If you run a Joomla site for more than a couple of months you may have noticed that there are a lot of user accounts which appear to be unactivated or have been activated but never logged in. There are typically three reasons for them:
-
Spam registrations. A spam bot registered a user account in the hope that it would be automatically approved and give them access to post information on your site, allowing them to submit spam. These accounts are typically unactivated and never logged in since the spam bot cannot follow through the default email self-registration process in Joomla.
-
A real human tried to create an account and either didn't receive the email from your site to activate their account (their account appears unactivated and never logged in) or went through the activation but changed their mind (their account appears activated and never logged in).
-
A real human asked for a password reset. This makes their account appear as not yet activated but there is a last logged in date.
This task type allows you to delete these user accounts. There are three options for the Delete inactive users preference in this task type:
- Only if they activated, but never logged in
-
Deletes all users who appear to be activated but have never logged in.
![[Warning]](/media/com_docimport/admonition/warning.png)
Warning In some cases these may be legitimate user accounts you do not want to delete. For example, someone may have purchased a subscription on your site to gift to another person. During that time they might not have logged in to your site yet, depending on how the purchase system on your site works.
- Only if they haven't activated their account
-
Deletes all users who appear to be not activated.
This will NOT delete user accounts which have a Last Reset Time set in their user account. This prevents accidentally deleting users who have simply asked for a password reset and have not yet completed the password reset process.
This is a change from the legacy behavior of the similar feature in the System - Admin Tools plugin which would naively remove users who have asked for a password reset.
- Activated or not, as long as they haven't logged in
-
Deletes all users without a last logged in date.
Warning In some cases these may be legitimate user accounts you do not want to delete. For example, someone may have purchased a subscription on your site to gift to another person. During that time they might not have logged in to your site yet, depending on how the purchase system on your site works.
The Delete after this many days setting is used to determine when to delete users. Only users who have created an account at least this many days ago will be considered for deletion. This allows you to give a "grace time" to users to activate their account and / or log into your site for the first time before they are targeted for account removal. We recommend setting this to somewhere between 7 and 30 days. Sometimes email gets lost, they might need to contact you or, generally real world life happens — we've had legitimate users who got hospitalised right after they created an account, creating a gap of several days between account activation and first login.