Purge Users
Automatically delete or block inactive users based on configurable time-based criteria.
purge_users
Install
composer require 'drupal/purge_users:^4.0'
Overview
Purge Users provides administrators with the ability to automatically manage inactive user accounts based on various time-based conditions. The module can identify users who have never logged in, haven't logged in for a specified period, never activated their accounts, or have been blocked for a certain duration.
Administrators can configure multiple purge conditions simultaneously, filter users by role (include or exclude specific roles), and choose from different cancellation methods including blocking, deleting, or reassigning content to anonymous users. The module supports both automated purging via cron and manual purging through a confirmation interface.
Email notifications can be sent to users both before and after their accounts are purged, with customizable templates that support Token module integration. The module also provides protection options to prevent purging users who have created content or comments, ensuring important authorship information is preserved.
Features
- Purge users who have never logged in after a configurable time period
- Purge users who have not logged in for a specified duration
- Purge users whose accounts have not been activated within a set timeframe
- Purge users who have been blocked for a configurable period
- Role-based filtering with include and exclude options for targeted purging
- Multiple user cancellation methods: block, block and unpublish content, delete account, or reassign content to anonymous
- Option to follow site-wide cancellation policy
- Email notification to users after their account is deleted
- Pre-deletion email notification warning users before their account will be purged
- Token module integration for personalized email templates
- Automatic purging via cron or manual purging through UI
- Protection options to prevent purging content authors and commenters
- Configurable time periods in days, months, or years
- Extensible API with alter hooks for customizing user selection
- Queue-based processing for handling large numbers of users
- Database logging to prevent duplicate notifications
Use Cases
GDPR Data Retention Compliance
Configure the module to automatically delete user accounts that have been inactive for a period matching your data retention policy (e.g., 2 years). Enable pre-deletion notifications to give users a chance to log in and preserve their accounts. This helps maintain GDPR compliance by not retaining personal data longer than necessary.
Cleaning Up Abandoned Registrations
Enable 'Purge users who have never logged in' with a 30-day period to automatically remove spam registrations and users who created accounts but never activated or used them. Use the 'user_cancel_delete' method since these accounts have no content to preserve.
Managing Blocked Users
After blocking problematic users, configure the module to automatically delete their accounts after a waiting period (e.g., 6 months). This gives time for any appeals while ensuring blocked accounts don't persist indefinitely.
Membership Site User Management
For subscription-based sites, configure role-based filtering to only purge users with the 'basic_member' role who haven't logged in, while excluding 'premium_member' and 'administrator' roles. Use pre-deletion notifications to encourage re-engagement.
Preserving Content Authorship
Enable 'Do not purge users who are authors of existing content' and 'Do not purge users with existing comments' to ensure user purging doesn't orphan content. Combined with 'user_cancel_reassign' method, content from purged users will be attributed to Anonymous.
Tips
- Always test on a staging environment before enabling automatic purging on production
- Exclude administrator and other important roles from purging to prevent accidental lockout
- Enable pre-deletion notifications to give users a chance to log back in before their accounts are deleted
- Use the 'Purge users now' button to preview which users would be affected before enabling cron-based purging
- Keep regular database backups, especially before performing large purge operations
- Consider using role exclusions for users who have purchased products or have important account history
- The module excludes user ID 1 (the super admin) from all purge operations automatically
Technical Details
Admin Pages 2
/admin/people/purge-rule
Configure user purge conditions, cancellation methods, role filters, and notification settings. This is the main configuration page for the Auto Purge Users module.
/admin/people/purge-rule/confirm
Confirmation page displaying the list of users that will be purged based on current configuration. Shows up to 50 usernames with email addresses, then summarizes remaining count.
Permissions 2
Hooks 4
hook_purge_never_loggedin_user_ids_alter
Alter the list of user IDs for users who have never logged in before they are purged.
hook_purge_not_loggedin_user_ids_alter
Alter the list of user IDs for users who have not logged in for the configured period.
hook_purge_inactive_user_ids_alter
Alter the list of user IDs for users whose accounts have not been activated.
hook_purge_blocked_user_ids_alter
Alter the list of user IDs for blocked users before they are purged.
Troubleshooting 6
Verify that 'Purge on cron' is enabled in the settings. Check that at least one purge condition is enabled and at least one role is selected for inclusion. Ensure cron is running properly on your site.
Enable 'Disregard inactive/blocked users' option if you're using a cancellation method that blocks users (user_cancel_block or user_cancel_block_unpublish). This prevents already-blocked users from being processed on every cron run.
At least one purge condition must be enabled (never logged in, not logged in, inactive, or blocked users). Enable at least one condition to save the configuration.
These options are mutually exclusive. If you want to purge blocked users, you cannot also disregard them. Choose one approach based on your needs.
Verify that the notification checkbox is enabled. Check that users have valid email addresses. Review the 'notification_users' log channel for errors. Ensure your site's mail system is properly configured.
The 'user_cancel_reassign' method only works for standard node entities. Custom entity types may not be covered. Check the module's custom logic in UserManagementService for supported entity types.
Security Notes 6
- This module has restricted access permissions - only grant them to trusted administrators
- The 'access purge confirmation form' permission allows users to delete user accounts - use with caution
- Always exclude administrative roles from purging to prevent accidental loss of admin access
- The module does not purge user ID 1 (super admin) under any circumstances
- Test thoroughly on staging environments as purged users cannot be recovered without database restoration
- When using 'user_cancel_delete', all user content will be permanently deleted