WordPress MU

Hi there. I installed WP MU some month ago and since the last 5 days I got about 350 spam users registered to my blog. Although I activated the option "No New Registrations" in the admin settings section.

I am using WP not for public use so I deleted all files I don't need and renamed the default theme directory. I deleted all blogs and all users. But it does not stop! New users and new blogs are created every 20 minutes.

What's wrong with my installation? Where can I definitely disable new registrations?

Did you disable signups under Site Admin -> Options? Sounds like you disabled the per blog one, and that's not it.

I am not sure, because I don't have the english version.

It is just Admin > Settings (Einstellungen) and on top of the page it says 'Global Settings ... can't be overwritten by users'. It is in file /wp-admin/wpmu-options.php

I can't find the 'per blog' option.

I just saw that there are 484 rows in the MySQL table wp_signups!
Some are activated and some are not. But in the WP backend no one is displayed.

Do you have bbpress integrated? If so, that's it. They're getting in thru there.

No, I have no bbpress installed. But 6 new spam blogs.

To manage my blogs in different domains, I have installed MU Multi-Site. But that is only for managing the domains and I think it has nothing to do with blogs on these domains!?

If you use a multi *SITE* plugin, then each one of those sites becomes their own MU install where people can sign up for a blog.

Go to EACH one, and disable registrations on ALL of them.

Each blog is set to disable new registrations. But only one seems to be affected a gets all the new blogs/members. Some others had their own spam users, but they are deleted and not coming again.

Any ideas what else could cause this security hole?

Thanks for you help!

"But only one seems to be affected a gets all the new blogs/members. "

Then something on that blog is letting them in. It's not a security hole, it's a wrong setting somewhere.

If you still have a spam *user* on that system, they can create as many spam blogs as they like.

Ok, where should I start to seek? In 'wp_users' (MySQL DB) is only one admin, me. Does this mean, there are no users in other blogs?

The table 'wp_signups' has about 400 entries with blogs and users. What are these signups? And why aren't they displayed in my WP backend?
About the half is flagged with 1 as active.

That is pretty confusing to me.

The table 'wp_signups' has about 400 entries with blogs and users. What are these signups?

Those are the ones creating the spam blogs you're complaining about.

And why aren't they displayed in my WP backend?

Because they're coming in elsewhere.

But only one seems to be affected a gets all the new blogs/members.

Go into the backend of this blog. Go to the Site Admin menu from there. Disable signups.

Go into the backend of this blog. Go to the Site Admin menu from there. Disable signups.

That is what I did last week :-) Everything is disabled, that is why I am wondering how new blogs could be registered.

I am going to delete all entries in wp_signups and see what happens ;)

Looks like deleting all signups was succesfull.
Since yesterday no new registrations came up :-) That's cool.

To get to the end of this ... please can anyone tell me why these user could create new users, although I had disabled they can do so?

Thanks!