I’m running a BuddyPress 1.2.8, WordPress Mu 3.1 site and a bot somehow manages to always create accounts, about 5 per day, even though account registration is disabled in /wp-admin/network/settings.php, and for each of my sites.
For example, the last account created had username “ramonlpa” and email “fidankaisageh@gmail.com”, and was not associated with any site (i.e. the site field is blank).
This has been happening for a long time. When I first found out, the bot had created 3000 accounts.
I’m also running bbPress with the WordPress Integration, so the hole might be in bbPress.
Easy way, On wpms 3.0.x
Disable the blog signup from SuperAdmin->Options ->Registration Settings
and select the second option (User account may be created). If you are on the wpms 3.1, you will have to go to NetworkAdmin->settings->Registration Settings and do the same.
On your users request, you can still create an account as you are the site admin.
There is an issue that we have been trying to sort out which involves the integration between BuddyPress and Wishlist with regards to the membership registration and login.
When you go to the subscribe page and fill out the details to become a member and pay by credit card – when you click submit, the system automatically creates a user account in Wishlist and although that account is yet to be approved (U) the user is automatically logged in to to Buddypress. We’re not sure whether Wishlist Settings are not working properly or whether something needs to be changed in BuddyPress. What we need is for the user not to be able to login until they are approved in Wishlist Admin by the Administrator.
Any help would be greatly appreciated.
Make sure you have turned on registration in WordPress.
if you’re on single WordPress, navigate to “Settings > General” and check “Anyone can register”:
https://codex.wordpress.org/Settings_General_SubPanel
If you’re on WP multisite, navigate to “Super Admin > Options” and under “Allow new registrations”, make sure registration is not disabled.
Then, in your sidebar, use “ to get the signup url.
Well, the admin bar propagates through all sites no matter what theme I have activated. I’m sure I can find a way to disable that, just wasn’t sure if there was a way via the GUI.
That, and all the registration links lead to the site that is installed in the main directory. This isn’t likely a BP thing but a shared DB thing I suspect?
I simply use the facebook connect. and have disabled any other form of registration or login.
and i only get 1 user unless they have multiple facebook accounts and i get the benefit of avoiding the need for any other authentication
since facebook spend millions confirming its users i get to use that development for free.
I do know however that 99.9999 % of my users will be facebook users
So when i look at yoru delema i wonder why you want to offer all those ways and in turn CREATE your own problem
I have Disable BuddyPress to WordPress profile syncing? set to no.
Somehow users don’t get added to the Worpress user directory. They can login with their Buddypress userid.
I really need to get them into the WordPress userlist to because I have to add some of them to a user group allowing them in certain restricted areas of my site.
Does anyone have a clue why the synchronizations does not work?
Thanks! Monique
If you want to disable BP’s registration and user account activation pages: In your functions.php or in a custom plugin:
`remove_action( ‘wp’, ‘bp_core_screen_signup’, 3 );`
I have BuddyPress installed and multi-site enabled. New User Registrations and New Sites for Logged In users is enabled. It has been working fine and then over the weekend I noticed a lot of spam members/user sites. I marked them as spam and installed a captcha plugin. Everything was fine again. And then today I noticed a handful of additional spam registrations when I started working on my home page. I then marked all the new users and the corresponding blogs as spam, but when I went back to the site the Sign Up button had disappeared and going to motherofautism.com/register just redirects to the homepage. I disabled and re-enabled user registrations in the admin panel, but to no avail.
I know it was working after I installed the captcha plugin this weekend because I tested it, and I have not installed or changed any settings since (just work on finishing the design work).
Any thoughts?
I think I’ve found an alternative to that plugin..
http://www.crashutah.com/blog/juanchito/2010/05/12/buddypress-disable-email-activation-my-first-buddypress-plugin/
And I just tried this.. works great!
Still, If anyone can help me with the system mail block please help 
i don’t know what’s causing it, and i don’t know the solution
but until you know, you can avoid the problem with this plugin: http://buddydev.com/plugins/bp-auto-activate-auto-login/
with this plugin verification mails are disabled
Wpmu? There’s WordPress with multisite now a days?
And no you can’t use the native register page with BuddyPress.
I have a WPMU setup and I would like to make it whereas you have to register through the native WordPress registration page, rather than the buddypress registrations page. Is there some kind of setting or plugin that i am overlooking or is there some kind of code I would have to insert somewhere?
There’s a “Sign Up” link notice in adminbar if you allow registration, beside the “Login” link see http://testbp.org/
Registration is disabled by default, so if you’re not seeing the Sign Up link, you should go to admin dashboard > Super Admin > Options – Registration Settings – Allow New Registrations – check any other than default “Registration is disabled”
Edit- for single WP install, go to dashboard > Settings > General Settings – Membership – Anyone can register and below that, you can choose Suscriber role.
Every morning I wake up, delete about 30 blogs and then delete the users. I will just learned how to check the access logs (I have my own server and just figured out how to check them lol) so I will pay attention to them and see what I can find out.
“WOW, I did the above mentioned items and I am still getting hammered with spam blogs. I have no idea what to do now, I am already making a sacrifice by taking away blog creation during signup. “
Start looking at access logs. If you have no way to check how they are getting in, then you have very little luck in stopping them.
have you DELETED the exisiting spam users? Because if you;re just deleting the blogs they create and leaving the spam users…. they just create more.
@lilyo Thanks for your help 
I really like the idea of editing the plugin to make blog registrations require a password. I will take a look at the code but I already know its out of my league as well. Perhaps I will contact him on the main WP site and see what he thinks. That seems like it would be a useful plugin on its own.
@jwack
– Yep
– Yes, it’s not the most accessible-friendly way to prevent splogging but we do require people use the code in order to register at all, instead of a captcha. And we haven’t had a single spammer since. But for the few who don’t know it, we also provide the link where they can easily find out what it is, especially if they feel too lazy to look it up (I would be, heh).
Since our targets are mostly local people or former residents, they tend to know what the zip code is. If you have a genre-specific site, perhaps a similar technique could be applied? Or maybe a developer here could help you to modify the code so it applies only to the blog registration? I’m more of a front-end user/designer so altering other dev’s code is way out of my league >_<;
@lilyo
Thanks for the response.
– I already changed the reg. slug in wp-config.php (this would do the same thing correct?
-That plugin would be awesome if it only allows blog creation with a special password, I want anyone to be able to register. You actually limit people to register on your site if they have a password?
@jwack
hi, I had similar issues… even after removing the blog signup at registration, spammers would sign up, activate their accounts, and then create a new splog. to help cut down, I tried these steps:
– changed my registration slug in bp-custom.php:
define ( ‘BP_REGISTER_SLUG’, ‘join’ );
– also added a redirect of wp-signup.php inside bp-custom.php:
function register_redirect() {
if (strpos($_SERVER, ‘wp-signup.php’) !== false ) {
$url = ‘http://www.mysite.com/join’;
wp_redirect($url);
exit;
}
}
add_action(‘init’, ‘register’);
those two helped but didn’t completely remove the issue, this plugin really nailed it for us though:
– installed this plugin: https://wordpress.org/extend/plugins/invitation-code-checker/ (since we have a local comm site, we just used a zip code as the invite code)
Not sure how your site is set up but perhaps you can find a way to use it too, may even allow you to re-enable blog sign up at registration. It says Tested up to: WordPress MU 2.8.4 but I have WP 3.0.3 with network enabled and BP 1.2.6 and still seems to be working just fine.
Most of these suggestions were pulled from helpful posts on BP, hopefully they help you out a bit 
WOW, I did the above mentioned items and I am still getting hammered with spam blogs. I have no idea what to do now, I am already making a sacrifice by taking away blog creation during signup.
Any ideas of what I can do?
I didn’t notice the wp-signup.php, I am hopeful this will solve the problem, thanks!
Either they;re getting in via the bbpress signup, or they are using exisitng logins.
Have you got “allow users to add exisiting users” checked in the super Admin -> Options menu? If so, UNcheck it. that’s one way we know they were getting in.
Also – you did nothing to the default multsite signup page, whcih is yoursite.com/wp-signup.php. Change that to a .txt file, then NOBODY can sign up for a blog on the front end.