Mass delete spam accounts

Question

Bots are ever so slowly taking over our existence and even the greatest captcha or guard will fail at points. This may result in a high amount of spam accounts that needs to be deleted.

Removing these manually via wp-admin is painful. Any way to quickly remove these?

Answer 1

Yes. There are a variety of ways to do this, primarily, we'll need to tackle the wp_delete_user() function.

Your first task, and the tricky one, is to identity which accounts are spam, and which are real. This can be quite an adventure if your site gains new users regularly.

With the following example, we target two values, the user's email account and meta_data.

In this case, we have an idea if it's a spam account by interpreting the email address. So let's add a list in an array:

$emails = array(
    '[email protected]',
    '[email protected]',
    '[email protected]',
);

Then we have a custom user meta data named points:

$meta_key = 'points';

And in our case, we know that if the meta key value is 10, then it is definitely a spam user. So we set the value:

$meta_key = 10;

Now let's put it together into a function:

function wpse_delete_users_by_email($emails, $meta_key, $meta_value) {

    if (!is_array($emails)) return;

    foreach ($emails as $email) {

        // get user data via email
        $user = get_user_by( 'email', $email );
        $user_id = $user->ID;
        $user_email = $user->user_email;

        // get
        $meta_data = get_user_meta($user_id, $meta_key, TRUE);

        // if meta data equals the meta value
        if ($meta_data == $meta_value) {

            // confirm that emails match
            if ($user_email == $email) {

                // must include this, or it will throw a 'call to undefined function' error
                require_once(ABSPATH.'wp-admin/includes/user.php' );

                // delete spam user
                wp_delete_user( $user_id );

                // display results
                echo '<br>' . $email;

            }

        }

    }

}

Simple stuff, but sometimes when dealing with spam and bots, one less headache can be valuable.

Answer 2

// ----------------------------------------------------------------------------
// ------------------------------------- Plugin for WordPress -----------------
// -------------------------- Standalone file PHP "clear_spam_users.php" ------
// ----------------------------------------------------------------------------
// ----------------------------------------------------------------------------
// -------------------------------------- By HelpSet.ru 2024 ------------------
// ----------------------------------------------------------------------------
// --------------------------- Add this filename in CRON start at 0:01 AM -----
// ----------------------------------------------------------------------------

ini_set('log_errors', 0);
ini_set ('display_errors', 0);
error_reporting (E_PARSE);
setlocale(LC_CTYPE, 'ru_RU');

// Удаляет СПАМ-пльзователей у которых 0-записей ==============================
$DBHost = "localhost";
$DBLogin = "user_login_db";
$DBPassword = "1234567890";
$DBName = "data_base_name";
$db = mysqli_connect($DBHost, $DBLogin, $DBPassword, $DBName);
mysqli_query($db, "SET NAMES utf8");
    
    // Узнаём последний id нового пользователя ----------------------------
    $queri = mysqli_query($db, "SELECT MAX(`ID`) FROM `wp_users`");
    ini_set('display_errors', 'Off'); ini_set('log_errors', 'Off');
    $rows_id_author = mysqli_fetch_array($queri, MYSQLI_BOTH);
    $id_author = ($rows_id_author[0]);
    // echo "id_author:".$id_author."<br>"; // test output

    // Прогоняем обратный цикл от последнего пользователя к первому -------
    for ($ii = $id_author; $ii > 1; $ii--)
    {
        // Проверяем был ли хоть оидн пост от всех пользователей ----------
        $querm = mysqli_query($db, "SELECT * FROM `wp_posts` WHERE `post_author`='".$ii."' ORDER BY `post_author`");
        ini_set('display_errors', 'Off'); ini_set('log_errors', 'Off');
        $rows_post_author = mysqli_fetch_array($querm, MYSQLI_BOTH);
        $post_author = ($rows_post_author['post_author']);
        // echo "id_post_author:".$ii." post_author:".$post_author."<br>"; // test output
        
        // Если постов не было, а пользователь такой имеется, то -----------
        if($post_author=="" && $ii!=$post_author)
        {
            // Удаляем пользователя у которого не было ни одного поста -----
            mysqli_query($db, "DELETE FROM `wp_users` WHERE `ID`='".$ii."' LIMIT 1");
            ini_set('display_errors', 'Off'); ini_set('log_errors', 'Off');
        }
    }

Original PHP-code: Remove SPAM from WP users in PHP