Hi TallSam,
Securing your user base should always be taken seriously. Personally I’m using TML (Theme my login) with the recaptcha and the security options activated. Then I also use wangguard to check for sploggers.
Pascal.
I’m trying TML. I was hoping they couldn’t enter a password when the sign up, but doesn’t seem to work that way. Instead, they have to request a password reset. But even then, I get an error saying the link for the password reset is invalid. How does this work for you?
I would have thought giving users a password for their registration would be of foremost importance seeing as they can’t do anything without it… I’m suprised bbpress doesn’t manage this without a plugin such as TML…
As far as security, I’m using WP-Spamshield which seems to be doing pretty good, no more spam registrations. Perhaps I should use wangguard in addition to this? Or maybe as a better alternative?
Thanks,
Sam
@tallsam
Users should have a password when they register??
Post a link to your site and I will test out registering with it. My username will be called “deleteme” if you decide later to remove the user I registered with.
Tried to register. See this message below.
A password will be e-mailed to you.
I just haven’t gotten the email that shows my login information. I did get some newsletter from your site.
Can’t tell if there is some next step that you may have to do that has been added from a plugin like manually approving me, or your server is having an issue sending emails.
The newsletter is via mailpoet, but even when I deactivate mailpoet, still no email is sent.
Maybe its a jetpack thing?
Any suggestions or maybe you can think of another forum I might ask?
Thanks,
Sam
MIght not be a Jetpack thing, but if your users do sign in with their wordpress.com account through the single sign on, they do not need a password, they just keep pressing the single sign on button.
Since it is mailpoet, then that does not use an external service if I remember correctly. So no problem with your host sending emails.
You can check right now to see if I am visible in your users section in Users > All Users, just search “deleteme”. See if you can see an approve link or something similar by user in the list.
You can also try to create an account with a separate email that you have currently for your site, with only Jetpack and bbPress activated first, and see if you get your email with your login information. I found the newsletter email in my spam folder, you may need to check there for the login information email.
I’ll try disabling all my plugins sometime in the next few days, don’t want to risk messing anything up at the moment.
In the meantime, I’ve asked the jetpack guys if they have any thoughts, we’ll see what they say…
Thanks,
Sam
Yeah it is not really Jetpack’s issue at all. Since I see this topic, it seems like your issue is resolved now.
https://wordpress.org/support/topic/password-reset-link-appears-to-be-invalid?replies=7
Theme My Login solved it by letting users enter a password imediately when they log in. However, they still seem to get an email telling them to reset their password, which then gives them an error. I’m trying to figure out how to stop this email from going out… Any thoughts?
Thanks,
Sam
Did you activate moderation on TML and set it to none ?
Pascal.
Hi Pascal,
I just tried that, handy, but still sends the email: “To set your password, visit the following address:”
I’ve searched it and it sounds like it may be a bug or something, but no answers I understand…
Thanks,
Sam
