For public-facing apps that need users to sign themselves up, enable self-registration in Site Settings. The self-registration form sits on your login page (or a dedicated sign-up page) and gives anonymous visitors a path to create their own account.
Registration mode
Three options under Site Settings → User Account & Login → User Registration Mode:
Disable all account creations
The strictest mode. Even admins can't create accounts through the standard form. Useful for installs where accounts come exclusively from an external identity provider (SSO) or an API-driven provisioning system.
Only admins can create accounts
Admins create accounts via the New User flow; no public sign-up. Suitable for internal apps where you control who has access.
Anyone can register an account
Self-serve sign-up. The login page shows a "Don't have an account? Sign up" link. Anyone (including anonymous visitors) can register themselves.
Default security groups
When a user self-registers, they're automatically added to the security groups configured under Site Settings → User Account & Login → Default Security Groups. Set these so new sign-ups have appropriate (but limited) access from the moment they register.
Typical configurations:
- Consumer app: All Users + Free Tier.
- B2B free trial: All Users + Trial Customer + Restricted Accounts (limited until they upgrade).
- Public knowledge base: All Users (read-only access to articles).
Welcome email
The Send New User Registration E-mail (Self-registration) setting controls whether self-registered users get a welcome email, and which template is used.
Standard welcome emails include:
- A greeting and confirmation of the account creation.
- The user's email (so they know what they signed up with).
- A link back to the login page.
- Optional: their initial setup steps, branded onboarding content, links to help.
Validation on registration
The registration form validates:
- Email is unique (no duplicate accounts).
- Email is in valid format.
- Password meets length/complexity requirements (if configured).
- Any required custom user fields are filled in.
- The user has accepted any terms or privacy notice (if you've added a Tickbox field for it).
Anti-spam measures
Public registration is a spam target. Three layers of defence to consider:
1. reCAPTCHA on the registration form
v2 Checkbox, v2 Invisible, or v3 — block automated registration attempts. Requires reCAPTCHA keys configured in Site Settings.
2. Email verification
The platform can send a verification email and require the user to click a link before their account is fully activated. Spam accounts that use fake emails never receive the link and stay un-verified.
3. Manual approval queue
For very sensitive apps, configure the registration to require admin approval before the account becomes active. New registrations go into a Pending Approval queue; admins review and accept or reject.
