There are a spammer(s) out there constantly creating accounts on my site. The accounts are 'blocked' by default so they do not pose a problem, nor does the spammer gain anything from them.

Still, I would like to delete them all but without having to click on the /admin/people page 150 times: canceling accounts 50 at a time.

Is there a way to cancel all 'blocked' accounts in one step?

Drush only appears to let me cancel one at a time...

  • You could easily do this with a mysql query...are you not wanting to go that route though? – kevindeleon Aug 3 '12 at 20:10
  • Some good answers here. As a preventative measure, to reduce spammers, you might want to consider the Are You A Human module - on sign up, users play a game. This works on mobile too. Then there is the usual captcha offering and mollom. Hope this helps! – therobyouknow Aug 22 '13 at 12:12
  • i finally implement a custom module for drupal 7. In the admin/people area there is a new form for complete this operation. Too with drush. More instrucctions here. Link to project. Link to issues. Please you can follow this topic in drupal.org for issues or others questions too. Thks. – lgrtm Sep 11 '13 at 7:12
  • @lgrtm Looks like your module has the same problem as the accepted answer, you're just deleting the rows in the database without giving the user_delete hook a chance to run. – David L May 29 '14 at 23:53
  • Below the link used to delete the spam user. turnkeylinux.org/blog/deleting-drupal-zombies In the above link,code will provide and this code is remove spam user register.But this code is remove based on site hacked day onward.You specify days.Ex 7 days to mention means in the one week who are all blocked user is removed – Balachandran Dec 6 '14 at 9:15

On the People page (admin/people), first select the blocked users and then from the update options select Cancel the selected user accounts. (Drupal 7)

Another way is using the Views Bulk Operations module.

  • 4
    How is this the accepted answer? Doesn't the OP request specifically that they don't want to have to select the blocked users 50 at a time with the checkboxes on the admin/people page? – squarecandy Mar 30 '17 at 23:57

Deleting users directly from database is not a good idea. either done through drush or by interacting directly with the database through SQL DELETE. Some modules, for instance, create robot users and these tend to be blocked. Just deleting them may interfere with the module's operation and even make the module fail, leaving you with orphaned data and inexplicable error messages.

When spam registrations appear as "blocked" users, they're blocked because their accounts remain unverified (spammers, as a rule, never verify, so their accounts never progress from the blocked status).

A project named LoginToboggan gives you the option to have unvalidated users purged from the system at a pre-defined interval. This will also take care of any spammers that register in the future, without making it necessary to introduce protective measures such as CAPTCHA, that tend to discourage legitimate users from signing up.

Using LoginToboggan to bulk-remove spam users is much safer and more robust than hacking the database yourself.

If you don't want to install a module to do this, as an alternative, you can delete the unverified users using drush and user_delete().

  • +1 for LoginToboggan. /admin/config/system/logintoboggan - set "Delete unvalidated users after" to "1 day". Check in again tomorrow! – squarecandy Mar 30 '17 at 23:59

Or use this module advance user module and token module and open people menu in drupal admin and see the advance tab menu and delete bunch of user records.





For Drupal 8 with drush under Linux (with bash) you can use following solution:

    echo 'select name from users_field_data where status=0 and uid!=0' | mysql --silent drupaldatabase > userlist
    for username in `cat userlist`; do drush user-cancel $username -y; done

This is both rather slow (1 user/s) and safe. It doesn't work with special UTF-8 character names and names with spaces.

  • echo 'select name from users_field_data where status=0 and uid!=0' | psql service=pg_drupal -t > userlist if you use PostgreSQL. – jgrocha Jul 19 '19 at 14:05

This is what I did, without adding in any extra modules or coming up with any fancy scripts or bash commands. Obviously, I'm going to get alot of hate for this as it involves hacking core temporarily.

But this is the FASTEST way. Period.

  • edit the file /modules/user/user.admin.inc
  • search for limit and change the 50 to a high number
  • goto your site and user admin page /admin/people
  • filter by blocked
  • delete....
  • switch the limit number back to 50, because the drupal gods will not like it.

No worries about missing any drupal hooks. Obviously if you set the limit number to high, it might crash your sql server. So set it appropiately. I had 10k worth of blocked users to delete. I set it to 5000 and just had to delete users only on 2 pages.

  • This is the cleanest answer here. It's quick and a valid drupal removal. No sql commands, no extra modules. – Matt Coady Jun 5 '18 at 6:47

If you are sure that all of the blocked accounts need removing, then you could run a query in phpmyadmin (or your mysql admin of choice):

DELETE FROM users WHERE `status` = 0 AND `uid` != 0;

That should get rid of all blocked accounts and leave the anonymous user. Of course you would DEFINITELY want to back your DB up first. Also, realize this also get rid of any accounts that may be legitimate, but that you may have set status as 'blocked' for some reason.

Note: I should say that I know way more about 6 than 7. So if the users table is drastically different in Drupal 7, this may be incorrect.

  • Yes, I am on 7. And, yes, I'll try this first on our testing copy of the site. – Jose M Vidal Aug 3 '12 at 21:06
  • 7
    This does not give any modules that implement hook_user_delete (or hook_user("delete") in Drupal 6) a chance to run. You could end up with problems and/or orphanced data in your database of you do this via direct SQL. – mpdonadio Aug 3 '12 at 21:43
  • 1
    @MPD is correct. However, that is why I said make sure that all 'blocked' accounts are in fact SPAM accounts before running this. If they are new accounts that have never signed in, or run anything, then it SHOULD be OK...however...that is why I said make a back-up first. It's not the best way to do it. You could write a custom module that removes all blocked accounts implementing Drupal hooks. That would probably be cleaner, but this is a quick dirty way. – kevindeleon Aug 4 '12 at 15:48
  • 4
    Even if they are spam account, there is the possibility that other modules have done things when accounts were created. For example, the profile module (and successors) create one or more nodes for each user when the account is created. These would remain in the DB. – mpdonadio Aug 4 '12 at 16:28
  • Gotcha. Good points. – kevindeleon Aug 4 '12 at 16:48

This is my late to the party solution how to use get this done without having to add vbo. The command itself is probably a bit fragile and may break under certain configurations of mysql but the deletion itself should be safe.

drush sqlq "SELECT uid FROM users WHERE uid >= 629" | grep -v uid|tr '\n' ','|awk '{print "drush ev \"user_delete_multiple(array("$1"))\""}'|sh

for nodes you can alter appropriately

drush sqlq "SELECT nid FROM node WHERE nid >= 435193 AND type='school'" | grep -v nid|tr '\n' ','|awk '{print "drush ev \"node_delete_multiple(array("$1"))\""}'|sh

Notice, you need to change nid/uid in the grep portion along with the function call to appropriately grab the uid/nid values.


IN drupal 8 you must delete content for 3 tables.

  • first make a copy of your database
    • now go to your phpMyadmin console and pick your database
    • Browse your user_field_data table in order to see the UIDS range you want to delete. usually low number UIDs are your real users..
    • now delete the data for blocked users, in my case all users with UID > 240 are blocked
    • use this SQL commands -change UIDs number for your case. DELETE FROM users_field_data WHERE uid >= 240
      DELETE FROM users_data WHERE uid >= 240 DELETE FROM users WHERE uid >= 240

For Drupal 8, there is the user_prune module that have few options such us delete never logged in users, or blocked users.

https://www.drupal.org/project/user_prune It deletes upto 500 users that fit certain criteria per cron run.

If you have huge number and want do it fast, then backup your db and do it via mysql query (not recommended but it works). The below query is assuming you using prefix for your db tables. As of this writing the 3 tables where users are located are:

[yourprefix_users , yourprefix_users_data, yourprefix_users_field_data ]

delete u,ud,ufd from yourPrefix_users u inner join    
yourPrefix_users_data ud ON u.uid = ud.uid inner join 
yourPrefix_users_field_data ufd ON ufd.uid = ud.uid
 where access=0;

That deletes those that never logged in (access=0) you can use status=0 for blocked ones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.