Descripción
DGN Webs Spam User Cleaner scans your WordPress users and identifies likely spam registrations using a multi-signal scoring engine — no external API required for the core features.
Every email address is scored across multiple heuristic signals. Users scoring above your chosen minimum threshold appear in a reviewable list. You decide who to delete — nothing is removed without your confirmation.
Core Features (Free)
- Multi-signal spam scoring — blacklisted domains, invalid email format, Gmail abuse patterns (starts with number, long digit sequences, excessive dots), bot-generated usernames (consecutive consonant clustering, unseparated long strings), random alphanumeric patterns, no vowels, very short usernames
- Never-logged-in flag — optionally add +3 score to users who have never logged in
- Minimum score threshold — slider from 1–20, users below the threshold are excluded from results
- Excluded emails whitelist — protect known-good users from ever appearing in scan results
- Batch scanning — processes 1,000 users per batch, works on sites with hundreds of thousands of users
- Real-time progress bar — scan and deletion progress displayed live
- Domain filter with Only / Except toggle — show or exclude a specific email domain
- Reason filter chips — filter results by any combination of detection reasons
- Score badges — colour-coded Low / Medium / High / Critical
- Bulk selection — select current page or all results across all pages
- Deletion with content reassignment — all content (posts, comments) is safely reassigned to an admin before deletion
- Protected roles — Administrators and Editors can never appear in scan results or be deleted
- CSV export — download the full result set
- Presets — Cautious, Balanced or Aggressive, with optional custom settings
- Safe users — mark genuine users so they are never flagged or deleted
- Comment check — flags users whose comments contain spam links, promotions or repeats (local heuristics, no external service)
- Recent activity — log of your last scans and deletions
- Automatic backup — a CSV of the selected users is downloaded before they are deleted (optional)
Privacy & External Connections
This plugin performs no external connections. MX record validation uses PHP’s built-in checkdnsrr function — a standard DNS query. No user data is sent to any third party. To support the never-logged-in option, the plugin stores a login timestamp in its own user meta key (dgnwebs_last_login) each time a user logs in, and stores your safe-user list and recent activity log in the options table; all of it stays in your database.
Capturas
Instalación
- Upload the
dgn-webs-spam-user-cleanerfolder to/wp-content/plugins/ - Activate the plugin through the Plugins menu in WordPress
- Go to Spam Cleaner in the main admin menu
- Select the user roles to scan
- Set your minimum spam score threshold (default: 3)
- Optionally add known-good email addresses to the Excluded Emails list
- Click Scan Now and review the results before deleting
FAQ
-
Will scanning or deleting break my site?
-
Scanning is completely read-only — it only reads user data, nothing is changed. Deletion reassigns all content (posts, comments) to a site administrator before the user is removed, so nothing is lost.
-
Can it accidentally delete real users?
-
The scoring engine flags likely spam but requires your review before anything is deleted. Every flagged user is shown with their score and the specific reasons they were flagged. You select who to delete. Administrators and Editors are permanently protected and can never appear in results. Use the Excluded Emails list to protect any other known-good users.
-
How many users can it handle?
-
It scans in batches of 1,000 users at a time, so it handles sites with tens or hundreds of thousands of users without timing out. The progress bar shows real-time scan status.
-
Does it work with WooCommerce?
-
Yes. The Customer role can be included in scans. Deleting a WooCommerce customer does not delete their orders — orders remain intact in WooCommerce.
-
Does this plugin send my users’ email addresses to an external server?
-
No. All checks run entirely on your WordPress server. MX record lookups use standard DNS queries — the same technology your server uses for all internet communication. No email addresses are transmitted to any external service.
-
Is this plugin compatible with multisite?
-
The plugin is designed for single-site installations. Multisite support is planned for a future release.
Reseñas
Colaboradores y desarrolladores
«DGN Webs Spam User Cleaner» es un software de código abierto. Las siguientes personas han colaborado con este plugin.
Colaboradores
Traduce «DGN Webs Spam User Cleaner» a tu idioma.
¿Interesado en el desarrollo?
Revisa el código , echa un vistazo al repositorio SVN o suscríbete al registro de desarrollo por RSS.
Registro de cambios
1.1.0
- New: scan presets — Cautious, Balanced and Aggressive — so you don’t have to tune every option. A «Use custom options» panel lets you set the minimum score, never-logged-in and comment checks yourself (presets are ignored while it’s open)
- New: Mark as safe — confirm a genuine user from the results (one at a time or in bulk) and they are never flagged or deleted again. Manage the list under «Safe Users»
- New: comment check — users’ comments are checked for spam-flagged comments, multiple links, link-only comments, promotional wording, generic «nice post» comments with links, and repeated comments
- Change: the plugin now has its own Spam Cleaner item (with an icon) in the main admin menu instead of living under Tools. The old Tools link redirects automatically
- New: Recent Activity — a simple log of the last 20 scans and deletions
- Improve: users marked as safe are also protected on the server, so they cannot be deleted even if selected
1.0.8
- Fix: replaced str_contains() with strpos() so the plugin stays compatible with WordPress 5.8 (the minimum supported version)
1.0.7
- New: automatic CSV backup — before users are deleted, a CSV with ID, username, email, display name, registration date, roles, website and last login is downloaded (on by default, can be unchecked)
- Security: the scan action now checks user capabilities, matching the delete and settings actions
- Fix: scan batches are now ordered by user ID so users are never skipped or repeated between batches
- Fix: «Flag users who have never logged in» now records logins from this version onward (plugin’s own user meta key) and also honours the common «last_login» key and active sessions, so it no longer flags every user on sites without a login tracker
- Improve: all request input is unslashed and sanitized; CSV exports now quote every field and neutralise spreadsheet formulas
- Tested up to WordPress 7.1
1.0.6
- Tested up to WordPress 7.0
- Fix: excluded emails textarea placeholder no longer shows extra blank lines, so the example text fits in view without expanding the box
- Fix: delete icon on the «Delete Selected» button now shows in white to match the button text on its red background, including on WordPress 7.0 where a new core admin rule was overriding it with the admin theme color
- Fix: search icon on the «Scan Now» button no longer fades into its own background on WordPress 7.0, caused by the same new core admin rule
- Improve: «Random alphanumeric» scoring no longer flags common name+trailing-number usernames (e.g. «jasdeep2008», «sarah.doe2001») — only genuinely interleaved letter/digit patterns are flagged
- Improve: a trailing birth-year suffix (e.g. «2008», «97») is now recognized and exempted from the «Gmail long digits» and «Ends with number» checks, since it’s one of the most common legitimate Gmail signup conventions
1.0.5
- Remove ACTIVATE.txt (leftover from pre-approval development, not applicable to this version)
1.0.4
- All detection features (disposable domain, MX validation, role-based) are now fully free with no restrictions
- Removed license system to comply with WordPress.org guidelines
- Simplified admin UI — single settings panel, no license tab
- Status badges (Invalid / Risky) now shown for all users
1.0.3
- Plugin renamed to DGN Webs Spam User Cleaner with slug dgn-webs-spam-user-cleaner to comply with WordPress.org naming guidelines
1.0.2
- Plugin renamed to comply with WordPress.org naming guidelines
- All function, constant, and option names updated to use the dgnwebs_ prefix
- Plugin URI updated
1.0.1
- UI: Tabs redesigned to classic folder style
- UI: Scan Settings and Add-on/License split into tabs — upsell less dominant
- UI: Scan Now footer hidden when Add-on tab is active
- UI: Filter Logic toggle switch replaces OR/AND radio buttons
- UI: Page scrolls to status card automatically when scan starts
- Fix: Unescaped colspan output hardened with absint()
- Fix: User IDs in delete handler sanitized with array_map( absint )
- Fix: Domain Path header removed from plugin header (no translations yet)
- Fix: Tested up to updated to 6.9
1.0.0
- Initial public release
- Multi-signal heuristic scoring engine
- Batch scanning with real-time progress
- Domain filter with Only / Except toggle
- Reason filter chips
- Excluded emails whitelist
- CSV export
- DGN Webs Spam User Cleaner add-on integration (disposable domains, MX validation, role-based detection)