Accounts Nobody Has Used In Six Months

What this check and mySites.guru tool looks at on your site

This check counts registered users, excluding administrators and super users, who have either never logged in or have not logged in for more than 180 days, and flags any it finds.

Why nobody notices a dormant account being misused

An account nobody uses is an account nobody is watching. If it were ever going to be misused, quietly, over a long period, without anyone noticing, this is exactly the kind of account it would happen to. Nobody checks the last-login date on an account they forgot existed.

That matters because passwords get compromised in ways that have nothing to do with your site. A user who reused the same password on a different service that later suffered a data breach is now vulnerable everywhere they used that password, including on your site, whether they log in once a week or once a decade ago. Credential stuffing tools work through exactly these breach lists, trying known email-and-password pairs against thousands of sites automatically. An account that logs in regularly has a better chance of the owner noticing something is wrong. An account nobody has touched in months has no one watching it at all.

Dormant accounts also accumulate for mundane reasons that are worth clearing out on their own: a contributor who left the organisation, a test account created during a site build and never removed, a customer account from a feature that has since been retired. None of these are malicious, but each one is a login credential sitting on your site that nobody currently needs and nobody is monitoring.

There is a quieter risk too, specific to accounts that use email-based password resets, which almost every Joomla site does by default. If an account has been dormant long enough, the email address it was registered with may itself have lapsed: a personal address the person no longer checks, a work address at a company they have since left, or a domain that has expired and been picked up by someone else entirely. Anyone who gains control of that mailbox, whether through a lapsed domain or a compromised inbox, can trigger a password reset on your site and walk straight into the account, without ever having to guess a password at all. The account being old is not just a monitoring problem; it can mean the recovery path itself no longer belongs to the person it was set up for.

Keeping a tidy user list is also worth doing on its own terms, separately from any specific threat. Fewer accounts means less personal data sitting in your database for no active reason, which matters if you ever need to account for what personal data your site holds and why.

Reviewed, not just old

Every non-admin account on your site has either logged in within the last six months, or has been reviewed and either blocked or removed. Accounts you are not sure about have been checked with the person they belong to before any action is taken.

The six-month threshold is a working balance, not a hard rule. It is long enough to allow for seasonal users, contributors who only write occasionally, or customers who log in a few times a year, while still being short enough to catch accounts that have genuinely been forgotten. If your site has a different natural rhythm, for example a members’ area that people only use once a year at renewal time, treat the threshold as a prompt to look, not an automatic instruction to remove.

How to fix it

1. Log in to https://yoursite.com/administrator and go to Users > Manage.
2. Sort the list by Last Visit Date to bring the longest-inactive accounts to the top.
3. For each account inactive for more than six months, decide what it is: someone who genuinely might return, a test account, or something you do not recognise at all.
4. Block accounts you might need to restore later; this keeps the record but prevents login.
5. Delete accounts you are confident are no longer needed, such as clear test accounts or one-off signups.
6. If you find an account you do not recognise creating or using content, or one with unusual group membership, treat it as a possible compromise rather than routine housekeeping, and investigate before removing it.

What mySites.guru does about it

We check every non-admin account’s last login date on each snapshot and flag any inactive for more than six months. There is no one-click fix for this, because whether to block, delete or keep an account is a judgement call only you can make, so we surface the list and leave the decision to you.

If an unfamiliar account also has an unusual username pattern rather than just being old, it is worth checking against known attacker-created account signatures before you simply delete it.