Spammer used buddypress direct messages to send spam

Hello @tkserver,

Yes, you are correct, the CleanTalk plugin protects private messages of BuddyPress from spam.
I believe, in you case it was a manual spammer who became trusted somehow.

To make the Anti-Spam Protection stronger, please, do the following:

• Go to WordPress Admin Page → Settings → Anti-Spam by CleanTalk → Advanced settings →
• → set the option “Protect logged in Users” to “On” →
• → set the option “Don’t check trusted user’s comments” to “Off” →
• → enable the options Anti-Flood and Anti-Crawler → Save Changes.
• Go to WordPress Admin Page → Users → Find spam users.

Then clear your website cache. Make sure that the website cache is 24 hours or less.

Additionally, the Stop-Word feature will be useful here too:
https://cleantalk.org/help/stop-word

Did it help you?

Thanks. Most of those settings were already set, except for don’t check trusted and anti-crawler. This user was sending out buddypress messages, but CC’ing multiple users for one message, presumably to get around flooding limits. But he had still sent out over 100 of those, to hundreds of users.

It would be great if you added a flood limit with a configurable daily, or hourly etc limit of messages that can be sent by a user.

I’ve got it set as per your instructions so we will see what happens moving forward. Thanks very much for the response.

Please also don’t forget to enable the ‘BuddyPress Private Messages’ option. Your suggestion is interesting, but this feature is a little bit outside of the plugin’s conception, maybe we will implement this later.

We haven’t received your reply in a few days, so I’m going to mark this topic as “resolved”.
If you have any further questions, you can start a new topic anytime.