WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many users with strange names, register on my blog, but don't leave comments. Should I be afraid, that this might be attack of some sort. Maybe someone found some sort of bug in Wordpress which allows to penetrate security?

Are there any actions I should take?

share|improve this question
up vote 5 down vote accepted

Spam bots will always try to register. They basically just input data into any form they can find in hopes it will pull their URL on to your page so they can build trackbacks and score higher in Google rankings.

There are a couple of things you can do to prevent this:

  1. If you don't need people to register for your site (most don't) just turn off new user registration.
  2. Install a captcha plugin for your registration form. It won't catch everything, but it should decrease the number of bogus registrations you're seeing. A good one I've heard of is Sabre.

You might also want to read this good article by Lorelle discussing anti-spam techniques with WordPress. It's from 2007, but the tools and tips are still very relevant.

First things first, though, would be to delete these bogus users from your database. All they are is clutter ... if they're not real people, they don't need to be there in the first place.

share|improve this answer
thnx. You answerd my question with good details. I would mark your answer as useful, but I can't do that at the time. My reputation is low. Still thnx. – Eugene Sep 21 '10 at 13:37
Sometimes the bots will even register a legit looking account and post a real-looking comment, just to see if you CAN register and comment. Then about a week later, all hell breaks loose. – Dan Gayle Sep 22 '10 at 16:07
That's why interacting with your commenters is so important ... if they respond and interact back, probably a real person. If they just continuously post "I really enjoyed this article" then they're probably a bot ... Akismet catches a lot of spam comments, but its a good idea to keep registration closed just in case. – EAMann Sep 22 '10 at 16:19
I have same issue and it seems they are doing what Dan Gayle said. except in my case they don't post comment. perhaps because I put captcha even for registered users and for the registration form. still it is weird that every now and then I have new user registration even though my site has no much traffic. – Dreaded semicolon Jan 28 '12 at 5:09
  • Are there any known vulnerabilities, related to registration? Not currently and not for low privilege accounts in the past.

  • Is it good idea to require registration for comments alone? No, as for me that only gives spam bots more ways to abuse your resources.

  • Why are they registering exactly? Who knows. Spam bots do a lot of strange things.
share|improve this answer
thnx. Did you do explode() function on my question :) – Eugene Sep 21 '10 at 13:38
@Eugene I just had trouble putting my answer together coherently... Doing it in parts helps in such cases. :) – Rarst Sep 21 '10 at 13:44
I don't have anything against it. Just a bit funny. – Eugene Sep 21 '10 at 14:14

Ban Hammer is a great plugin that checks new registrations against a know list of spammy domains, then disallows registrations with emails from those domains.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.