BuddyPress.org

something like the https://buddydev.com/plugins/bp-private-message-rate-limiter/ may be helpful if you really want to stop 99.9% of it.. that one is premium / costs $19.. but it’s more of a hindrance to the spammers than just the spamshield.. which I use and think it stops 90% of them.. so is the other 9.9% worth the premium.. situations vary..

Try https://wordpress.org/plugins/wp-spamshield/

Hi @djsteveb:

Thanks for the awesome feedback! We always want to improve the plugin. If you could contact us via our support form, it would allow us to look into that. With a little modification on our end we should be able to auto-detect, and make it so no one has to tweak any settings.

– Scott

ip geo block plugin best dam thing ever.

shield firewall plugin just to disable xmlrpc or a disable xmlrpc plugin

“good question” (https://wordpress.org/plugins/good-question/) or similar – adds a question that must be answered to finish registering

wp spmashield

limit login attempts

sucuri hardening

audit log and multisite register ips (for the manual dedicated spammers)

this mix seems to make like tough for them – especially the ip geo block stopping several countries from abusing the site..

ymmv
dj Steve

ps

@redsand – good to see you active in bp threads! your plugin is a miracle, especially since akismet changed – one on bp site I did have to fiddle with the settings for forms or something recently – vaguely remember users having trouble sending pms were getting the you cant do that permissions thing until I messed with it a bet.. just like 2 weeks ago.

WP-SpamShield will take care of all of that for you. 🙂

Full disclosure: I’m the developer.

There are some plugins, do a google search.

you can also use this code but you will get spam if they can get in without email conformation.

add_filter( 'bp_registration_needs_activation', '__return_false' );

I’m a bit uncertain about allowing users to change their Usernames, it means they lose connections with the past in so much as the activity table is static so the name does not change on past activity items and this throws some errors, also I think it may make the admin anti spam task harder, users posting stuff then changing their login name.

I suggest an anti spam plugin, the one im using is cleantalk

Hi @Tranny,

Trust me, I completely hear you. You’re right. Ideally anti-spam controls like that should be built-in.

Those are great suggestions. We’ll take a hard look at possibly including those features in future versions of WP-SpamShield as well. One thing you’ll find by using a plugin like WP-SpamShield is that it will block 100% of bots, and it will prevent most human spammers from even registering (which keeps them from even getting to a place where they can spam other users), and it will make it difficult for them to post their spammy messages.

Let us know if we can help in any way.

– Scott

Hey @danbp

I just thought I’d jump in here real quick, as I think this will be beneficial to everyone in the thread including @Tranny.

And even if you would be a genius coder creator of an extra super original spam shield, you could be sure to became target #1 of all spammers, because in this case, you would represent the absolute challenger of all code breakers !

We are that “genius coder creator of an extra super original spam shield” that you speak of. 🙂

There is no miraculous plugin or trick to stop them.

Ahh, but there is.

It’s real, and it’s even called WP-SpamShield. LOL…you can’t make this stuff up. 🙂

Check it out on WPorg. It’s been out for about two and a half years, and is forked from another plugin we developed almost a decade ago. It works perfectly and automatically on BuddyPress, bbPress, and pretty much everything else. You can also feel free to check out the plugin documentation here.

…And for the record, we definitely are a huge target of spammers. 🙂

dealing with spammers is a long run work, to not say a never ending work.

True story!

– Scott

@tranny,

dealing with spammers is a long run work, to not say a never ending work. There is no miraculous plugin or trick to stop them.
And even if you would be a genius coder creator of an extra super original spam shield, you could be sure to became target #1 of all spammers, because in this case, you would represent the absolute challenger of all code breakers !

Back to real life.

Most of updates spam comes directly into the DB. Bots are clever and don’t need to login to do that.
Some spammers are real people, and once they are logged, they do their stuff manually. These people can be isolated, but to do this, you have to find them in the user list. Which is absolutely not easy and time comsumting. And of course, this is not prevention but intervention, after you where spammed.

You could also track IP‘s, but again, this can be helpfull only AFTER you where spammed. But getting ip’s on admin user list is a great way to gain time. Once you have the IP, you can consult many anti spam sites who store any bot and user known to be attackers. And eventually ban them with this plugin.

For now, first thing to do is to clean your user list. Whatever suspect username, like a589xdf or special to BP, Bill UNERHOOD, can be eliminated. The first example use alpha-numeric digits, the second a very well formed first and last name. It’s extremely rare that normal users enter such credentials. In addition to this, you can check their email. Why would you, for example, have members with a polish email (@blogmedykamenty.pl) if you’re in New Zeeland and your site relates about pets ? In this case, you can raisonably doubt about an interest between medicaments and pets ! You can fire such user.

All this may be good and well, but you have also to hardening WP. This means using another table prefix as wp_ at very first. And second, to not use “admin” as user name. Never !
Read also @venutius tutorial

You have to clean out the existing spammers, unfortunately manually. And to avoid upcoming spam.

To calm down the bots – in case you receive dozen of spam daily, close all comments and deactivate notices and messages component in bp settings for 2 or 3 weeks.

Also, in case you’re on a dedicated server, you really need to enforce his security. But this is out of the scope of this forum.