[w-sky]

Hello, recently I have noticed that I have many, probably hundreds of fake user accounts on my website, where the only thing they did was creating an user profile with spam text including one or more links as “Biographical Info”.

Because they refrain from posting additional spam comments or spam forum posts (or because these are prevented by our spam blocker), they remain very unnoticed. But all the profile pages with their spam text exist on our site and I would like to do two things:

1. Remove spam profiles
2. Preventing this from happening again

As far as I can see they are not indexed by Google. The “../forum/user/*” tree is not included in our sitemap by Yoast, which is good.

Does anyone have an idea how to deal with this?

[Robin W]

I presume you have ‘anyone can register’ ticked in :

dashboard>settings>general>membership – that will let anyone join, and at that stage you cannot know if they are real or not, so no automatic way to prevent.

I’d suggest you move to a closed registration, so that you can manually join people.

as for getting rid of those in there – you would need some code which would look for all users who have not made a forum post, but this might delete genuine users, so without a forumla to work out who is real or not, it would be hard to code/

[w-sky]

Yes sure, that could help. We had decided once that we want user registrations as quick and easy as possible. Earlier we even allowed anonymous comments but of course, that generated too much spam in forums and comments.
Maybe I will try a captcha on the registrations page. We had Google ReCaptcha once, but can not use it any more because it does not comply with EU-GDPR.

If we could filter all “subscriber” users who have not published any comment or forum post, that would probably list exactly all of those kind of spammers, as well as “dead” users who can be deleted too. I am working on that.

[Robin W]

this might hep

https://pmgarman.me/delete-users-without-posts-from-wordpress/

bbpress just uses worpdress posts, so it should work.

BUT ensure you can restore if it does something funny !!

[jonearthur123]

https://pmgarman.me/delete-users-without-posts-from-wordpress/

This might help