2

We look after a bunch of WordPress sites none of which run themes which involve public participation. So basically the setting Membership - anyone can register is always turned off.

I have just taken a look at one particular site and found a few dozen mystery subscribers in the user list. Checking the settings I find this site is has anyone can register turned on.

Easy enough to delete them and fix the setting.

A couple of questions however:
1) Should I check anything else apart from deleting the new users and fixing the setting?
2) What do these (presumably spam) subscribers get out of the deal? They get no access to the site, as I understand it, and no eyeballs on any spam they might want to push.

Incidentally, this site is running an up-to-date version of WordPress.

  • I you had "anyone can register turned on" there was nothing stopping someone registering in the site through yoursite.com/wp-login.php?action=register. Where is the problem? – cybmeta Dec 26 '14 at 19:09
  • @cybmeta i dont think i have a problem. i have 2 questions as above – hawbsl Dec 31 '14 at 12:11
  • For future questions, there is "one question per thread" rule in this site. Anyway your two questions have not one answer: what they get? Ask them, impossible to know. Anything else you have to check? I don't think so, but it depends on your site, plugins and themes you may have installed, server characteristics and configuration, .... – cybmeta Dec 31 '14 at 12:19
1

I'll try to answer even though the questions are a bit generic:

1) Should I check anything else apart from deleting the new users and fixing the setting?

When deleting a user from the admin, WordPress asks you if you want to keep or delete any associated post for that user. Independently from that, it also takes care of cleaning up the database (like removing user settings etc). So no, you don't need to do anything else.

2) What do these (presumably spam) subscribers get out of the deal? They get no access to the site, as I understand it, and no eyeballs on any spam they might want to push.

Most of the time they are just "random automated attacks" to gather as much information as possible, like the installed WordPress version, checking the existence of email addresses, having the ability to post comments etc...

protected by Community Jan 6 '17 at 10:24

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.