The website is http://cureuphoria.com
All of a sudden yesterday, the site got killing slow and special characters got teh funny symbols (that is in the Admin too).
I obviously suspect some hack attack here.
I got LOTS of spam registration the last days. I deleted one fake member after the other.
Than installed SI Captcha, but still had some.
Now I changed the register slug to something else.
How can I fix both problems: slow + characters?
The slowness will push away users from using the site. It’s like having a nail in my heart, ’til I solve this.
Couldn’t find anything on this so I wrote something.
It seems to work for me.
I simply add this to the bp-custom.php
function update_friends_count( $user_id ) {
global $wpdb, $bp;
if ($friend_ids = BP_Friends_Friendship::search_friends( ”, $user_id )) {
foreach ($friend_ids AS $fid) {
$total_sql = “SELECT COUNT(id) FROM {$bp->friends->table_name} WHERE initiator_user_id = $fid OR friend_user_id = $fid”;
$total_friend_ids = $wpdb->get_var($total_sql);
update_usermeta($fid, ‘total_friend_count’, (int)($total_friend_ids) – 1);
}
}
do_action( ‘update_friends_count’, $user_id );
}
add_action( ‘wpmu_delete_user’, ‘update_friends_count’, 1 );
add_action( ‘delete_user’, ‘update_friends_count’, 1 );
add_action( ‘make_spam_user’, ‘update_friends_count’, 1 );
FYI, I’m running the following plugins and they seem to be stopping/slowing spammers:
Bad Behavior
WPMU-Block-Spam-By-Math
Also I use this in my .htaccess http://wpmututorials.com/how-to/spam-blogs-and-buddypress/
In going over with my community what kind of groups they want (i.e. they can make anything they want, or they have to ask admins to make one), the idea came up ‘What if we could make them, but you have to approve them!’
Is that possible? I know you can set up new blogs and posts to be approved, but new GROUPS to require approval on creation would be kind of neat. Stop the spammers a little bit.
the hack adds “the new users’ e-mail address to the e-mail with the activation link. This way you’ll know which activation link belongs to which user.” This is really needed!
Is there another line to add to functions.php that will add the email address?
Actually what we need is a plugin that creates a pending membership panel in the admin so you can go in and active or mark as spam… just like comments!
AH! Got it http://buddypress.pastebin.com/LrQuRa9T
This will show you the number of pending (NOT SPAM) comments next to the menu for ‘Manage Comments (#)’. Whew. I’m going to fiddle and see if I can make something like the notifications alert show up. But this is mostly what I wanted 
The /*disable blog signup for non logged in member*/ code from @sbrajesh didn’t work… it didn’t remove the create a blog from the signup page.. I got a spam blog within minutes.
ah well that’s it for this rainy Sunday afternoon…. When I get some time next I’ll start but updating to php5 and then I’ll check back with the forum. Thanks everyone!
~ Ruth
I have the same problem. 50% of my users are marked as spammers
I think they don’t get the activation email, or it gets thrown in their SPAM folders..
It would be nice to have a functionality in WP to send them another email with activation link..
It is the only activity in the forum
dissertation writing services aimee club zero 1 5 days, 22 hours
Missing usernames beside avatars for members who are not spammers and/or not bozos … at least that’s what I think they’re not 
which one is it or is it gone now?
Hi,
A spam member startd a group and forum topic. I blocked the member, marked them as a spammer, removed the group….. how do I clear it off of this page? http://clubfootclub.org/community/forums/
Thanks for your help!
~ Ruth
@DJPaul – editing my own posts work now, it wasn’t working about an hour ago. Andy’s been busy! 
—
Other issues:
– Hyperlinks in the “About Me” profile description need to be nofollow’d to prevent SEO spam.
– Group avatars do not work
Members Directory. If you sort by “newest registered”, and thus get the most recent spam signups. Not only does it take a long time to load due to number of users on this site (30+ seconds), but as those spammers don’t have a name, the floats aren’t appearing to be cleared correctly. See http://twitpic.com/1i4ueq/full
FYI, Today I updated SI CAPTCHA Anti-Spam for latest version of buddypress 1.2.3 compatibility
SI CAPTCHA Anti-Spam
https://wordpress.org/extend/plugins/si-captcha-for-wordpress/
This plugin adds CAPTCHA anti-spam methods to WordPress on the comment form, registration form, login, or all. In order to post comments or register, users will have to type in the code shown on the image. This prevents spam from automated bots. Adds security. Works great with Akismet. Also is fully WP, WPMU, and BuddyPress compatible.
The screenshots were from an old version. I have updated them. The CAPCHA looks nicer now.
SI CAPTCHA Anti-Spam
https://wordpress.org/extend/plugins/si-captcha-for-wordpress/changelog/
Today I updated it for latest version of buddypress 1.2.3 compatibility
Had our first Hacker attack…
WhooHoo…
It was a friend’s acquaintance trying to prove a point
so kinda silly – and taken care of.
But it did bring Security issues to mind.
Thankfully the Group-Notifications plug-in has some anti-spam measures.
Any ideas on how to Baton Down the Hatches for BuddyPress?
We need to keep it open to registration and activity.
But how do we squash and ban certain unruly users quickly and effectively?
I now have WP plug-ins installed: Ban Hammer and WP-Ban
which are good for banning IPs, hostnames, etc.
But what about on the BP side?
How do we moderate Activity feeds especially?
Let us know some thoughts and ideas.
– Avatar –
.
many thanks Ray !
That “no reply” e-mail seems not to be the issue, because the second e-mail which says “Dear User. Your new account is set up.” is also being send from “noreply@domain.com”.
So both e-mails are being send from “noreply@domain.com” , but the first e-mail containing the BP-Registration-Code is landing in the Spam-folder, the second e-mail which the user is receiving is actually not landing in the Spam-folder of Gmail.
Anyway, do I need a Plug-in” in order to change the e-mail-address from “noreply@domain.com” to something different ?
Is there a way to change that somewhere in the backend without using a plugin ?
Ahh okay, Erich! Thanks for the extra details.
It could be an issue with the email address that the activation email is sending from.
By default, the activation email tries to use the admin email option in WPMU.
If that isn’t set, it uses something like:
noreply@domain.com.
Which could be causing the activation email to go to the spam folder.
Try using the following plugin to set the email address:
https://wordpress.org/extend/plugins/mail-from/
Hi Ray,
the thread you are referring to is regarding a different issue.
I am running a dedicated server and I have no issues with SMTP.
Sending e-mails via BP is actually working fine, the only issue I am having is that the e-mail send via BP containing the Verification-Code is landing in the Spam-folder of the Gmail-account of the respective user.
All other e-mails send by BP are actually not landing in the Gmail-Spam-folder.
So something got to be wrong here…..
I guess this is worth a TRAC-ticket.
Many thanks,
captcha and math tools do not really help fighting spam.
spammer register manually and then feed your blog automatically remote via xmlrpc.
i am running a wordpress mu + buddypress site and had about 40 spammer-registrations a day with lots of spam. then i deactivated xmlrpc via renaming xmlrpc.php in wp-root, result was only user registrations (without content spam). about four days later spammer registrations were reduced from 40 to about three a day (easy to delete), seems that the spam-apps noticed that the rpc doesn´t work and deleted my site from their targetlists, entering their messages manually is to complicated for them….
I havent had a spammer registration since i used the “WMPU block spam by math” plug-in. i was getting 20 a day, and now absolutely zero.
https://wordpress.org/extend/plugins/wpmu-block-spam-by-math/
I changed the signup page name, stopped all new registrations across all blogs, added to the htaccess page and STILL get signups.
I asked over at wpmu and they say it is Buddypress causing this and to ask here but I see that BP blame WPMU.
Great!
Running latest version of BP and WPMU. I have marked a member as a spammer but they are still able to update their status and it displays on the home (activity stream). Any check I can add to the activity stream to make sure that spammers comments, updates, etc doesn’t display on the activity stream?