inbox.
- Email tester
- Type an address and the plugin tells you whether it would be allowed or refused, using the rules you have saved right now. No fake signup needed.
- Configuration check
- One button that flags the mistakes people actually make: no rules saved at all, logging switched off, a missing log table, an expired licence.
- Disposable list, one click
- A bundled list of 4,931 throwaway mail hosts goes into your block list, replacing what is there or adding to it. Nothing is fetched from a remote service.
- Bulk import and export
- Load either list from a CSV or text file, export it back out, and export the whole configuration as JSON before you change something.
Pricing
Same filtering on every plan. Pick your site count.
Personal, Professional and Agency ship the identical feature set: the allow list and block list, wildcard and extension patterns, the email whitelist, real time validation, all eight registration paths, the activity log with export, and the one click disposable import. The licence only decides how many sites you can activate it on. Every tier is available annually or as a one time lifetime licence. Read the refund policy.
Personal
1 site
$49/year
or $149 once · lifetime
- Use on one site
- The complete filtering feature set
- Email support
- Updates for a year, or forever on lifetime
Most popular
Professional
Multiple sites
$99/year
or $299 once · lifetime
- Use on multiple sites
- The complete filtering feature set
- Email support
- Updates for a year, or forever on lifetime
Agency
Unlimited sites
$129/year
or $349 once · lifetime
- Use on every site you run
- The complete filtering feature set
- Email support
- Updates for a year, or forever on lifetime
Runs on WordPress 5.0 or newer with PHP 7.4 or newer. The integrations activate themselves only when their plugin is present, so nothing else is required.
Before you buy
Questions site owners ask before locking down registration.
- 01
Which registration forms does it cover?
Eight paths. The WordPress registration form and multisite signup, WooCommerce account and checkout registration, BuddyPress signup including the Nouveau AJAX form, Ultimate Member, MemberPress, Paid Memberships Pro, Restrict Content Pro and WP-Members. Each one switches itself on only when that plugin is installed.
- 02
Do I use the allow list or the block list?
Whichever fits. Fill the allow list and only those domains may register. Leave it empty and the block list refuses the domains you name while everything else passes. If you fill both, the allow list wins and the block list is ignored, and the plugin says so in its configuration check rather than leaving you to work it out.
- 03
Can I allow a company domain and its subdomains?
Yes, and subdomains are included by default. Listing company.com also admits mail.company.com and support.company.com. If you want exact matches only, one checkbox in Advanced turns the subdomain behaviour off. A separate domain, such as a subsidiary on its own name, is added to the same list.
- 04
How do I block disposable and throwaway addresses?
The plugin ships a list of 4,931 known throwaway mail hosts and imports it into your block list with one button, either replacing what is there or adding to it. The file is bundled with the plugin, so nothing is fetched from a remote service. You can keep adding your own patterns as new hosts appear.
- 05
Can I limit registration to educational institutions?
Yes. Any entry beginning with a dot is matched as a suffix, so .edu covers every .edu address, and .ac.uk or .edu.au work the same way. You can also list specific school domains instead, or mix both in the one list.
- 06
Can I let one person in when their whole domain is blocked?
Yes. There is a separate email whitelist for individual addresses, and it is checked first. An address on that list registers even if its domain is on the block list or missing from the allow list.
- 07
Can I set different rules for different forms or user roles?
No. There is one allow list and one block list, and they apply to every registration path on the site. What you control is which forms are covered, not a different rule per form or per role.
- 08
What does the visitor actually see?
Your own message, which you write in the plugin. It appears under the email field about half a second after they stop typing, and again if they submit anyway. When five or fewer domains are on the allow list, the message can also name them, so someone using the wrong address knows what to use instead.
- 09
Will real time validation slow my registration page down?
It adds one small request roughly half a second after typing stops, not on every keystroke. On the server an exact domain match is a single lookup, with wildcard and extension patterns checked separately, and the log table is indexed on the columns the admin filters by. If you would rather not have it at all, one checkbox disables real time validation and the rules still apply when the form is submitted.
- 10
Where do blocked attempts go?
Into a table of their own, with the address, the domain, which form it came from, the IP and the time. You can filter by date range, source or domain, page through fifty rows at a time, and export the result as CSV. Entries older than your retention setting are deleted on a daily schedule, thirty days by default. Optionally each block also emails you.
- 11
Does any of this data leave my site?
No. Logs stay in your own database, and the disposable domain list is a file inside the plugin rather than a remote feed. The only outbound call the plugin makes is the licence check for updates.
- 12
Is there a free version, and what separates the tiers?
There is no free edition, and every purchase carries a 30-day money-back guarantee. All three tiers ship the identical feature set. Personal covers one site, Professional covers multiple sites, and Agency is unlimited.
Set the rule once. Every form on the site starts enforcing it.
Install it, name the domains you will accept or the ones you will not, and the next registration attempt is checked before an account exists. The log tells you what it turned away, and the email tester tells you whether your rule does what you meant.
30-day money-back guarantee · Annual or lifetime · Personal, Professional, Agency