diff --git a/src/controllers/StudyUser.controller.go b/src/controllers/StudyUser.controller.go
index 822aab0..74f8ea4 100644
--- a/src/controllers/StudyUser.controller.go
+++ b/src/controllers/StudyUser.controller.go
@@ -17,6 +17,7 @@ func (s *StudyUserController) CreateStudyUser(e echo.Context) error {
 	if err := e.Bind(&studyUser); err != nil {
 		return common.SendHTTPBadRequest(e)
 	}
+
 	httpStatus := studyUserServiceImpl.CreateStudyUser(studyUser)
 	if !common.HTTPRequestIsSuccessful(httpStatus.Status) {
 		axonlogger.InfoLogger.Println("CreateStudyUser() failed")
diff --git a/src/services/StudyUser.service.go b/src/services/StudyUser.service.go
index 614ff9c..3621e8a 100644
--- a/src/services/StudyUser.service.go
+++ b/src/services/StudyUser.service.go
@@ -43,6 +43,16 @@ func (s *StudyUserService) GetAllStudyUsersByStudyId(studyId string) ([]models.S
 func (s *StudyUserService) CreateStudyUser(studyUser *models.StudyUser) models.HTTPStatus {
 	axonlogger.InfoLogger.Println("STUDYUSER SERVICE: CreateStudyUser()")
 
+	study, httpStatus := studyRepositoryImpl.GetStudyById(studyUser.StudyID)
+	if !common.HTTPRequestIsSuccessful(httpStatus.Status) {
+		return httpStatus
+	}
+
+	// do not allow registration for a study that was either deleted or not started
+	if !study.Started || !study.DeletedAt.Valid {
+		return models.HTTPStatus{Status: http.StatusForbidden, Message: http.StatusText(http.StatusForbidden)}
+	}
+
 	studyUser.CompletionCode = ""
 	studyUser.CurrentTaskIndex = 0
 
diff --git a/src/services/User.service.go b/src/services/User.service.go
index 14af42c..fe07747 100644
--- a/src/services/User.service.go
+++ b/src/services/User.service.go
@@ -184,7 +184,7 @@ func (u *UserService) UpdateUserPassword(email string, passwordAttempt string, n
 	}
 
 	if isCorrect := passwordIsCorrect(user.Password, passwordAttempt); !isCorrect {
-		return models.HTTPStatus{Status: http.StatusUnauthorized, Message: http.StatusText(http.StatusUnauthorized)}
+		return models.HTTPStatus{Status: http.StatusUnauthorized, Message: "password is incorrect"}
 	}
 
 	hashedPassword, err := hashAndSalt(newPassword)