Under General settings in WordPress, untick the “anyone can register”.
Then check your website logs as that will tell you exactly how they are landing on your website.
Once the sciptbots work out that ‘a site’ is running WordPress, they’ll then automate setting up of accounts (mainly for comment and trackback spamming).
They’ll use XML-RPC (which you can switch off if nothing else uses it), and you can also use a plugin such as WP Hide Login which will change your wp-admin link to something else. (Normal users of the site will still be able to login as all internal links to wp-admin forward to your ‘secret’ login link. It just stops the scriptbots from automatically landing on wp-admin and then signing up creating new accounts.
It’s 99.99% not likely to be wp-members, unless you have your sign-up process so open that your form is allowing every Tom, Dick and Harry to sign up.
If you are seeing multiple random users sign-up via your WP Members/sign up form, you will probably need to enable Admin approval and/or a combination of Akismet/User verification service.
As to why it’s ever since installing the plugin, that may well be down to bad timing and only now have the scriptbots found a new WP site to play with.
However, the fact you say they are being assigned ‘no role’ suggest that it could be WP Members (unless you’ve played with the existing WP Role structure) when it might well be them coming in via your WP Members.
Don’t forget, even though you may not have your registration form on display, it only takes one ‘leak’ of a link to that registration page and it’s on the bad boys search list. That list then gets passed around and you’ll be targeted.
If it is down to that link suddenly being attacked, change the link to a new one and update internally. Use .htaccess to redirect those trying to access the old link.
If you run WordFence or similar, you can even block those IP’s trying to access the old link.
Your website logs are your friend… go through them and analyse exactly how, from where and what they are trying to do… Only then can you close the doors.
