BuddyPress.org

It seems that those spamming my site are using wordpress’ default way of creating an account and not registering through buddypress. When I go to the users admin, all of the users that used buddypress were given the default forum role of “participant”. The spammers don’t have this role.

Because of my current setup, I installed the Members plugin and created a new role. Then I made the buddypress form show up only for those that I have confirmed. I would recommend that this be added to future buddypress installs as an option.

Also, perhaps the emails are being sent but falling into user’s spam folders. Perhaps ask them to check

A great plugin that I use (is free) that has greatly reduced registration spamming is WANGUARD (check it out here: https://wordpress.org/plugins/wangguard/) works great with buddypress and bbpress

First you said:
>I disabled registrations using “Registration is disabled” from the network admin settings/network settings and the spam registrations continue.

Now you say:
>– disable registrations (network admin) and the automatic reg stops

Not sure why things have changed, but it’s a clue.

btw – did you change the salts in your wp-config ?
https://codex.wordpress.org/Editing_wp-config.php#Security_Keys

@ride2719

https://buddypress.org/support/topic/critical-exploit-backdoor-spam-registrations-via-bbpress/#post-173527 ?

>Forums are enabled (it’s a primary purpose for the site)

Understood, but try deactivating bbPress.
If the spam regs stop, you know it’s a bbPress issue and you can post a bug report on their site.

If they don’t stop, at least you know it’s not bbPress.

I need an interface that organizes all the forum related tasks. I’m finding the setup with BuddyPress & bbpress to be a little intimidating.

It sounds like you just need a forum, which would be bbPress. The reason bbPress and BuddyPress are separate plugins is that this allows people to pick and choose according to their needs. What you need to figure out first is, what do you want and need?

To learn more about how to use bbPress, check out the official guides here: https://codex.bbpress.org/

There are also plugins specifically to add functionality to bbPress, such as spam control and other neat things:

Plugins

Hope that helps.

Hi @ubernaut

Yes, if WangGuard detect a user as splogger and you mark it as not splogger, he is flagged as “Checked Forced”. That will force to WangGuard to accept that user as good user at your WordPress.

But if you mark a user as Splogger, and then, you mark it again as Not Splogger, he is flagged as Checked user and he is removed from WangGuard database.

your first admin profile page

http://modemlooper.me/buddypress-spam-link.zip

click download gist button and then upload it to WordPress

I would like to offer two ideas for consideration:

1) Integrating basic anti-spam capabilities into core
2) Improving performance via fragment caching

1) I realize that there are already good plugins that deal with spam, both comment and multisite blogspam. But being spam, it is a cat and mouse game and I feel that buddypress should have some basic anti-spam protection out of the box. For example, a hidden text field via css as a honeypot. Users who are not at all comfortable coding or editing files can turn this on or have it on by default (rather than try to follow guides like this: http://www.pixeljar.net/2012/09/19/eliminate-buddypress-spam-registrations/)

2) This was touched on in the recent buddypress panel discussion:

(caching: 19min – 22min)

After spam, the biggest issue that I’ve heard is with performance. I think we should start to address this. For more info and details see this thread.

One of the challenges of using caching plugins like WT3 is that they don’t work for signed in members of buddypress sites. But a fragment caching system can still cache parts of the page which are ‘static’ and would not change as a result of the user activity.