BuddyPress.org

I have a couple BuddyPress installs. The older of the 2 has received 150+ spam member registrations (and blogs) this weekend. All create members like bob45873675 and “Bob’s Blog”.

I have changed slugs, activated recaptcha and followed several blog posts on best practices. What’s interesting is they are somehow bypassing my registration page. I have required fields and have removed the “create a blog” from the registration page; but somehow they manage to create an account and a blog. I also receive “lost password reset” email notices for each account that is created, so maybe that’s a clue to where the issue is.

I was so fed up with it, I disabled registrations completely (only allowing blog creation by logged in users) — and I’m still getting new spam members and blogs (how is that possible??) This seems to be a pretty serious security issue that is different from previous “splogging”…

Vulnerability/hack in the registration or lost password, etc…?? I presume this could be WPMU not necessarily BP?

I agree, my test users have been telling me that they have so many passwords to memorize that they like to be able to find them in the registration emails…

I know its not safe, but theres nothing to protect if users never log back in…

Best,
C.

I am also having this problem – I guess everybody is. I also followed the tips you mentioned and initially, it reduced splogger registrations a lot.

However, I disagree with Terry: there are not real people setting up blogs and answering captchas, these are bots. As kiwipearls mentioned, if you go and try to sign up manually, you have to fill in the required fields.

There is a leak somewhere in BuddyPress/WPMU registration and all methods to stop the oil have failed until now. BP (haha) people say it’s WPMU and the other way around, I guess. The leak has been here for months and nobody seems to want to fix it. Maybe it’s some kind of corruption since the premium site Terry mentioned has a way to fix it.

Check Site Admin > Options – Allow new registrations == must be set to “Blogs and user accounts can be created.”

Don’t worry about sploggers, when you have WPMU Secure Invites on, no one can register without an invitation — unless of course one of your members invites one…

Alternatively, go to Site Admin > Invites. Then in Invites panel click on “Edit Settings” link. Some things to watch out for if you’re using bp-default or its child theme:
== What is the address of the signup page? (wp-signup.php is the default)
Signup page == make it register.php
== What address do you want the invitation emails to send people to? Please add the full URL to the registration page.
Signup page == if BP is installed in main site == http://yoursite.com/register.php . Or if BP is installed in sub-blog == http://yoursite.com/subblogname/register.php or http://subblogname.yoursite.com/register.php

@crashutah thanks a lot man for your responses and information. I’ve noticed that there is some differences indeed between single and MU handling the whole registration, activation, and log in processes.

I tried this piece of code (in my functions.php after the disabling activation and email bits) however it game me some weird behavior and my backend became non functional. I probably missed something (used the code as is while I needed to modify) or maybe one of my other plugins is causing misbehavior? I have auto redirect to profile on login plugin, and branded login plugin activated.

Cheers.

Never mind I got it – I dont even know what I did. I checked it on a different computer and there it was. Then I checked it on the first computer and the sign up link was there. Wonder what that was all about.

@dailynewarker what do you mean when you said you pointed to your “real, production database”

I tried removing lines 17+18 of bp-core-signup.php /* If the user is logged in, redirect away from here */
if ( is_user_logged_in() )

but that didnt do anything

On to the next fix…

I am having this problem too. There is no registration page showing up. when I type in http://www.yoururl.com/register it redirects to the home page. Any suggestions?

Does Buddypress require WPMU. I am having issues with the registration options plugin as it does not activate.

I wrote a plugin called Invite Anyone that doesn’t do quite what you are looking for (it doesn’t restrict registration) but it could be modified to do what you’re asking: https://wordpress.org/extend/plugins/invite-anyone/

Hi @jillsays

If you’re creating a child theme: The template file you’re looking for is wp-content/themes/yourtheme/registration/activate.php

If you can’t find it in your theme folder then you need to copy it from wp-content/plugins/buddypress/bp-themes/bp-default/registration/activate.php and copy it into your theme folder. Remember to paste it into wp-content/themes/yourtheme/registration/activate.php

NB! Where ever I’ve written “yourtheme” replace it with the name of your theme’s folder.

Great job on the homepage Mike. How come nothing happens when I click on Forums, Groups, etc? Are you still working on this?
Your layout is great but I’m not too crazy about the color theme. It doesn’t feel engaging enough. Maybe it’s just me. But I love what you did with the sign up form with the rounded corners and drop shadow.

mercrime did you get it to work? Because this doesn’t work. It breaks the Registration field.

I have BuddyPress 1.2.4.1 on a single instance of WordPress 2.9.2 and after Activating bp-registration options I get the following error in the Registration Page and the “Complete Sign Up” button disappeared.

undefined function get_current_site() in myserverpath……../wp-content/plugins/bp-registration-options/bp-registration-options.php on line 726

I have BuddyPress 1.2.4.1 on a single instance of WordPress 2.9.2 and after Activating bp-registration options I get the following error in the Registration Page and the “Complete Sign Up” button disappeared.

undefined function get_current_site() in myserverpath……../wp-content/plugins/bp-registration-options/bp-registration-options.php on line 726

I’ve used WP for years too and when I switched to WPMU and BB as a community the username default setup does not go down well. I’ve only a small number of registered only users and I set their display names to their name manually with each new registration (with less than 20 users that’s doable). Looking through my entire BB install I cannot find any username mentioned. So, maybe a plugin to automatically make users display name their first name (or first+second) would work for you? The @mention should also use the display name too else it’s probably unusable in a community space. Real people – real names. I paid to have BB chat component work with ‘display’ names for the same reason else some of my users would not know who they were chatting with.

Some thoughts;
– Assuming you don’t want others creating blogs in your installation, and you’re on WPMU, go to Site Admin > Options – under Registration Settings – choose ” User accounts may be registered.”
– Deactivate the Blogs component in admin dashboard – BuddyPress > Components Setup – under Blog Tracking – choose disabled
– Furthermore – https://codex.buddypress.org/how-to-guides/modifying-the-buddypress-admin-bar/

It’s because the registration function [bp_core_validate_user_signup()] only looks for lowercase usernames.

A ticket has been filed for this already:
https://trac.buddypress.org/ticket/2207