I administer a website which does not require users to register. The only user that is needed is the Super User. The problem is that I found a large number of new registered users.

First I want to disable the ability to register new users and delete existing ones, except Super User.

For a start I made some steps, I installed two verification steps in a try to block and delete users.

I faced a problem when I tried to erase or block users, nothing happened without displaying any error.

  • What is the problem you encountered when tried to delete users? Any special error message?
    – FFrewin
    Commented Oct 26, 2015 at 19:00
  • No error showed me. This is the strange. I choose all Users except mine and choose delete, the page is loaded, and then nothing.
    – Vassilis
    Commented Oct 27, 2015 at 7:02
  • hmm, if there are toooo many users listed, then Joomla might preventing you from doing a delete to all together, if you set it to list them "All". Try deleting in bunches of 100. Use the show # of records filter to 100.
    – FFrewin
    Commented Oct 27, 2015 at 7:21
  • I solve the problem. First I choose only the users who is'nt activated and i deleted. Then I block the users who was activeted and then I delete all.
    – Vassilis
    Commented Oct 27, 2015 at 8:16

2 Answers 2


Newer versions of Joomla 3.x disable User Registration by default.

If your version of Joomla was installed before this change, you probably have User Registration enabled.

User Registration can be disabled by setting Users -> Manage -> Options -> Allow User Registration to "No".

You can then delete all users except the Super Administrator account.

  • 2
    Neil thank you versy much. I find the and I disable the Allow User Registration. I found onather problem, I' Couldnt delete a user which is activated.First I need to disable the user and then delete it.
    – Vassilis
    Commented Oct 26, 2015 at 12:50
  • 1
    It's a good idea to also check your 3rd party extensions. I had once installed EasyBlog using a sandbox site (i.e. a temporary hosting account I set up and teardown to test out extensions), and left all the default settings. After a couple of days, I had about 10 spam subscribers to the site - it was an 'out-of-the box vulnerability' of the 3rd party extension that needed special attention to 'lock-down' before going live. I use EasyBlog as an example, but any extension which allows users to register and/post content can inadvertently add vulnerabilities for fake users to register.
    – NivF007
    Commented Jan 8, 2018 at 20:48

Why I find fake/spam registered users in my site…?

The majority of such registrations are coming from botnets, infected machines, script kiddys and generally all kind of bots.

In systems like Joomla, where the location of the user registration form is well known and by default public accessible, it's easy to start filling up and submitting the forms.
Actually in today's internet world, this is something that is happening continuously and in super-high volume in all kind of web-forms (forums, comments, contact forms, registration etc).

- Disable User Registration

There are a few ways to protect a Joomla site against such activities. At first, if you don't need Users to register in your website, you could disable the User Registration, in Users Configuration (Users->options->Allow User Registration set to No).

Security enhancements Tips against Spamming your forms

In addition to this, or in the case you do actually need to have Users Registration enabled, here are some techniques and suggestions to protect your various Joomla forms from spammers, spambots and hackers:

- Enable reCaptcha for user registration

Joomla comes with a native captcha plugin. You can find it inside Plugins, search for: Captcha - ReCaptcha. Inside the plugin there are instructions on how to set it up. You will also need to obtain an API key from https://www.google.com/recaptcha/.
Joomla Documentation on reCaptcha

- Redirect all registrations to Custom Registration form with hidden fields

There are many good Joomla form extensions out there. Many of them provide integration for the user registration. You can build your own custom registration form and add 1 extra hidden field, with a validation against being completed, or by processing the POST data of the form. Your users will never see the hidden field, but bots will try to complete this field as well - but then your validation will fail, or if you are processing the post data, you could redirect to a 403 Forbidden page. For this solution to work completely you will need an extra plugin, that will handle redirection for all registrations to your custom form.

- Joomla Antispam/Security Extensions

Admin Tools, RS- Firewall and there should be more... are extensions that provide thorough firewall protection against this and more security concerns. For example with the Admin Tools pro you can inject hidden fields in all existing forms of your Joomla site and block the IPs from where a submission is coming from. Futhermore Admin Tools provide integration with HoneyPot project and GeoIP blocking features by country, among other features.

JED Links

- Integrate ProjectHoneyPot

Http:BL is a system that allows website administrators to take advantage of the data generated by Project Honey Pot in order to keep suspicious and malicious web robots off their sites. Project Honey Pot tracks harvesters, comment spammers, and other suspicious visitors to websites. Http:BL makes this data available to any member of Project Honey Pot in an easy and efficient way.

There are many software applications that provide ProjectHoneyPot integration. For Joomla some extensions are: Admin Tools Pro and sh404SEF.

- ZBBlock.php by Spambotsecurity.com

Enhance the security of your Joomla application with this free php security script. It is designed to detect certain behaviors detrimental to websites, or known bad addresses attempting to access your site. It then will send the bad robot (usually) or hacker an authentic 403 FORBIDDEN page with a description of what the problem was. It's possible that you might have to make some custom signatures or sign.overrides to make it work exactly for your needs, but it is very effective. Spambotsecurity.com

- Prevent Posts that are not coming from your site in htaccess

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://www.yourwebsite.com [NC]
RewriteRule .* - [F]  

And a reference to a blog post with more ways to blacklisting via htaccess and mod_rewrite. https://perishablepress.com/eight-ways-to-blacklist-with-apaches-mod_rewrite/

- Mod_Security Web Application Firewall.

Well there are so many cool things that you can do on the server level, using mod_security (assuming it is installed on your server). The topic is big and most likely out of the scope of this website. Also, many of the possibilities depend on your hosting type / environment, , so I will post some reference links with further information about mod_security.

- Relative 3rd party software & general server security links

  • Thank you for your answer. I chose as an answer of Neil but yours is more comprehensive and completed is a good recommendation for security of a Joomla site. I will keep her for future reference. Thank you again.
    – Vassilis
    Commented Oct 27, 2015 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.