I have a CiviCRM contribute page that allows people to sign up for a membership and that automatically creates a Wordpress account for them at the same time. Everything works, but when the user submits the membership, they are automatically logged into the new Wordpress account that was just created. The user log in occurs before the user validates the email address that was sent to them and which includes a link to set their password. This behaviour might be ok for some purposes but it does not follow best practices when signing up for online accounts. Before allowing a user to log on to see private content on a website, one almost always has to first verify the email address and then set a password. By logging the user in before doing this verification, any person that enters a fake email address will be able to access private content. There is absolutely no way to avoid fake/spam signups in the current configuration. If for whatever reason the new member needs immediate access to any links or information after signing up, this could be provided through the "Thank you" page and/or by a thank-you email. If they need access to more sensitive information, then the user should explicitly sign in after creating a password. Based on [this topic](https://civicrm.stackexchange.com/questions/31158/prevent-automatic-login-after-registration) at stack exchange it appears that this is related to [one line of code](https://github.com/civicrm/civicrm-core/blob/bee660d8fdf9168d4cfeb71d89474c77979c7d73/CRM/Utils/System/WordPress.php#L609-L613). I suggest that one simply deletes these lines of code.