You're not alone!

Please note that all WordPress websites are under hard spam attack.

Spam is everywhere! It doesn't matter you use wpForo or not. If you enabled user registration then wait for spams... wpForo doesn't handle user registration and doesn't have any affection on number of spam registrations. All processes of user registration are still performed by your WordPress core functions. So you should find solutions to protect WordPress not wpForo.

Human spam cannot be stopped. You can stop only robot spam.

Please remember, not all spams are robots. So you'll still have 1-5 spam registered users per day even if you use all antispam solutions around the world. Because those solutions are made to detect robots. Human spam cannot be 100% stopped. There are lots of people who earn money for manual registration in forums and for posting spam content. So if you have less than 5 spam users posts per day, it means your forum is protected very well! 99% of bot spams are already stopped. You only have a human spam. These guys are real human, they register as other real members of your forum. So the antispam solutions have no any chance to stop them.

New registered users posts become unapproved and wait for moderation

wpForo doesn't display spam topics and posts if wpForo Spam Control is enabled in Dashboard > Forums > Tools > Antispam Tab. wpForo has built-in "New User" control system. It does a hard scan of new registered users' topics and posts. If it found many similar posts by the same user, or external links or other suspicious content, it makes those unapproved and sends you email notification saying a new Topic or Post is awaiting your moderation. You can even make the control stronger by enabling the option "All posts must be manually approved" for new registered users. The "New User" status is based on the number of posts he/she submitted.

And yes, WordPress is not protected from spam. You must use antispam solutions!

Here are the solutions we recommend:

1. Google reCAPTCHA version2 Checkbox. wpForo has a built-in reCAPTCHA for you. In Dashboard > Forums > Tools > Antispam Tab you can configure and enable the reCAPTCHA v2 Checkbox "I'm not Robot". We recommend configure and enable wpForo reCAPTCHA for all registration and login forms:

Note: once you configure and enabled the reCAPTCHA, please use other browser to test it as guest, and register one user with a real email to make sure all works fine.

2. Akismet. wpForo is well integrated with Akismet. You should install and activate Akismet too. There is also a free plan in Aksimet, but paid plans are better.

3. Antispam plugins. Because wpForo user and registration system is handled by WordPress you can use WordPress antispam plugins. There are hundreds of them: https://wordpress.org/plugins/search/spam+signup/

• Anti-Spam by CleanTalk: https://wordpress.org/plugins/cleantalk-spam-protect/
• Shield Security: https://wordpress.org/plugins/wp-simple-firewall/
• No-Bot Registration: https://wpforo.com/community/postid/54646/

One of the lightest Antispam solution is this:

Note: once you installed some antispam plugin, please use other browser to test it as guest, and register one user with a real email to make sure all works fine.

4. Manual User Approving. Starting from wpForo v2, you can manually approve new registered users. Please read the documentation: https://wpforo.com/docs/wpforo-v2/settings/login-registration/#enable-user-manually-approval-system

5. Block Spam User  based on the post content. Most spammers have very similar words and phrases in spam posts. You can copy some very usual spam words and phrases and create a user blocking rules using Forums Censure PRO plugin: https://gvectors.com/product/forums-censure-pro/