I am battling spam accounts being generated via Magento's REST API for customers. Someone keeps hitting my site with Postman and dumping in hundreds of fake accounts. I have set Allow Anonymous Guest Access to No. How can I prevent this from happening?
1 Answer
In /vendor/magento/module-customer/etc/webapi.xml, change the CreateAccount method from "anonymous" to "self"
Save the file and then clear the cache.