# Disable unverified users to create topic
**URL:** https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508
**Category:** Support
**Created:** [July 26, 2024, 6:12am UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508 "2024-07-26T06:12:09Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 6:12am UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/1 "2024-07-26T06:12:09Z")
Hi, I have problem dealing spam accounts, they are created through local accounts, If I look into one spam account, it says primary email `not verified`, I want to disable this kind of accounts to create a new Topic until they verify their email, how to achieve this?
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 7:54am UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/2 "2024-07-26T07:54:32Z")
I dont know if this setting will help deleting unverified users
`purge_unactivated_users_grace_period_days`
setting this to 0 will allow unactivated users forever? it seems entirely opposite of what this field is for.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 7:57am UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/3 "2024-07-26T07:57:26Z")
If their emails aren’t verified then they shouldn’t be allowed to post. Are they staged users? (That is, do you allow anonymous users to email in?)
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 8:07am UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/5 "2024-07-26T08:07:01Z")
> That is, do you allow anonymous users to email in?
how to check this? there is a settings `enable staged users` which says `Automatically create staged users when processing incoming emails.` and it is checked. is this what you are asking?
This is how that spam account permission looks right now.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 8:48am UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/6 "2024-07-26T08:48:54Z")
It doesn’t look like that’s a staged user.
I’m not sure how people are logging into your site with an unactivated account. Do you have any special login methods?
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 1:07pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/8 "2024-07-26T13:07:48Z")
> Do you have any special login methods?
Only two methods, local login and google oauth. I’m pritty sure he is not using google his domain is not under gmail.
I see there is another thread with similar issue as mine
> [@Enable Email Verification to Prevent Spam](https://meta.discourse.org/t/enable-email-verification-to-prevent-spam/311031/9):
>
> It does sound like something is not set up quite right. It can be tricky taking over an existing forum as there are often bits and bobs that have been changed or added over the years that can take a while to track down. If you have a standard login it should behave in a very similar way to how you signed up for an account here. Do you have a forum URL you can share? (in a PM if you’d prefer not to share it publicly)
I dont know if any progress on that thread.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 1:12pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/9 "2024-07-26T13:12:19Z")
Ah yes, we discussed that further in PM. That was down to SSO not verifying the emails before passing them to Discourse.
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 1:14pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/10 "2024-07-26T13:14:29Z")
How can I proceed further to find the root cause of this issue? should I contact you (or someone) through DM?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 1:23pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/11 "2024-07-26T13:23:49Z")
No, you’re best off having a public topic so other people can weigh in with ideas if they have some. 👍
I’m afraid I don’t have many more ideas for what has happened. Did someone deactivate their account after they posted? (You can check your staff action logs for ‘deactivate user’)
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 1:28pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/12 "2024-07-26T13:28:55Z")
Yes, I deactivated that account after I saw that account created one spam topic, nginx’s access.log didn’t show any new topic activity either from this user. I’m really confused how this guy creating new topic without using web interface, there should be some other way to create topic other then the web interface, thats why asking help here.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 1:36pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/13 "2024-07-26T13:36:57Z")
If you deactivated the account then that would explain why the email is unverified (them needing to reverify their email is part of the deactivation)
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 1:38pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/14 "2024-07-26T13:38:41Z")
No, the account posted a spam topic first with unverified email, thats why I deactivated that account.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 1:41pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/15 "2024-07-26T13:41:57Z")
I think we may be talking cross-purposes. 🙂 I don’t mean Silence or Suspend, but specifically ‘deactivate’:
Did you check your staff action logs?
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 1:44pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/16 "2024-07-26T13:44:15Z")
sorry, I meant to say I `silenced` and `suspended` that account after that spam topic.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 1:55pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/17 "2024-07-26T13:55:29Z")
If you didn’t deactivate the account, then I think you’ve got to work out how they managed to bypass the normal email verification step. From what you’ve described so far, I don’t see how this is possible.
Signing up locally would send them an email to activate their account, which verifies their email, and signing up using google would also verify their email.
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 1:58pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/18 "2024-07-26T13:58:35Z")
do we have any logs which can give some clue? apart from nginx logs.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2024, 2:03pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/19 "2024-07-26T14:03:04Z")
Not that I can think of. Are you the only mod/admin for the site?
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 2:24pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/20 "2024-07-26T14:24:31Z")
I’m an admin to that website, I’m just trying to see whats going on, I don’t even know where that box is running and don’t have ssh access.
Meanwhile, I see something strange, somebody logged in as “system”, created a “Test” account and deleted immediately
I asked the admin guys did anyone logged in as system account and created Test account, yet to get reply from them. If they say nobody logged in as system at that time, then it looks like that box is compromised.
In this case, can anyone create user account through db bypassing email verification? can we see their activity in db logs?
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [July 26, 2024, 2:44pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/21 "2024-07-26T14:44:06Z")
> [@Mohan43u](#):
>
> somebody logged in as “system”, created a “Test” account and deleted immediately
I think this is shown in the logs when a user uses the delete button at their profile.
---
### Author:  [@Mohan43u](https://meta.discourse.org/u/Mohan43u)
#### Post date: [July 26, 2024, 4:23pm UTC](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508/22 "2024-07-26T16:23:25Z")
If the user delete their account from their profile, do the logs will show `system` in user field? it should be showing ‘Test’ in user field right? there is something fishy here.
[Next page](https://meta.discourse.org/t/disable-unverified-users-to-create-topic/318508.md?page=2)