WordPress Security for Forums and Community Sites: User Protection Guide

Forums and community sites face unique security challenges due to user-generated content, public registration, and direct user interaction. Protecting both the platform and its members requires comprehensive security measures.

Forum Security Challenges

Community sites face specific threats:

• Spam and automated bot registrations
• User impersonation and account takeover
• XSS through user-generated content
• Private message abuse and phishing
• Harassment and doxxing

Registration Security

Prevent automated and malicious signups:

function secure_forum_registration($user_data) {
    // CAPTCHA verification
    if (!verify_recaptcha($_POST['g-recaptcha-response'])) {
        return new WP_Error('captcha_failed', 'Please complete the CAPTCHA');
    }

    // Honeypot check
    if (!empty($_POST['website'])) {
        log_spam_registration($_SERVER['REMOTE_ADDR']);
        return new WP_Error('spam', 'Registration rejected');
    }

    // Rate limit by IP
    $ip = $_SERVER['REMOTE_ADDR'];
    $key = 'forum_reg_' . md5($ip);
    $recent = get_transient($key) ?: 0;

    if ($recent > 2) { // 2 registrations per day
        return new WP_Error('rate_limit', 'Registration limit exceeded');
    }

    set_transient($key, $recent + 1, DAY_IN_SECONDS);

    // Check for known spam patterns
    $email = $user_data['user_email'];

    if (is_disposable_email($email)) {
        return new WP_Error('invalid_email', 'Please use a permanent email address');
    }

    // Username validation
    $username = $user_data['user_login'];
    $bad_usernames = array('admin', 'moderator', 'support', 'staff');

    if (in_array(strtolower($username), $bad_usernames)) {
        return new WP_Error('reserved_username', 'This username is reserved');
    }

    return $user_data;
}
add_filter('wpmu_validate_user_signup', 'secure_forum_registration');

Content Sanitization

Prevent XSS in user-generated content:

function sanitize_forum_post($content) {
    // Allowed HTML tags for posts
    $allowed_tags = array(
        'p' => array(),
        'br' => array(),
        'strong' => array(),
        'em' => array(),
        'a' => array('href' => array(), 'title' => array(), 'rel' => array()),
        'ul' => array(),
        'ol' => array(),
        'li' => array(),
        'blockquote' => array(),
        'code' => array(),
        'pre' => array(),
        'img' => array('src' => array(), 'alt' => array()),
    );

    $content = wp_kses($content, $allowed_tags);

    // Sanitize URLs in links
    $content = preg_replace_callback(
        '/href=["\']([^\"\']+)["\']/i',
        function($matches) {
            $url = esc_url($matches[1]);
            if (empty($url)) {
                return 'href="#"';
            }
            return 'href="' . $url . '" rel="nofollow ugc"';
        },
        $content
    );

    // Block javascript: URLs
    $content = preg_replace('/javascript:/i', '', $content);

    return $content;
}
add_filter('bbp_new_reply_pre_content', 'sanitize_forum_post');
add_filter('bbp_new_topic_pre_content', 'sanitize_forum_post');

Private Message Security

Protect private messaging system:

function validate_private_message($message_data) {
    $sender_id = get_current_user_id();
    $recipient_id = $message_data['recipient'];

    // Check if sender is banned
    if (is_user_banned($sender_id)) {
        return new WP_Error('banned', 'You cannot send messages');
    }

    // Check if recipient blocked sender
    if (has_user_blocked($recipient_id, $sender_id)) {
        // Silently fail - do not reveal block status
        return new WP_Error('failed', 'Message could not be sent');
    }

    // Rate limit messages
    $key = 'pm_sent_' . $sender_id;
    $sent_count = get_transient($key) ?: 0;

    if ($sent_count > 20) { // 20 messages per hour
        return new WP_Error('rate_limit', 'Message limit reached. Try again later.');
    }

    set_transient($key, $sent_count + 1, HOUR_IN_SECONDS);

    // Scan for spam patterns
    $content = $message_data['content'];

    if (contains_spam_patterns($content)) {
        flag_user_for_review($sender_id, 'Suspicious PM content');
        return new WP_Error('spam', 'Message rejected');
    }

    return $message_data;
}

// Block revealing user email in PMs
function redact_emails_in_content($content) {
    return preg_replace(
        '/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/i',
        '[email removed]',
        $content
    );
}

Reputation System Security

Prevent reputation manipulation:

function validate_reputation_vote($voter_id, $target_id, $post_id) {
    // Prevent self-voting
    if ($voter_id === $target_id) {
        return new WP_Error('self_vote', 'Cannot vote on your own content');
    }

    // Check if already voted on this post
    $existing = get_user_vote($voter_id, $post_id);

    if ($existing) {
        return new WP_Error('already_voted', 'Already voted on this content');
    }

    // Rate limit voting
    $key = 'votes_cast_' . $voter_id;
    $votes = get_transient($key) ?: 0;

    if ($votes > 50) { // 50 votes per hour
        return new WP_Error('rate_limit', 'Voting limit reached');
    }

    set_transient($key, $votes + 1, HOUR_IN_SECONDS);

    // Check account age
    $user = get_user_by('id', $voter_id);
    $account_age = time() - strtotime($user->user_registered);

    if ($account_age < (7 * DAY_IN_SECONDS)) { // 7 day minimum
        return new WP_Error('new_account', 'Account too new to vote');
    }

    // Detect ring voting patterns
    if (detect_vote_manipulation($voter_id, $target_id)) {
        flag_users_for_review(array($voter_id, $target_id), 'Vote manipulation');
        return new WP_Error('manipulation', 'Suspicious voting pattern detected');
    }

    return true;
}

User Profile Protection

Secure user profile information:

function filter_profile_fields($fields, $user_id) {
    // Remove sensitive fields from public view
    $private_fields = array('email', 'phone', 'address', 'birthday');

    foreach ($private_fields as $field) {
        if (isset($fields[$field])) {
            // Check privacy settings
            $privacy = get_user_meta($user_id, $field . '_privacy', true) ?: 'private';

            if ($privacy === 'private' && get_current_user_id() !== $user_id) {
                unset($fields[$field]);
            }
        }
    }

    return $fields;
}

function validate_profile_update($user_id, $data) {
    // Verify ownership
    if (get_current_user_id() !== $user_id && !current_user_can('edit_users')) {
        return new WP_Error('unauthorized', 'Cannot edit this profile');
    }

    // Sanitize bio
    if (isset($data['bio'])) {
        $data['bio'] = wp_kses($data['bio'], array(
            'p' => array(),
            'br' => array(),
            'a' => array('href' => array()),
        ));

        // Limit length
        if (strlen($data['bio']) > 500) {
            $data['bio'] = substr($data['bio'], 0, 500);
        }
    }

    // Validate avatar upload
    if (isset($_FILES['avatar'])) {
        $allowed = array('image/jpeg', 'image/png', 'image/gif');
        $file_type = $_FILES['avatar']['type'];

        if (!in_array($file_type, $allowed)) {
            return new WP_Error('invalid_avatar', 'Invalid image format');
        }

        if ($_FILES['avatar']['size'] > 500000) { // 500KB
            return new WP_Error('avatar_too_large', 'Avatar must be under 500KB');
        }
    }

    return $data;
}

Moderation Queue Security

Secure the moderation system:

function log_moderation_action($action, $content_id, $moderator_id, $reason) {
    global $wpdb;

    $wpdb->insert('moderation_log', array(
        'action' => $action,
        'content_id' => $content_id,
        'moderator_id' => $moderator_id,
        'reason' => sanitize_textarea_field($reason),
        'ip_address' => $_SERVER['REMOTE_ADDR'],
        'created_at' => current_time('mysql'),
    ));

    // Alert on unusual moderation patterns
    $recent_actions = $wpdb->get_var($wpdb->prepare(
        "SELECT COUNT(*) FROM moderation_log
         WHERE moderator_id = %d
         AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)",
        $moderator_id
    ));

    if ($recent_actions > 50) {
        wp_mail(
            get_option('admin_email'),
            'High moderation activity alert',
            sprintf('Moderator %d performed %d actions in 1 hour', $moderator_id, $recent_actions)
        );
    }
}

// Require reason for user bans
function require_ban_reason($user_id, $reason, $duration) {
    if (strlen($reason) < 10) {
        return new WP_Error('reason_required', 'Please provide a detailed reason');
    }

    // Log the ban
    log_moderation_action('ban', $user_id, get_current_user_id(), $reason);

    // Notify user
    $user = get_user_by('id', $user_id);
    wp_mail(
        $user->user_email,
        'Account Suspension Notice',
        sprintf('Your account has been suspended for: %s', $reason)
    );

    return true;
}

Conclusion

Forum security requires robust registration controls, content sanitization, private message protection, reputation system safeguards, and comprehensive moderation logging. Regular monitoring helps identify and address abuse patterns before they escalate.