BuddyPress.org

@dangthrimble – no matter what you do to hide the admin username, the really good hack teams are running scans to get the admin names by running url checks like “yourdotcom /?author=2
?author=3

and scraping the details wp is providing both on page, and in meta fields.
Then adding those names to their pass cracking bot nets.
(look in your raw access logs, you will see it)

I’ve tried changing names on wp sites many times, the rssn hackers get getting the new names, you can tell if you check your fail log with “limit login attempts” plugin.

I’ve played with some code to change in wp themes to hide details there, but my php is slightly below beginner and my understanding of what the theme code is doing is same.

I tried a plugin from the wp-repo that is supposed to hide all that- but it’s not working.

(you could htaccess geo block ukrain and chna from your site completely and probably prevent 90% of these issues anyway from what I have seen by checking logs)

I found some htaccess someone posted that is supposed to suppress all requests for “/?auth [nc] or something like that – but since I do not understand what each part is doing, I have not deployed it.

I think it needs to be htaccess add and include anything with “author” and a number to work well (reg ex for numbers?)

Until I find a htaccess regex method I understand and trust, I have found that the best combo for prevention is:

Geo IP Block
(https://wordpress.org/plugins/ip-geo-block/ )
(default settings are okay, I think it’s best to change the drop downs to block by country the plugins area, theme area, admin ajax, etc as well – options in settings
Also some blogs may want to uncheck the “comment post” block by country
)

If this geoip block plugin author had a donate link I’d already sent him some bucks, it’s the most useful plugin I’ve found since… “good question”

and succuri is an informative add on as well
(shows that some bots have figured out how to bypass the limit login attempts max tries setting)

The way WP is handling question marks in urls (string queries I think it’s called) and giving up 200 status codes and extra info (including author names) to bots is a big issue for me, this kind of relates to the unanswered support question I posted here:
https://wordpress.org/support/topic/question-mark-url-return-200-not-404-string-query-noindex-or?replies=1

$subscribers = get_users( 'fields=ID&role=subscriber' );

$subscribers will be an array of just the IDs of all subscribers.

https://codex.wordpress.org/Function_Reference/get_users

https://wordpress.org/plugins/bp-registration-options/ ?

Your worrying about nothing. As long as you have some security measures in place it doesn’t matter if someone knows a username of an admin. To feel safe create an account you use for the front end and keep the admin account for only accessing the admin.

Add a plugin like this one https://wordpress.org/plugins/sucuri-scanner

Use strong passwords.

Have you tried searching the WordPress Plugin Directory? There seems to be lots of plugins that display a geographical map of users.

I don’t know if this is any indication of the issue but no pages were generated during the installation of the plugin, I had to set them all up manually.

The answer is in your first topic:
I have deleted the original copy of BuddyPress from my site and the associated pages.

If you haven’t removed BP from DB, via plugins dashboard > delete before reuploading a new copy it’s normal that you have to recreate the pages manually.

The adventure starts here:

Installation in WordPress Multisite

Most of the time BP will use page.php since that template file exists in the majority of WordPress themes. However, if you wanted to style BuddyPress pages differently than a regular WordPress page, you could add a template file named buddypress.php to your theme’s directory and BP would use that template instead since that file is ahead of page.php in the hierarchy above.

That’s a recent function i didn’t know ! It’s filtrable, so you haven’t to hack that core file.

See also in same file member_can_edit function, related to bp_moderate capability, used for group admins, but i doubt you can apply it to “editor”…

FYI: https://buddypress.org/support/topic/bp_moderate-capability/

Additionnally, see this snippet written for WP only, if you can combine something:

Let Editor Manage Users in WordPress

I’ve already tested all this, but i got the same result as you. But i’m not a dev. 🙂

Good luck !

This is actually not possible. Is a work on progress: https://buddypress.trac.wordpress.org/ticket/5121

Take a look at Unconfirmed.

Do you have ms defines in wp-config ?
define( 'WP_ALLOW_MULTISITE', true );

Have you setup pretty permalinks (something other than default) ? Also htaccess may be wrong.
Create a new one.
This can be done by removing the old htaccess and (re)saving permalinks, WP will give you new params or create htaccess for you.
Also are all salt keys in wp-config ? Try to remove the existing and add new one. Take them from here: https://api.wordpress.org/secret-key/1.1/salt/

Hi @azizul-karim-aec,

to add a profile field like biography to profiles, you have to activate xprofile component in BP settings.

This and much more is all explained on the Codex.

User Extended Profiles

it just showing membername|sitename This is not a issue, but intended so by default.
membername|sitename is the page title when on a member profile
members|sitename is the page title when on the member directory – where “members” is the title you give to the member page. BP create automatically this page and use “members” as title at first install, but you can modify it.

Aside, you’re using admin as user name. I strongly recommend you to change this.
https://codex.wordpress.org/Hardening_WordPress
http://www.wpbeginner.com/wp-tutorials/how-to-change-your-wordpress-username/

hi @revadigital,

not sure what you call buddyblog… The blog is part of WordPress, not BuddyPress.

Can you give site url, theme, list of plugins and install type (network or single) please ?

Found a site which seems to be yours. If it is the case, you’re using Frisco for BP, an old theme. This theme hasn’t been updated in over 2 years. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.

Since BP 1.9 (dec 2013), you can use almost use any existing theme.
If you’re in a test phase, use simply 2015. Once anything is working, you can search a theme. 🙂

no need to be a programmer to apply a patch. You’re still know how to copy/paste, i’m sure ! 🙂

the number refer to the line number. If you use a code editor like notepad++ you’ll see them.

+ or – is self explanatory: + is added, – is removed.

Depending the patch size, you should be very attentive and concentrated when copy/pasting.

Or you use the heavy pro method, explained on WP’s Codex:
https://make.wordpress.org/core/handbook/working-with-patches/apply-a-patch-using-tortoisesvn/

… but for one or two lines, it’s a bit to much IMO !

When the door is closed, you always enter by the window ? 🙂

This is the impossible thing (on backend):
1. create a new user with basic information

The WordPress login process use ONLY a username, a mail and a password.
As long as this is not handled and correctly introduced to DB, you can’t before or during this process, enter anything related to a given user from back office.

WP register first the user.
Once the user is registered, he receive an unique ID. It is this ID who allow BP to add additionnal informations.

Or you allow front-end registering or you have to use the 2 step work from back-end: register + extended profile information.

Seems to be a weird bug ! A ticket was opened a few weeks back:
https://buddypress.trac.wordpress.org/ticket/6360

Same issue here, with a patch:
https://buddypress.trac.wordpress.org/ticket/6371

Test the patch, an give feedback (important) about your issue and some details about your host config: server type, php & mysql version.
You can login by using same credentials as here.

Good luck !

@baldarab –

I see how you are using groups – so it does appear that links to them are easily discoverable from your public facing pages.

If you do a view source and look at your code for each of your groups, you will notice that the page title is exactly the same for all of your groups ( <title>Activities – Freaky Rivet</title> ) – and there is no meta name description =

Two major issues for the big G.

Which version of buddypress are you using?

This problem concerns me so much that I have kept one of my sites with an older version of buddypress (2.2.3.1 ) with the cobbled custom code I was able to get from wpmudev ( http://premium.wpmudev.org/forums/topic/bp-meta-tite-description-for-groups-and-members-pages#post-806736 ) – the cobbled code may work the newer version of bp – but things are quite confusing with how wp has changed up some of the title thing, and bp has it’s way of things and there are possible conflicts with priority or something..

The discussion on this trac ticket( https://buddypress.trac.wordpress.org/ticket/6107 ) says things have been “fixed” – I do appreciate the devs working on it a bit – but I have a feeling the fix is more of a “make it work in a semi-okay way with a couple of setups” – not much as far as giving users real control over the titles and descriptions.

I am guessing people will point to theme designers to hook this up, and they will point to “we use wordpress’s suggested way of title-ing (wp the title or whatever) – and so it’s wp/bp issue, and descriptions should be handled my an seo plugin – but given that bp’s pages are pseudo pages without any taxonomy registered, it appears that yoast and others have so desire to work with it.

This is my current understanding, and may be not 100% accurate – what I gather after posting many questions and issues relating to this in various places.

I’d pay someone to code a plugin that gives options for bp meta stuff like the suggestion I posted before, and give it to the community. If I could understand all the bp/wp code and php I’d gladly make it. It seems the BP coders are spread a bit thin, so I have no good options for fixing this issue at the moment.

Is this the only part where you can’t access ?

Ensure you followed correctly all install instructions

Installation in WordPress Multisite

BuddyPress does not work on installations where you give WordPress its own directory.

@henrywright OP has commented at https://buddypress.trac.wordpress.org/ticket/5577
5 days ago

There is a ticket about this issue. See if you’re concerned and don’t hesitate to mention your issue and this topic.

You can login to Trac with same credentials as here

Right. So it looks as though it could be something the BuddyPress core team might need to look at. Can you open a Trac ticket explaining how the profile fields are displaying in the wrong order? If you could provide as much info as you can that’d be great.

You can use the same username and password as you use here in the forums.

This can be accomplished using BuddyPress. As to whether you’ll need plugins or custom code, I’d be tempted to say you’ll need to go down the custom route because I haven’t seen a plugin that will do this for you (I may be wrong so check the Plugin Directory first).