unwanted user registration

Hi
I am using the Doctor Pro demo as the basis for a client’s site, however, I have not, at least not explicitly, enabled the user registration features.
After only a few days of using the site, one user managed to register as WordPress user, with the role of subscriber.
Obviously I deleted that user, but how can I go about completely disabling, at least for now, the ability for users to register?
Thanks in advance, Luca

a)
Get down to the membership section on the general settings page. Uncheck the checkbox that says anyone can register on your website. This will prevent any visitors, man or bot, from being able to register as users on your site.

b) consider a recaptcha to stop bots (we now use hcaptcha several places)
https://www.wpbeginner.com/plugins/how-to-add-captcha-in-wordpress-login-and-registration-form/
not tested: https://wordpress.org/plugins/login-security-recaptcha/

I don;t work here. Just WP user for over 20 years, so been around the block a few times 😉

Thank you very much for your reply. My bad, I forgot to disable, as I usually do, Membership->anyone can register. However, on this site I have an active plugin, WPS Hide Login, which as the name says disables /wp-login.php by redirecting to a 404 page and allowing access to the dashboard via a custom link. In fact, if I try to access /wp-login.php?action=register I get a 404 error. So, how do you think that this user was able to register?
Thanks again, Luca

Thanks Anamaria, however I just disabled the login.php page via the plugin, when I visit the page <site url>/wp-login.php?action=register I get a 404 error.
I just can’t figure out how that user could have registered, but ok, I’ll keep an eye on the issue and get back to you if it comes up again.
Thanks again, Luca

Also remember unless you disable or redirect the built in WordPress REST API stuff, folks can ping that to look for vulnerabilities like user ID, admin user, etc. Addihg redirect in your htaccess or a plugin is ideal. But be careful as some plugins rely on that to “do something’ – so good to look more deeply into overall security (page on the wordpress.org codex page, for instance). Recaptcha good place to start as thwarts bots.

thanks, Anamaria, but no form on that site…
by the way, at the moment we dont’t get other unwanted registrations.
thanks, Luca

Hi, thanks again for for your recommendations.
as I just wrote to Anamaria, luckily at the moment we have had no more unwanted registrations
Best regards, Luca