I am facing quite a problem with spam-bots, and could really use some advice. My WP website/phpBB forum uses a WordPress to phpBB bridge, to allow integration of users/registration from phpBB to WordPress. I have disabled registration from WordPress entirely and kept registration through phpBB.

Somehow I am constantly getting spam registrations, After examining the MySQL database I noticed the user entries do not include an email address or password. How is it possible for a spam-bot to bypass the required fields or register without providing an email or password? Is this a sign of malicious code or SQL injection? I have run several security plugins for WordPress, which did not detect anything.

I would very much appreciate any help or advice on how and where to begin to address this issue.

Many Thanks, Sam

  • I don't have a solution, but just wanted to say that back when I ran phpBB board, I was constantly inundated with hundreds of spam accounts - far more than the cumulative total I've come across in 6 years of working with WordPress. This in mind, and the fact that your phpBB installation alone is handling registration, I'd wager the problem's on the phpBB end. Even if WordPress plugins don't believe WordPress to be compromised, it doesn't mean phpBB isn't. I'd start by tightening up phpBB security. Also check out the security of the user bridge you're using
    – bosco
    Mar 23, 2017 at 22:08
  • @bosco I feel so too, however since a user added to either database, WordPress or phpBB, results in an email being sent for approval by the admin, so far no harm has been done other then clutter my inbox, and make it harder for me to approve the authentic users, but what is baffling to me is how can a user be added on either without providing an email or password, without direct access to the database to add these bogus users. Thankyou for your suggestion, guess i should explore both sides, actually considering moving to BBpress, managing two databases is not fun.
    – Samwyzz
    Mar 23, 2017 at 22:23
  • What are you using as the actual bridge? I'd be curious to take a look at it myself. It is strange - the phpBB function to add a user definitely requires a email, and the WordPress function to add one definitely requires a password. I feel like the bridge might be directly interacting with the db. Do you use a Captcha as a part of your registration form?
    – bosco
    Mar 23, 2017 at 22:34
  • @bosco The plugin is bridgeDD (non pro which only supports phpbb 3.0x), pretty amazing plugin from the author, I use image captcha and users have to be manually approved, on phpBB, i dont suspect the bridge or phpbb in truth, since the spam users do not show up on the phpbb database and only in the wordpress database.
    – Samwyzz
    Mar 23, 2017 at 22:49
  • It does look to be a neat plugin! Do users have to be manually verified before they are added to the phpBB db as well? Another thought occurred to me. I haven't dug into the plugin yet, but if we can determine where users are actually added to the database, you could log a stack trace at that point, which would give some idea as to how the spambot user-data entered the system - or potentially indicate more direct database interaction if traces don't log for the spambot registrations. A good place to try this would be on the user_register hook - write the user ID and stack trace to a file.
    – bosco
    Mar 23, 2017 at 23:19


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.