Topic: Spam/Bot users · BuddyPress.org

Spam/Bot users

mmaccou
Participant

@mmaccou

9 years, 10 months ago

I have akismet and I just added iThemes Security, however I am still getting several bot users gaining access to my site. Last night, 12 were added. I am assuming this is via buddypress? In the wordpress settings, I have the membership box checked that says “anyone can register” but they should still have to go through the registration process and request membership. Sometimes, the users automatically show up on the site without me granting access. Other times, they will be in the pending folder (requested access) but they are all from other countries, odd “about me” sections, and weird email addresses.

If this is not a buddypress issue, I apologize, but to me it seems like it might be. Looking for some direction.

Also, I have the “coming soon” plugin installed. If I have that activated, these issues do not exist.

This is what I have installed…

buddypress version 2.1.1
WP version 4.0.1
Akismet version 3.04
iThemes Security version 4.5.6

What other measures can I make to only have real users added?

Viewing 7 replies - 1 through 7 (of 7 total)

danbp
Participant

@danbp

9 years, 10 months ago

It’s not buddypress but WP who manage registering and concerning bots, they go directly on your server.

A good starting point is to read the WP Codex:
https://codex.wordpress.org/Hardening_WordPress

And at least,
Never use “admin” as username
Never user wp_ as table prefix

If you search for “spam” on this forum, you will find many topics about this subject.
And the latest one, even if not directly related to your issue, is one of the sticky post on the forum homepage. https://buddypress.org/support/topic/this-is-why-we-cant-have-nice-things/

mmaccou
Participant

@mmaccou

9 years, 10 months ago

OK @danbp thanks I’ll take a look at that documentation

Security
Participant

@shivam-kumar

9 years, 10 months ago

Hi @mmaccou my site was also suffering from the same issue until few days back but one of the way by which i prevented the fake account registrations on my site is by putting minimum allowed character restrictions on my registration form input fields you can read a small howto and details on it from here
I hope it helps
Thanks

shanebp
Moderator

@shanebp

9 years, 10 months ago

@shivam-kumar
Thanks for the link and for creating the how-to.

Security
Participant

@shivam-kumar

9 years, 10 months ago

Hi @shanebp NP and thanks for reading 🙂

djsteveb
Participant

@djsteveb

9 years, 10 months ago

Best thing I did to limit spam bot users is adding the free wordpress plugin “good question” – but change the defaults questions and answers.

I also reccomend si captcha plugin, and limit login attempts.

I always change the default settings on limit login attempts to be more strict than default.

I also add whitelist ip plugin for limit login attempts so I don’t lock myself out – lol.

Jmar42
Participant

@jmar42

9 years, 10 months ago

NoMoreCaptchas may help. Anti bot technology. https://buddypress.org/extend/plugins/?ps=nomorecaptchas