What bbPress does on your site
bbPress adds a discussion forum to WordPress without a separate database: forums, topics and replies are WordPress post types, and your forum members are your WordPress accounts. Once activated, a Forums menu appears in the admin, the forum archive lives at /forums/ by default, and every member gets a public profile page under /forums/users/.
The plugin handles five forum roles (Keymaster, Moderator, Participant, Spectator and Blocked), public, private or hidden forums, email subscriptions to forums and topics, favorites, topic tags, search and revisions. It ships shortcodes ([bbp-forum-index], [bbp-topic-form], [bbp-login]...), widgets and an importer that converts forums from phpBB, vBulletin, SMF, MyBB, XenForo, Invision, Vanilla and about fifteen other packages. It integrates with Akismet against spam and with BuddyPress for group forums.
bbPress is a community project built by WordPress contributors (led by John James Jacoby) and is completely free: there is no Premium edition and no subscription. Display relies on a theme compatibility layer that injects the forum templates into your theme. It works with most themes, but you may need a bit of CSS to make it look right.
Which communities bbPress suits best
bbPress is a good fit when you want a lean forum that lives inside your WordPress site, with no license fee:
- Support forums for a product or plugin: customer questions stay on your domain, using the same accounts as the rest of the site.
- Nonprofits, clubs and hobby communities: private forums for logged-in members, hidden forums for the board, dedicated moderators per forum.
- Moving off an old forum: the importer brings over topics, replies and accounts from most well-known forum packages.
- Internal social networks with BuddyPress: each group can have its own forum.
It is the wrong choice if you expect a full-featured forum out of the box: bbPress does not enable file attachments, which take an add-on, and the look depends heavily on your theme. For a paid membership area, bbPress handles neither payments nor subscriptions, so pair it with a membership plugin, or with Ultimate Member for richer profiles and registration.
bbPress strengths and limitations
Strengths
- Completely free. No paid edition and no feature locked behind a subscription.
- Built on WordPress. Content, accounts, search and backups all go through the usual WordPress machinery.
- Very broad importer. Around twenty converters, from phpBB to XenForo, to take over an existing forum.
- Fine-grained permissions. Forum roles, private or hidden forums, per-forum moderators and a site-wide Open, Closed or Frozen status.
Limitations
- Minimal by design. Attachments and other advanced features come from third-party add-ons, whose upkeep varies.
- Looks depend on the theme. Automatic compatibility works, but a polished design often takes custom CSS.
- No commercial support. Help comes from the documentation and the bbPress.org forums, with no response-time commitment.
- Recurring access-control flaws. Several recent releases fixed leaks of content from private forums.
The bbPress settings we recommend
You will find these settings under Settings > Forums. The defaults are already sensible; the main point is not to open the forum more than you need. A public forum draws spam quickly, which is why anti-spam protection is worth adding on top of the settings below.
| Setting | Recommended value | Why |
|---|---|---|
| Roles Settings > Forums > Forum User Settings | On, Participant role (default) | A registered account can post and nothing more; never pick Moderator or Keymaster as the automatic role. |
| Flooding Same section | On, 10 seconds (default) | Slows down bots that post in bursts. |
| Editing Same section | On, 5 minutes (default) | With 0 minutes, an approved post could be edited at any time, for example to slip in a spam link. |
| Anonymous Same section | Off (default) | bbPress itself reserves guest posting for intranets or sites protected by anti-spam such as Akismet. |
| Use Akismet Settings > Forums > Forum Integration for Akismet | On | The section only appears when Akismet is active; topics and replies are then filtered like comments. |
| Revisions Settings > Forums > Forum Features | On (default) | Keeps an edit history, handy for moderating a rewritten post. |
| Auto-embed links Same section | Off (default), unless you really need it | Embedded videos and media load third-party services in your forum pages. |
| Super Moderators Same section | Off (default) | When on, Moderators and Keymasters can edit member profiles and forum roles: one stolen moderator account would be enough. |
- Logged out, open
/forums/: only public forums should appear, never private or hidden ones. - In Users, check that only trusted accounts hold the Keymaster or Moderator forum role.
- Post a test topic with a Participant account to check how it looks in your theme and whether Akismet filtering works.
- If topic or reply counts look wrong after an update, use Tools > Forums > Repair Forums, one tool at a time and outside peak hours.
bbPress security: keep private forums private
A forum opens two doors you need to watch: registration and the visibility of private forums. The vulnerabilities published for bbPress mostly involve these two areas:
- CVE-2020-13693, fixed in 2.6.5: unauthenticated privilege escalation when new user registration is enabled.
- CVE-2025-1435, fixed in 2.6.12: a forged request (CSRF) could give a visitor the Keymaster role if an administrator clicked a booby-trapped link (CVSS 6.3).
- CVE-2026-62137, fixed in 2.6.15: unauthenticated sensitive data exposure (CVSS 5.3).
- CVE-2026-110762, fixed in 2.6.19: with BuddyPress, topics in a public subforum nested under a private or hidden forum stayed readable in the activity stream.
The useful move is simple: turn on automatic updates for bbPress under Plugins (see our guide to automatic plugin updates) and keep high-privilege accounts to a minimum, as our article on WordPress roles and capabilities explains. WP Masquerade Pro replaces the /wp-content/plugins/bbpress/ folder address and the IDs of the files bbPress loads, which makes the plugin harder for bots targeting these flaws to spot; the bbpress and bbp-* CSS classes stay visible, and hiding is no substitute for updating.
What WP Masquerade hides for bbPress
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to bbPress: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- CSS classes
bbpress, bbp-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
bbPress FAQ
Is bbPress really free?
Yes. bbPress is distributed under the GPL on wordpress.org, with no paid version. Only some add-ons from other authors, for example for attachments, may cost money.
Do I need BuddyPress to use bbPress?
No. bbPress works on its own with WordPress accounts. BuddyPress is only useful if you want groups that each have their own forum, plus an activity stream.
Can I import a phpBB or vBulletin forum into bbPress?
Yes, with Tools > Forums > Import Forums: you pick the source software and enter access to its old database. Test the import on a copy of the site first, since it can take a long time on a large forum.
Do bbPress profiles reveal member usernames?
A profile URL contains the account slug (user_nicename), which by default is derived from the login name. For your admin accounts, choose a login that differs from the public name and protect sign-in with two-factor authentication.