BuddyPress.org

Hello @smithloo,
I usually grab Yoast or Rank Math, set it to index profiles with simple title/description templates, and keep the clean /members/username/ URLs. I let the plugin add basic Person schema, ask users to add a photo and bio for unique content, then confirm my XML sitemap includes /members/ and that robots.txt isn’t blocking it. Finally, I speed things up with caching and lazy-load avatars—and if I ever need privacy I just flip profiles to noindex or require login.

@mike8022 It’s certainly something something that I’ve done, because removing items from search can really hit large servers, it’s a known performance issue. So it’s better to not offer search to the bots, so that you can have a more nuanced approach to search for logged in users, and also for people visiting the site. A bot should not ne using search at all, in fact this is a primary part of a DOS attack, to het WordPress constantly searching for none existent pages. So what I’m thinking for my plugin, is to exclude bots from all searches, to give logged in users full search, and to have controls on what site visitors are able to search for. Included in this is the need to have control over the xml sitemap, and to enable hard rules for exactly what site visitors are allow to search for. Include in this a strategy of honeypots and other traps for those with prying eyes.

bbPress tags seem be a bit of a target, as a lot of the security solutions out there do not cover them. it pretty simple to turn those off for not logged in users, and also to choose to turn them off just for bots I reckon, but it shows a comprehensive approach is needed I reckon, and this DOS attack I’m looking at currently is helping my ideas gel into that comprehensive approach. As I see it, ideally, next time I get an attack, I’ll have a single page allowing me to lock down the entire site if I need to.

Hello,

Thank you for your thread which helped me to find a solution.
I was lokking to noindex profiles pages in buddypress.
At least it works on my side. Hope that will help you guys.

// Set a high priority to remove Yoast meta robots tags before they are added
function remove_yoast_meta_robots() {
    if (function_exists('buddypress') && bp_is_user()) {
        // Remove Yoast's meta robots tag
        add_filter('wpseo_robots', function($robots) {
            return 'noindex, follow';
        });
    }
}
add_action('wp', 'remove_yoast_meta_robots', 1);

Alternatively, you might consider using a “whitelist” only plugin, in my experience very effective in keeping out most bots plus temporary email addresses.

@ingenxcomputers I am seriously stressing because my site is constantly being violated by Russian bots after this latest update and you are splurting out nonsensical questions … Seriously?

The plugin I mentioned is very well documented. I suggest that in the future you do a bit of homework first before jumping in without offering any advice or solutions

Removing the activation URL/key combo from the activation email and requiring users to manually copy and paste the key could indeed help slow down spam registrations to some extent. This approach introduces an additional step that may be more challenging for automated bots to complete, as they would need to extract the key from the email and input it accurately into the form. While it might inconvenience legitimate users slightly, it could potentially deter some automated spam bots.

However, it’s important to note that determined spammers might still find ways to automate this process, such as using OCR (Optical Character Recognition) to extract the key from the email. Balancing security with user experience is crucial. Here are a few considerations:

User Experience: Requiring users to manually copy and paste the activation key can be frustrating, especially for users who are less technically inclined. It might lead to a higher abandonment rate during the registration process.

Accessibility: This method might pose difficulties for users with visual impairments or those using screen readers.

Alternate Solutions: There are other methods to combat spam, such as CAPTCHAs, email verification, and behavior analysis. You might consider combining multiple techniques for a more effective anti-spam solution.

Testing: Before implementing such a change, it’s recommended to conduct testing to see if it indeed reduces spam registrations without significantly impacting legitimate users.

As for your request to add “TWITCHAUDIENCESPOTLIGHT,” I’m not quite clear on where you would like to add this text. Could you please provide more context or specify where exactly you want to insert this text?

Hi, site is 3 years old, 13,000 members, approx. 1100 active daily, but not a single instance of multiple-user spam-messaging, forum spamming, blog comment spamming, etc.

The site is a (very mild) NSFW dating site, niche interest, so is a prime target for bots, but so far no big issues.

If you want to compare ideas/methods then please provide some form of contact, happy to provide info in private.

Hi Scott,

thanks for raising this issue, bots registrations are a constant issue on my site, but pretty successfully controlled with a combination of:

– limit permitted registration email domains to the most common, Gmail, Yahoo, aol, etc. No weird stuff allowed.
– BP Registration Options plugin, but requires a lot of manual moderation.

Your point: I must say that not a single bot registration attempt on my site was ever able to activate the account by successfully responding to the activation email. They simply generate non-existent email addresses so never become active.

Your experience is different?

Make sure the captcha is verified on both browser and server levels. If this captcha is working only at browser level, then yes a simple CURL request can bypass it and register bots in your site.
There are other ways as well, but the Google captcha should do the trick. We have not had any issues with signups at all.

Hola, con el plugin wp cerber. Detecta Ip de los bots y si lo configuras bien los bloquea

Hey @maximejobin! 👋

Sorry for the delay here. The codex no longer auto-roles people as Editors, because spam bots ruined that idea. I’ve added you manually though, so you’ve got the power!

@danielafer use private community plugin or BP lock , it will help to keep your community private for logged in users.
If you do not want the private community approaches you can also use no-index.

function no_index_for_buddypress() {
    if ( is_buddyPress() ) {
        echo '<meta name="robots" content="noindex, nofollow">';
    } else {
    }
}
add_action( 'wp_head', 'no_index_for_buddypress' );

Thanks, I haven’t found an easier solution. This is a very annoying missing function in Buddypress. To delete all messages by a user should be available due to increasing spam bots these days.

I am also using plugins like reCaptcha, WPBruiser, and Aksimet, which stops spammers, but we still get one every now and then.

Hi,

I have this in the theme functions.php :

function noindex_buddypress() {
    if ( is_buddyPress() ) {
        echo '<meta name="robots" content="noindex, nofollow">';
    } else {
    }
}
add_action( 'wp_head', 'noindex_buddypress' );