Support

You do not need to have a menu item to the Users component, or a user module, in the frontend. You can always display Joomla's user page by visiting index.php?option=com_users&Itemid=999999999. If you allow user registration on your site there will be a link to register users. This means that spam user registrations by bots will, indeed, take place.

The first line of defence should be to set up a CAPTCHA for the user registration page. Set up the CAPTCHA plugin you want in System, Manage, Plugins. Then go to Users, Manage, Options, User Options and select it in the Captcha drop-down. This will kill most spam user registrations.

For those remaining, remember that they will not be active users if the New User Account Activation option in the Users component (Users, Manage, Options, User Options) is set to anything other than None. Yes, even though your site will send an email when it's set to "Self", the bots which try to create spam user accounts can't interact with that email, if that email address is even correct to begin with. This means that the spam user accounts you get are inactive, therefore you can use a Scheduled Task with Admin Tools to remove them.

Go to System, Manage, Scheduled Tasks. Make sure that Scheduled Tasks will be running. Since there is no Joomla documentation on that, please refer to ours: https://www.akeeba.com/documentation/admin-tools-joomla/php-file-scanner-joomlascheduled.html 

You can now create a new scheduled task. Click on New in the toolbar and select the "Admin Tools - Delete Inactive Users" type. If you don't see it, please make sure the "Task - Admin Tools" plugin is enabled.

You can now set up the scheduled task. I recommend the following options.

• Delete inactive users: Only if they haven't activated their account.
• Delete after this many days: 7

This will wait for a user to activate their account for 7 days. If this does not happen, the user account will be deleted. DO NOT set this to anything below 3 days! Remember that VirtueMart might not activate a user account before the payment goes through, which can take a few days to take place. You don't want to delete the user account (and the associated transaction information!) while the payment is pending.