There are a spammer(s) out there constantly creating accounts on my site. The accounts are 'blocked' by default so they do not pose a problem, nor does the spammer gain anything from them.

Still, I would like to delete them all but without having to click on the /admin/people page 150 times: canceling accounts 50 at a time.

Is there a way to cancel all 'blocked' accounts in one step?

Drush only appears to let me cancel one at a time...

  • You could easily do this with a mysql query...are you not wanting to go that route though? Commented Aug 3, 2012 at 20:10
  • Some good answers here. As a preventative measure, to reduce spammers, you might want to consider the Are You A Human module - on sign up, users play a game. This works on mobile too. Then there is the usual captcha offering and mollom. Hope this helps! Commented Aug 22, 2013 at 12:12
  • i finally implement a custom module for drupal 7. In the admin/people area there is a new form for complete this operation. Too with drush. More instrucctions here. Link to project. Link to issues. Please you can follow this topic in drupal.org for issues or others questions too. Thks.
    – lgrtm
    Commented Sep 11, 2013 at 7:12
  • @lgrtm Looks like your module has the same problem as the accepted answer, you're just deleting the rows in the database without giving the user_delete hook a chance to run.
    – David L
    Commented May 29, 2014 at 23:53
  • Below the link used to delete the spam user. turnkeylinux.org/blog/deleting-drupal-zombies In the above link,code will provide and this code is remove spam user register.But this code is remove based on site hacked day onward.You specify days.Ex 7 days to mention means in the one week who are all blocked user is removed Commented Dec 6, 2014 at 9:15

9 Answers 9


Use the Views Bulk Operations module.

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used.

You can create a view that shows only the blocked accounts and adds bulk operations to it. In this way, once you select all the accounts with a single click, you can delete them by selecting the operation to do and clicking on the submission button.


Deleting users directly from database is not a good idea. either done through drush or by interacting directly with the database through SQL DELETE. Some modules, for instance, create robot users and these tend to be blocked. Just deleting them may interfere with the module's operation and even make the module fail, leaving you with orphaned data and inexplicable error messages.

When spam registrations appear as "blocked" users, they're blocked because their accounts remain unverified (spammers, as a rule, never verify, so their accounts never progress from the blocked status).

A project named LoginToboggan gives you the option to have unvalidated users purged from the system at a pre-defined interval. This will also take care of any spammers that register in the future, without making it necessary to introduce protective measures such as CAPTCHA, that tend to discourage legitimate users from signing up.

Using LoginToboggan to bulk-remove spam users is much safer and more robust than hacking the database yourself.

If you don't want to install a module to do this, as an alternative, you can delete the unverified users using drush and user_delete().

  • +1 for LoginToboggan. /admin/config/system/logintoboggan - set "Delete unvalidated users after" to "1 day". Check in again tomorrow! Commented Mar 30, 2017 at 23:59

This is what I did, without adding in any extra modules or coming up with any fancy scripts or bash commands. Obviously, I'm going to get alot of hate for this as it involves hacking core temporarily.

But this is the FASTEST way. Period.

  • edit the file /modules/user/user.admin.inc
  • search for limit and change the 50 to a high number
  • goto your site and user admin page /admin/people
  • filter by blocked
  • delete....
  • switch the limit number back to 50, because the drupal gods will not like it.

No worries about missing any drupal hooks. Obviously if you set the limit number to high, it might crash your sql server. So set it appropiately. I had 10k worth of blocked users to delete. I set it to 5000 and just had to delete users only on 2 pages.

  • 1
    This is the cleanest answer here. It's quick and a valid drupal removal. No sql commands, no extra modules.
    – Matt Coady
    Commented Jun 5, 2018 at 6:47

For Drupal 8 with drush under Linux (with bash) you can use following solution:

    echo 'select name from users_field_data where status=0 and uid!=0' | mysql --silent drupaldatabase > userlist
    for username in `cat userlist`; do drush user-cancel $username -y; done

This is both rather slow (1 user/s) and safe. It doesn't work with special UTF-8 character names and names with spaces.

  • 1
    echo 'select name from users_field_data where status=0 and uid!=0' | psql service=pg_drupal -t > userlist if you use PostgreSQL.
    – jgrocha
    Commented Jul 19, 2019 at 14:05

Or use this module advance user module and token module and open people menu in drupal admin and see the advance tab menu and delete bunch of user records.





For Drupal 8, there is the user_prune module that have few options such us delete never logged in users, or blocked users.

https://www.drupal.org/project/user_prune It deletes upto 500 users that fit certain criteria per cron run.

If you have huge number and want do it fast, then backup your db and do it via mysql query (not recommended but it works). The below query is assuming you using prefix for your db tables. As of this writing the 3 tables where users are located are:

[yourprefix_users , yourprefix_users_data, yourprefix_users_field_data ]

delete u,ud,ufd from yourPrefix_users u inner join    
yourPrefix_users_data ud ON u.uid = ud.uid inner join 
yourPrefix_users_field_data ufd ON ufd.uid = ud.uid
 where access=0;

That deletes those that never logged in (access=0) you can use status=0 for blocked ones.


If you are sure that all of the blocked accounts need removing, then you could run a query in phpmyadmin (or your mysql admin of choice):

DELETE FROM users WHERE `status` = 0 AND `uid` != 0;

That should get rid of all blocked accounts and leave the anonymous user. Of course you would DEFINITELY want to back your DB up first. Also, realize this also get rid of any accounts that may be legitimate, but that you may have set status as 'blocked' for some reason.

Note: I should say that I know way more about 6 than 7. So if the users table is drastically different in Drupal 7, this may be incorrect.

  • Yes, I am on 7. And, yes, I'll try this first on our testing copy of the site. Commented Aug 3, 2012 at 21:06
  • 8
    This does not give any modules that implement hook_user_delete (or hook_user("delete") in Drupal 6) a chance to run. You could end up with problems and/or orphanced data in your database of you do this via direct SQL.
    – mpdonadio
    Commented Aug 3, 2012 at 21:43
  • 1
    @MPD is correct. However, that is why I said make sure that all 'blocked' accounts are in fact SPAM accounts before running this. If they are new accounts that have never signed in, or run anything, then it SHOULD be OK...however...that is why I said make a back-up first. It's not the best way to do it. You could write a custom module that removes all blocked accounts implementing Drupal hooks. That would probably be cleaner, but this is a quick dirty way. Commented Aug 4, 2012 at 15:48
  • 5
    Even if they are spam account, there is the possibility that other modules have done things when accounts were created. For example, the profile module (and successors) create one or more nodes for each user when the account is created. These would remain in the DB.
    – mpdonadio
    Commented Aug 4, 2012 at 16:28
  • Gotcha. Good points. Commented Aug 4, 2012 at 16:48

This is my late to the party solution how to use get this done without having to add vbo. The command itself is probably a bit fragile and may break under certain configurations of mysql but the deletion itself should be safe.

drush sqlq "SELECT uid FROM users WHERE uid >= 629" | grep -v uid|tr '\n' ','|awk '{print "drush ev \"user_delete_multiple(array("$1"))\""}'|sh

for nodes you can alter appropriately

drush sqlq "SELECT nid FROM node WHERE nid >= 435193 AND type='school'" | grep -v nid|tr '\n' ','|awk '{print "drush ev \"node_delete_multiple(array("$1"))\""}'|sh

Notice, you need to change nid/uid in the grep portion along with the function call to appropriately grab the uid/nid values.


IN drupal 8 you must delete content for 3 tables.

  • first make a copy of your database
    • now go to your phpMyadmin console and pick your database
    • Browse your user_field_data table in order to see the UIDS range you want to delete. usually low number UIDs are your real users..
    • now delete the data for blocked users, in my case all users with UID > 240 are blocked
    • use this SQL commands -change UIDs number for your case. DELETE FROM users_field_data WHERE uid >= 240
      DELETE FROM users_data WHERE uid >= 240 DELETE FROM users WHERE uid >= 240

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.