Spam registrations and genuinely orphaned accounts (created once and never used, from a plugin that no longer exists, or left behind by an old integration) accumulate quietly on most sites, and clearing them out is straightforward — but if what you’re actually seeing is one specific account you don’t recognize alongside other signs something’s wrong, that’s a different, more serious situation than routine cleanup.
Distinguish routine spam from a genuine, unexplained account
Spam registrations typically arrive in batches, with obviously fake or randomly generated email addresses, and no genuine activity attached. A single administrator or editor-level account you don’t recognize, especially one with real activity or elevated access, is a different situation — read the caution below before treating it as routine.
Orphaned user & spam registration purge
Spam and orphaned accounts cleared out — with a real, unexplained account flagged separately, not swept in.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Admin access to review the current full user list
- Confirmation of who legitimately should have an account, at least roughly
- Your tolerance for us flagging borderline cases versus removing anything clearly spam automatically
This or something else?
| You have a buildup of spam registrations or clearly unused, orphaned accounts to clear | This fix covers it |
| You found one specific admin or editor account you don’t recognize, with real access | Read the caution above — this may be a security matter, not routine cleanup, and worth describing to us directly first |
| You want to import a known, legitimate list of users instead | Bulk user import from supplied CSV |
| You want the underlying registration process fixed, not just the resulting accounts cleaned up | User registration flow errors |
What we do
- Review the current user list for obvious spam and orphaned accounts
- Flag anything ambiguous or potentially significant for your confirmation before removal
- Remove confirmed spam and genuinely unused accounts
- Check for any content, orders, or activity tied to removed accounts, so nothing important is silently lost
- Recommend registration-level protections (like a honeypot or CAPTCHA) if spam volume suggests it’s worth addressing at the source
- Provide a written summary of what was removed
What is included
- Confirmed spam and orphaned accounts removed
- A check for any activity or content tied to removed accounts
- A written summary of what was cleaned up
- A recommendation on reducing future spam registrations, if relevant
Not included
- Investigating an account that shows signs of being a genuine security concern rather than routine spam — flagged separately, not treated as standard cleanup
- Fixing the underlying registration flow itself, a separate, related fix
- Setting up spam prevention measures beyond a recommendation, a separate fix if you want it implemented
- Ongoing, scheduled cleanup as a standing service
Questions about this fix
How do I tell spam accounts from something more serious myself before you look?
Spam registrations tend to arrive in bulk with obviously fake details and no real activity; a single, active-looking account with real access that you simply don't recognize is worth flagging to us specifically rather than assuming it's routine.
Will removing these accounts delete anything important, like an order history?
We check for exactly this before removing anything — if an account has associated orders or content, we flag it rather than deleting silently, since that's not routine spam cleanup at that point.
Why do spam registrations keep happening in the first place?
Usually automated bots targeting an open registration form — if the volume is high, we can recommend a low-friction prevention measure rather than only cleaning up after the fact each time.
Is it safe to just delete everything that looks unfamiliar?
Not without a quick check first — an unfamiliar account isn't automatically spam, and we'd rather flag genuine ambiguity than remove something that turns out to matter.
Should I be worried if I find a lot of these accounts?
A large volume of obvious spam registrations is common and not itself alarming; it's the presence of one specific, active, unexplained account with real access that's worth taking more seriously.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.