[Dane Gould]

Hi there

We are experiencing a ‘mass spam attack’ that is overloading the database on our web host server. Our web hosts SGIS have looked into this and have deleted 75,000 spam attacks this week that have taken place from May to August 2014 (there were only a few hundred in the 14 months preceding this).

Investigation has seems to show that the spam attack is linked to the bbpress forum plugin in our website. We have the latest version of Akismet installed and the latest version of bbpress. We don’t allow guests to start topics or posts or to reply to posts. All users have to be registered to reply to posts and only a few users are allowed to start new topics and posts. We are also using the latest version of WordPress which is 3.9.2. Does anyone have any thoughts or ideas about why this may be happening? Look forward to any reply.

Our website address is: http://www.tenantcentral.org.uk

Cheers – Dane

[Stephen Edgar]

This really isn’t a bbPress issue, it is more of a WordPress issue.

Your web host should be able to do some things via firewall rules.

A good starter doc is https://codex.wordpress.org/Combating_Comment_Spam , conceptually it is the same thing, you have some ‘content’ that spammers want to get in on, in this case rather than comments it’s your bbPress forums and/or topics.

bbPress uses WordPress user system for user authentication (login registration etc)

I know it’s probably ideally not what you were looking for but is the state of things.

A couple more thoughts would be to verify your Akismet API key is valid and Akismet is actually catching what spam it can. I’d also look to adding “capcha” plugin that supports the bbPress, there’s a few of these in WordPress plugin directory.

[Sam Rohn]

these 3 plugins are very effective in eliminating spambots and other spammers on wordpress/bbpress site

i use all 3 with no apparent problems, but read the notes for each plugin, all need to be properly configured and stop spammer reg can be very aggressive, stop spam reg and bad behavior will both check visitors against a blacklist of known spammers and will deny them access to reg and posting forms etc

https://wordpress.org/plugins/bad-behavior/

https://wordpress.org/plugins/stop-spammer-registrations-plugin/

https://wordpress.org/plugins/wangguard/