---
title: "Guardrails & Account Creation – Overview"
description: Guardrails let Social Login, Magic Link and Email OTP authenticate existing WordPress users while giving you control over whether an unknown visitor may create a new account from a login form. Free Core Guardrails are included in VentraConnect Free. Pro…
url: "https://wpventra.com/docs/guardrails-account-creation-overview/"
updated: "2026-10-26"
category: "Account Creation & Guardrails"
---

# Guardrails & Account Creation – Overview

Guardrails let Social Login, Magic Link and Email OTP authenticate existing WordPress users while giving you control over whether an unknown visitor may create a new account from a login form.

Free Core Guardrails are included in VentraConnect Free. Pro adds login-form settings for WooCommerce and membership/LMS integrations.

**The short version:** there is no single master switch. Each surface has its own rule, and a few surfaces are not covered by any Guardrail setting.

   1

## What Guardrails Do

Without account-creation controls, a login form can accidentally become a public registration surface: an unknown email arrives through Social Login, Magic Link or Email OTP and a new WordPress user is created.

Guardrails separate **signing in an existing user** from **creating a new user**, so you can keep modern login methods available to people who already have accounts while directing new users through the registration, checkout, membership or onboarding flow you intend.

   Existing user If VentraConnect can securely identify and match an existing WordPress account through the selected authentication method, the user can sign in without creating a new account.   Unknown visitor If no matching WordPress account exists, account creation depends on the method’s **Registration mode** (Magic Link and Email OTP), the **Allow new accounts from default login forms** setting on the WordPress login form, and, with Pro, the WooCommerce and integration account-creation rules.

**Important:** The WordPress setting **Anyone can register** (Settings → General) is **not** checked for Social Login, Magic Link or Email OTP. Turning it off does not stop these methods from creating accounts. It only controls the WordPress registration screen itself and Passkey registration.

    2

## How Account Creation Is Controlled

Account creation is decided per surface and per method, not by one master setting:

| Control | What it does |
| --- | --- |
| **Allow new accounts from default login forms** VentraConnect → Settings (General Settings card). On by default. | Applies to the WordPress login form (`wp-login.php`). When off, Social Login, Magic Link and Email OTP on that form only sign in existing users. |
| **Registration mode** (Magic Link and Email OTP) | **Login only** never creates accounts. **Login & Register** lets the method create a new account unless another rule blocks it on that surface. |
| Social Login | Has no Login only / Login & Register selector. Outside the surfaces covered by a setting above, Social Login can create a new account for an unknown visitor. |
| Passkeys | Have their own Registration mode and are not affected by the settings above. See section 4. |
| **VentraConnect Pro** | Adds an “Allow new accounts from … login form” setting for WooCommerce and for each membership/LMS integration. See section 5. |

Where more than one rule applies to the same surface, both must allow account creation. For example, on `wp-login.php` a Magic Link set to Login & Register cannot create an account while **Allow new accounts from default login forms** is off.

    3

## The Default WordPress Login Form

**Allow new accounts from default login forms** (**VentraConnect → Settings**, General Settings card; default: on) applies to the WordPress login form (`wp-login.php`).

   When it is off Existing users can still sign in with enabled Social Login, Magic Link or Email OTP. A visitor with no matching account cannot create one from the WordPress login form.   What it does not cover The WordPress registration screen; the [ventraconnect_sl_social_login] shortcode unless you add `context="shortcode"` ([ventraconnect_sl_social_login context="shortcode"]); generic pages; and WooCommerce, membership and LMS forms, which have their own settings in Pro.

**Do not assume the setting stops sign-ups everywhere.** A page that uses the default [ventraconnect_sl_social_login] shortcode is not covered by this setting, and Social Login has no Login-only option.

    4

## Passkeys Have Their Own Controls

Passkeys are not controlled by the Social Login / Magic Link / Email OTP Guardrails. A new account can be created with a passkey only on the WordPress registration page (`wp-login.php?action=register`), and only when WordPress **Anyone can register** is on, **Register form** is enabled in **VentraConnect → Settings**, and the Passkey **Registration mode** is **Login & Register (default)**.

   To stop passkey sign-ups Set the Passkey **Registration mode** to **Login only (existing users)**.   How sign-up works The visitor confirms their email first (the link is valid for 30 minutes); the account is created only after the passkey is created.   Existing accounts Adding a passkey to an existing account is done from the user’s profile.

WooCommerce account settings never control passkey account creation. Passkeys require PHP 8.2 or higher and HTTPS.

    5

## What Pro Adds

VentraConnect Pro adds an **Allow new accounts from … login form** setting for WooCommerce and for each membership/LMS integration. These settings are **on by default** and apply only to that plugin’s login form. Turn one off to make that login form existing-users-only.

**Registration, signup and checkout forms are not covered by these settings.** There, Magic Link and Email OTP follow their Registration mode, WooCommerce placements follow WooCommerce’s account settings, and Social Login (which has no Login-only mode) can create an account.

See [Guardrails with WooCommerce](/docs/guardrails-with-woocommerce/) and [Guardrails with Membership & LMS Flows](/docs/guardrails-with-membership-lms-flows/) for the per-surface rules.

   6

## Recommended Setup

   1. Decide per surface Decide whether each login form on your site should ever create new users: WordPress login, WooCommerce, and each membership/LMS login form.   2. WordPress login If it should authenticate existing users only, turn off **Allow new accounts from default login forms**.   3. Pro login forms Turn off the WooCommerce and integration “Allow new accounts from … login form” settings (on by default) where those forms should be existing-users-only.   4. Magic Link and Email OTP Choose **Login only** if the method should never register a user; use **Login & Register** only where it is intentionally allowed to.   5. Social Login and shortcodes Social Login cannot be set to Login only. Where new accounts are unwanted, do not place it on registration or signup forms, and review pages that use the [ventraconnect_sl_social_login] shortcode.   6. Passkeys Set the Passkey Registration mode to Login only if passkey sign-ups are unwanted.   7. Test Test with both an **existing email** and a completely **new email** in a private browser window, on each surface.     7

## Common Questions

   Is there a master setting that wins everywhere? No. **Allow new accounts from default login forms** governs the WordPress login form (and the shortcode only with `context="shortcode"`). WooCommerce and integration login forms have their own settings in Pro, and registration forms follow the method Registration mode.   Do Guardrails block existing users? No. They control whether an unknown visitor can create a new account; existing users can still authenticate.   Do Guardrails disable WordPress registration? No. Guardrails do not change the WordPress registration screen. The WordPress setting **Anyone can register** (Settings → General) is **not** checked for Social Login, Magic Link or Email OTP. Turning it off does not stop these methods from creating accounts. It only controls the WordPress registration screen itself and Passkey registration.   Do Guardrails apply to Passkeys? No. Passkeys have their own Registration mode and are controlled as described in section 4.     8

## Guardrails Documentation

   Login Only vs Login & Register What the registration mode does for Magic Link, Email OTP and Passkeys. [Open guide](/docs/login-only-vs-login-register/)   Guardrails with WooCommerce Account-creation rules for My Account, registration and checkout. [Open guide](/docs/guardrails-with-woocommerce/)   Guardrails with Membership & LMS Flows Login-form settings for membership, community and LMS integrations. [Open guide](/docs/guardrails-with-membership-lms-flows/)   Troubleshooting Account Creation Checks for unexpected or blocked account creation. [Open guide](/docs/troubleshooting-account-creation/)