BuddyPress.org

Two more methods that help. I recently had a crazy spam attack – probably 300 fake signups per day. I implemented these two methods and it dropped to near 0.

1. Change the /register/ slug to something unique. An example would be /create-your-account/, or something of that nature. It just needs to be unique and also make sense in a URL for your user. Spammers targeting BuddyPress look for /register/ as the signup page. It’s all automated so you want to filter them out at the first step.

2. Add this to your functions.php file in your theme or child theme.

It presents a dummy field that humans don’t see. Spambots will fill it out, and if the field captures a value it will reject the signup.

// BuddyPress Honeypot
function add_honeypot() {
    echo '';
}
add_action('bp_after_signup_profile_fields','add_honeypot');
function check_honeypot() {
    if (!empty($_POST['system55'])) {
        global $bp;
        wp_redirect(home_url());
        exit;
    }
}
add_filter('bp_core_validate_user_signup','check_honeypot');

Credits for #2 go to:
http://mattts.net/development-stuff/web-development-stuff/wordpress/buddypress/anti-spam-techniques/registration-honeypot/

I edited it slightly to remove the required redirect. Add that back from his tutorial if you want to. It requires that you make an extra page to send the spammer to, and I personally think that’s not necessary. I actually want them to have no indication their signup failed.

@blinkybill01 recommend that you create a throw-away user account and post it here instead. After issue is resolved, just delete the account.

buddypress.php placed in the root of a newly created directory ‘buddypress/’ or ‘community/’ will act as the main template file for all BP screens whether directory or account screens, group screens, it’s the wrapper as it were that provides the main header, sidebar,footer includes and main markup your chosen theme needs, essentially it is a replica of page.php from your main theme, having buddypress.php means you can make changes to that file that will only affect BP screens e.g get_sidebar(‘buddypress’).

when your happy with the basics then read the extended guide which explains further means of creating custom bp templates.

They don’t exist until you create them.

🙂 I’ll go and fish out all the codex guides that have been written on the subject of templating/themeing

Also remember you can use conditional logic to wrap the sidebar in your bp template so if you wanted the sidebar just for user account screens you could do:

`
if( bp_is_user() ) :

endif;
`

The two guides to read are:

Theme Compatibility & Template Files

Template Hierarchy

> I’m conflicted on how much we can realistically support themes that deviate so far from the norm.

I see no real conflict to be resolved, it’s impossible for BP to take into account unknown divergences from the core template api WP provides, if theme authors want to create something non-standard then sadly that’s their problem and unfair to expect BP to have to try and deal with this. The best BP can do and is doing pretty well is to tie in as much as possible to the set WP template approach and if all themes did the same – and frankly they probably could regardless of proprietary approach to frameworking – then this would be a non issue.

>that now uncover pretty fatal flaws in several themes

Flaws that existed and have existed in many themes that do their own thing.

Where that leaves things is sadly fairly and squarely in the theme authors court to try and help provide a solution for template issues.

On a sidenote on another thread I noted a response relayed from a theme author to the user on enquiry of how to resolve their theme issue that the theme author couldn’t possibly support every third party plugin issue that happened along! It’s worth perhaps pointing out to any theme authors that might happen past this thread that there are plugins and there are plugins that really are best described as modules that extend WP they transcend the notion of a simple plugin and leverage the WP API to it’s fullest, these plugins, and I’m thinking of BuddyPress and bbPress here are in wide spread use, and really the smart theme author might be advised to actually test their themes with both these ‘plugins’ to gauge the level of support the theme offers and where possible improve it!

Obviously the above isn’t a great deal of help to those of you having these issues, but this forum is going to struggle to help on these sorts of issues being it’s primary purpose has to be directly related to BP issues and third party themes especially premium ones are something we can’t deal with due to lack of knowledge on how they are constructed.

You’re not attempting to hide anything, if you have created xprofile field groups other than the default ‘Base’ then anything in those groups for user profile input will not show on the standard BP registration form only on the users account profile screen. If you are following that principle and those fields are showing on the main registration form then something is going wrong and likely you have third party plugins at work?

Here’s what I need:

Client wants to enter member info themselves, then later on have users create WP account. Is this possible, to create profile first, without wp account, and then save?

So at that point, how does already-existing buddypress profile get associated with wp user?

If this isn’t possible, can a temporary username / password be generated?

It seems that those spamming my site are using wordpress’ default way of creating an account and not registering through buddypress. When I go to the users admin, all of the users that used buddypress were given the default forum role of “participant”. The spammers don’t have this role.

Because of my current setup, I installed the Members plugin and created a new role. Then I made the buddypress form show up only for those that I have confirmed. I would recommend that this be added to future buddypress installs as an option.

create a new user in admin and change that account to admin. then logout. login with new admin account and mark your other account not a spammer in wanguard

The easiest way I’ve found to hide the “last active 3 hours ago” info box is to comment out those bits in the templates in your theme. For instance, in members > members-loop.php, about line 57, you’ll see
<div class="item-meta"><span class="activity"><?php bp_member_last_active(); ?></span></div>

Comment that whole line out, and the last active message is hidden.

Re the first question, Members shouldn’t appear in the list until they’ve activated their accounts, I believe. So you may have a bunch of unactivated members pending. The Pending Activations plugin should show you a list of those. I can find a few members that don’t appear in the members directory because they have created no activity at all, so maybe you’re seeing that problem as well.

@dennish The installation of bbPress that is packaged with BuddyPress contains a file at buddypress/bp-forums/bb-config.php. When you attempt to access the bbPress installation directly as you describe, the bbPress bootstrap loads this bb-config.php file, and sends a 403 Forbidden header to the browser. Thus, it should NOT be the case that users are able to create accounts (or do anything else) on these pages. If you are finding otherwise, it could be because your buddypress/bp-forums/bb-config.php file is missing or corrupt.

In the future, when you find what you believe are security issues in BP, please do not post them to the forums, but instead send an email to security@wordpress.org. Thanks.

@bphelp I’ve seen websites that grant login access even before the account has been activated. Twitter is an example.

Thinking about the profile URL being created – Although BP doesn’t give login access, the fact that a profile URL is created opens up opportunities. For example, on registration submit you could add an action that redirects the user to their profile URL. They’ll be logged out of course, but nothing to stop you displaying a template notice like “Your page awaits you. Just activate you account then you can log in”

Thank you for the response. It didn’t fix my problem, though. Registration still not working, unless the user registers with Facebook.

http://finisjhung.com/Streaming/create-an-account

HELP!?

Hi @justin_k

thank you very much for your reply and first at all, thank you for your great job with your plugin WP-FB-AutoConnect.

The issue that I had was 8 months ago, so I apologize if I don’t remember all the details about it. But I remember that the issue was getting the connecting’s user’s email address in some cases.

The point was that I tested the plugin with different FB users with differents privacy settings and the problem was with those users that had their emails’ visibility for “Only me”

Everytime that I logged in with the same “Only me FB user”, WP created a new account, so I had duplicated users in those cases.

I would be very happy if you tell me that I was doing something badly and that your plugin has not that issue.

Thanks again 🙂

Rocío

I’m having a problem that I’m hoping the above situation will fix, but I need more information on how to utilize what’s above.

Problem: WordPress toolbar is NOT showing up in MSIE, Firefox or Safari browsers. It IS showing in the Google Chrome browser. I’ve tried logging in with different accounts to see if it’s related to the login, but it’s the same – admin or member account – no toolbar. ALSO it’s the same with my other WordPress site – both are on two different servers. However, if I go to a WordPress.com site (versus a WordPress installation on a server/private site), the WordPress toolbar IS available.

Since the WordPress toolbar is not available, I was hoping I could create menu tabs/options to get members easily to their BuddyPress inbox. The above information about building links from the sample structure is Greek to me. Where do I put that code? I’m using the Mantra Theme, so would I put it in the Custom CSS area? In the Appearance > Menu > Enter URL option? I’m thoroughly confused and I’m such a newb. Sorry!

Here’s the website I’m building: http://ilovevampirenovels.com/ravenousbooktours

Thank you!
Arial Burnz
Tour Host Coordinator

I have the same question, about to install wordpress and buddypress, but saw this and also only want one login and user account for people to sign up with. I’m right in that it sounds like new users would have to create one account for each right now or not? TY 🙂

@budskab
They are not visible until the user fills them out. In the My Account Menu at the top right hover over it and select Profile/Edit. When you are on the next screen below the profile tabs you will see “Base” and whatever other field group you created. By default you will be on “Base” these fields are the ones that correspond with your registration form. The other Field Group button you made will display the other fields you created within that field group. This is assuming your theme is functioning correctly. If you are still having issues you may want to try some basic troubleshooting by activating a known theme that works well with BP like Twenty Twelve or bp-default as well as disabling any plugins other than BP. Good luck!