BuddyPress.org

searching the wp-repo fro something else – and found this – https://wordpress.org/plugins/members-page-only-for-logged-in-users/

not sure if it works with current versions of things – may work – or may be helpful in finding the right code for whatever.

I think any system for preventing member view (or other page / pseudo page views) should have an optional setting to send a 403 access denied server code – may help with some things.

/random thoughts

@d_enajetic

From my limited information / understanding (as user not a dev)
“peeps that create BP” – abandoned the project long ago.

The forums here and the bp site are mostly ignored and have many problems.

There is no funding for BP anymore – and has not been for a long time.

With that being said – I was amazed to see some really awesome peeps doing a lot of work and smart discussions about so many code issues when recently visiting the bp trac system – so there is a lot going on behind the scenes. All those guys deserve a big bonus, but I am not sure if anyone is getting paid from Auttomattic for working on bp anymore.

There are several people who are monetizing a bit with paid plugins and “bp jobs”, I understand the need to get paid, and I get that there are only so many (maybe a dozen?) – Bp dev people, so providing free support in the forums here is not top of the priority list – and really many of the forums questions are not so much tech issues, but “how to” and “can I..” – which would be more easily answered by a quick bing search..

Anyhow I wish I knew more about how the activity thing chose what to pull in, and how to mod it- there are some neat newish things that BP has added to help filter the activity thing, once in a while someone will chime in with how to do it – but I have not seen any real documentation on it – another job that should be filled, yet will likely not be the top of the unpaid priority list anytime soon.

I wish wordpress would pull BP from showing up as one of the top plugins in the wp-repo and the wp dashboard- I think it is getting too many people to install it or check it out that have not business jumping into this rabbit hole, or asking about it! – lol

Let me know if any of that works our for ya, or if you find the magic “this is what bp pulls” – I am working on a plugin that converts gifs to html5 video for one of my sites, and as to where I don’t mind if those are pulled into the activity – it would be a mess if they all auto-played – so may need to do some work arounds to keep something else there in their place and a “click to see post” kind of thing like were originally talking about.

@fridafric and now the multi-network “blogs” are called “sites” – which I think is stupid – but be aware when learning how to enable wordpress “multi-site” which was for a long time “wpmu” – that a “multi-blog network” is now “multi-site” network – and your users are asked if they want to create a new “site” – instead of being told they can create their own “blog” – meh.,

@fridafric Most of the information on that book is obsolete. If you want blogs, you need to create a network first, and that is a WordPress function which BuddyPress supports. Deactivate BuddyPress and other plugins first the follow instructions at https://codex.wordpress.org/Create_A_Network
Do make sure that your multisite installation is working as expected before activating BuddyPress.

@wealthy – I don’t think you need buddypress for this. I believe you could easily achieve those goals setting up and wordpress install, turn on multi-site (aka wordpress mu setting) – add in one of the many membership type plugins like s2member.. then add in a commerce plugin like marketpress or woo-commerce, something like that.

Make it so all sub “blogs” aka “sites” are locked out from visibility unless logged in, your “logged in state” is determined by the s2member or similar plugin…

might take a look at press permit core for restricting content.. there are others.. but in essence I think there is no need to add buddypress to the mix. Only thing that would do it open up profiles and friends – but then you’d have much more difficulty locking down member profile viewing and groups viewing and stuff like that, which is not so easy to deal with at the moment.

@ghar123 – I am sure there are many options / different ways to accomplish what you are asking about, my suggestion would be to look at “press permit core” first.
https://wordpress.org/plugins/press-permit-core/
(pretty sure that will do what you need easy)

Then take a gander at s2member plugin perhaps..

there are others I am sure.

We’ve worked with the Premium version of WP-FB-Autoconnect on a number of sites. It does the job.

You could also take a look at the WordPress-Social-Login project on GitHub, which looks interesting.

I have not used it for anything like that, but s2member works with BuddyPress, allows you to restrict content, and supports dripping content:

Home

It is possible that it might work out for you. There is a free version that is likely sufficient.

https://wordpress.org/plugins/s2member/

It integrates with WP Courseware, if that is what you are using for your courses.

Good luck. Have fun.

@dangthrimble – no matter what you do to hide the admin username, the really good hack teams are running scans to get the admin names by running url checks like “yourdotcom /?author=2
?author=3

and scraping the details wp is providing both on page, and in meta fields.
Then adding those names to their pass cracking bot nets.
(look in your raw access logs, you will see it)

I’ve tried changing names on wp sites many times, the rssn hackers get getting the new names, you can tell if you check your fail log with “limit login attempts” plugin.

I’ve played with some code to change in wp themes to hide details there, but my php is slightly below beginner and my understanding of what the theme code is doing is same.

I tried a plugin from the wp-repo that is supposed to hide all that- but it’s not working.

(you could htaccess geo block ukrain and chna from your site completely and probably prevent 90% of these issues anyway from what I have seen by checking logs)

I found some htaccess someone posted that is supposed to suppress all requests for “/?auth [nc] or something like that – but since I do not understand what each part is doing, I have not deployed it.

I think it needs to be htaccess add and include anything with “author” and a number to work well (reg ex for numbers?)

Until I find a htaccess regex method I understand and trust, I have found that the best combo for prevention is:

Geo IP Block
(https://wordpress.org/plugins/ip-geo-block/ )
(default settings are okay, I think it’s best to change the drop downs to block by country the plugins area, theme area, admin ajax, etc as well – options in settings
Also some blogs may want to uncheck the “comment post” block by country
)

If this geoip block plugin author had a donate link I’d already sent him some bucks, it’s the most useful plugin I’ve found since… “good question”

and succuri is an informative add on as well
(shows that some bots have figured out how to bypass the limit login attempts max tries setting)

The way WP is handling question marks in urls (string queries I think it’s called) and giving up 200 status codes and extra info (including author names) to bots is a big issue for me, this kind of relates to the unanswered support question I posted here:
https://wordpress.org/support/topic/question-mark-url-return-200-not-404-string-query-noindex-or?replies=1

$subscribers = get_users( 'fields=ID&role=subscriber' );

$subscribers will be an array of just the IDs of all subscribers.

https://codex.wordpress.org/Function_Reference/get_users

https://wordpress.org/plugins/bp-registration-options/ ?

Your worrying about nothing. As long as you have some security measures in place it doesn’t matter if someone knows a username of an admin. To feel safe create an account you use for the front end and keep the admin account for only accessing the admin.

Add a plugin like this one https://wordpress.org/plugins/sucuri-scanner

Use strong passwords.