The reason to cover a registration is not that someone will steal the car by reading it. It is duller and more common than that: a plate is a key into public and semi-public records, and a plate published next to a location and a phone number is a package.
Plate cloning works precisely because a photograph is enough. Someone puts your registration on a car of the same make and colour, and the paperwork for their speeding, their fuel drive-offs and their parking follows you. Sorting it out is administratively grim in every country that has tried it.
What to cover, in order of how often it is forgotten
The rear plate in the three-quarter shot. Everyone covers the head-on front plate. The angled rear one, half in shadow at the edge of the frame, is the one that survives into the published listing.
The VIN. On a lot of cars it is readable through the windscreen, and on plenty of listing photos it is legible at full size even though it looks like a smudge in the thumbnail. It identifies the specific car more precisely than the registration does.
Dealer and inspection stickers. Small, in a corner of the glass, and they carry a dealership, a date and sometimes a reference number.
Reflections. A plate reflected in a shop window or the paint of the car next to it is still a plate. This one catches people who did everything else right.
The house behind the car. If the shot was taken on your driveway, the number on the door and the street sign at the corner are in the frame too. Covering the registration and publishing the address is not a win.
Blur, or something stronger
A light Gaussian blur looks like redaction and is not, in the strict sense: blurring is a mathematical operation, and a mild one can be partially undone. Coarse pixelation is better and still leaks the average colour of each block, which is enough to narrow a six-character plate considerably.
For a listing, moderate blur is usually fine - the photo needs to look like a photo, and nobody is running deconvolution on a used Golf. For anything going onto a public forum or staying online indefinitely, use a solid bar or a stamped label. Those replace the pixels rather than smearing them, so there is nothing left to reconstruct.
Doing twelve photos without doing it twelve times
A listing is rarely one image. Shoot the whole set first - having the plate visible while shooting is not a problem - then run the folder through one preset in a single pass. Consistency matters here for a reason that is not obvious: if eleven photos have the plate covered and one does not, the one is what counts.
The check that takes ten seconds
Export the file, then reopen the exported file rather than trusting the editor preview. Zoom to full size on the covered area and look for the shape of characters showing through. If you can read the outline, so can anyone who saves the image and does the same.
While you are there, check the metadata. A photograph taken on a phone carries GPS coordinates by default, and a listing photo with the plate covered and the coordinates intact tells a more precise story than the plate ever would.