Agent Abilities
GitHubGet it free
Features
Abilities
Browse all abilities

WordPress core

ContentTaxonomies & TermsCommentsUsersMediaSite settingsPluginsThemes & stylesBlocksMenusSearch

Integrations

WooCommerceAdvanced Custom FieldsRank Math SEOYoast SEOAll in One SEO
Integrations
All integrationsWooCommerce52Advanced Custom Fields7Rank Math SEO5Yoast SEO3All in One SEO3
Bridge
AI clients
All clientsChatGPTClaude.aiManusClaude DesktopClaude CodeCursorVS CodeWindsurfGemini CLI
Resources
DocsChangelogPrompt LibraryBlogComparisonsSupport
GitHubGet it free

Find and remove spam user accounts

UsersIntermediate~10 min
AbilitiesGet usersGet userDelete user

Before you start

A connected site whose bound user holds the list-users and delete-users capabilities, with the get-users, get-user, and delete-user abilities enabled. delete-user is off by default.

Open registration invites a slow drip of junk accounts: names that are a wall of consonants, throwaway email addresses, zero activity ever. Deleting them by hand means eyeballing the user list page after page. This has the agent do the eyeballing and propose a list, and it deletes nothing until you sign off.

The prompt
This site has collected spam signups. Help me clear them out, and delete
nothing until I approve the list.


Read only first: pull the user list and hand me back the accounts that look
like spam, the ones with zero posts and gibberish names or throwaway email
addresses. Put them in a table with the signal you spotted for each, and don't
touch anything yet.


I'll confirm which are really spam. Then delete the approved ones a few at a
time, reassigning any content they somehow own to [me], and skip anyone I
didn't clear. You can't remove me or the last administrator, so an honest
account caught by mistake still can't take the site down with it. Give me back
the list of who you deleted at the end.

Why this is safe to run

Reading the user list and deleting an account are two different abilities with two different switches, so the read pass genuinely cannot delete anyone: if delete-user is off, the agent hands you the candidate list and stops there. You approve the accounts one batch at a time, and each deletion reassigns any content the account owned to a user you name rather than destroying it. The plugin will not delete the account the agent is acting as, nor the last administrator, so a false positive on a real member is caught before it matters. Every removal is checked against your bound user’s capability and logged.

Already connected? Ask your agent for the “remove spam user accounts” recipe and it runs the same propose-then-confirm pass on your own signups.

How it works

  1. List the users and surface the accounts that look like spam signups.
  2. Read each candidate's details to back up the call.
  3. Return a table with the spam signal spotted for each one.
  4. Wait for you to confirm which accounts are really spam.
  5. Delete only the approved ones, reassigning any content, and skip the rest.
  6. Return the list of accounts removed at the end.

Questions

What if it flags a real member by mistake?
Nothing is deleted until you confirm the list, so a wrong flag just sits in the table until you clear it. And the plugin can never delete you or the last administrator, so an honest account caught in the net still cannot take the site down.
What happens to content owned by a deleted account?
delete-user reassigns whatever the account owns to a user you name, so removing a spammer never orphans a post. Most spam signups own nothing, but the reassignment is there when one does.

Related recipes