How to bulk-delete fake WooCommerce customers

How to recognise fake customer accounts

Bot-made WooCommerce accounts usually share some of these traits:

• no orders, ever, and no saved billing details;
• usernames or addresses that look generated, such as [email protected], or the same Gmail inbox in many dotted spellings;
• throwaway email domains;
• registrations in bursts, often at night, sometimes hundreds in an hour.

"No orders" is the safest single filter, but it is not proof. Real people create accounts and buy later, and a customer who checked out as a guest with the same email has orders that aren't linked to their account. That's why the steps below skip recent accounts and ask you to check a sample.

Step 1: slow the flood first

If fake accounts are still arriving, deal with that before cleaning up. In WooCommerce › Settings › Accounts & Privacy you choose whether visitors can create an account on the My account page and during checkout. Switching account creation off on the My account page for a while is a quick stop-gap if your shop doesn't need it. The lasting fix is screening each registration (step 5).

Step 2: back up

Use your host's backup tool or a backup plugin you already trust, or, with WP-CLI:

# Run in the WordPress folder (or add --path=/path/to/wordpress).
wp db export before-customer-cleanup.sql

Step 3: find customers with no orders

In the dashboard

WooCommerce › Customers lists customers with their number of orders, which helps you see the scale of the problem. To act on accounts, go to Users › All Users and click the Customer role filter above the table. You can search by email domain there, which is handy when the fakes share one.

With WP-CLI

For more than a few dozen accounts, the command line is faster and more precise. Start by looking, not deleting:

# How many customer accounts are there?
wp user list --role=customer --format=count

# Keep a copy of the list for your records
wp user list --role=customer --fields=ID,user_login,user_email,user_registered --format=csv > customers.csv

Then build the list of candidates. This uses WooCommerce's own order lookup, so it works whether your store keeps orders in the newer order tables or the older posts storage:

# Read-only: write the IDs of customers with no orders,
# registered more than 30 days ago, to a file. Nothing is deleted.
wp eval '
$ids = get_users( array(
  "role"       => "customer",
  "fields"     => "ID",
  "date_query" => array( array( "before" => "30 days ago" ) ),
) );
foreach ( $ids as $id ) {
  $orders = wc_get_orders( array( "customer_id" => (int) $id, "limit" => 1, "return" => "ids" ) );
  if ( empty( $orders ) ) { echo $id, PHP_EOL; }
}
' | grep -E '^[0-9]+$' > no-order-customers.txt

wc -l no-order-customers.txt    # how many were found
wp user get $(head -n 1 no-order-customers.txt) --fields=ID,user_email,user_registered

Orders in the trash aren't counted, so check WooCommerce › Orders › Trash for these customers first. Then open the file, look up a handful of the IDs, and make sure none are people you recognise. Remove any IDs you want to keep before going on.

Step 4: delete in batches

In the dashboard: on Users › All Users with the Customer filter, tick only accounts you have confirmed have no orders (check each one under WooCommerce › Customers, which shows the order count), choose Delete from Bulk actions and confirm. If WordPress asks what to do with content owned by these users, choose Attribute all content to an administrator, never Delete all content. For more than a few accounts, use the WP-CLI steps, which only select customers with no orders.

With WP-CLI (this is the permanent step, and it cannot be undone without your backup):

# DESTRUCTIVE: deletes every user ID in the file, 100 at a time.
# Find an administrator's ID first, and use it in place of 1 below:
wp user list --role=administrator --fields=ID,user_login
# Any posts the deleted users own go to that administrator.
xargs -r -n 100 wp user delete --reassign=1 < no-order-customers.txt

Run it once, then repeat Step 3 to confirm the list is empty. If you're on a multisite network, read the WP-CLI notes on --network first.

Step 5: stop new fake registrations

Cleaning up treats the symptom. The accounts came from somewhere: a registration form, the My account page or checkout. A CAPTCHA helps against crude bots, but many fakes come from real browsers, people, or scripts that post the form directly (see fake sign-ups despite CAPTCHA).

The free InlineShield plugin for WordPress and WooCommerce screens each new registration before the account is created: on the registration form, the My account page and, if you switch it on, checkout. It catches disposable addresses (including unlisted ones, through their mail servers), Gmail alias repeats, machine-made addresses, headless browsers and scripted clients, and VPN, Tor and datacenter IPs. Suspicious sign-ups are flagged or held so you decide, and the Users screen gets Report fraud and Report legitimate actions. It works alongside your CAPTCHA plugin. The bot side is explained in bot sign-up detection.