How to optimise DotNetNuke speed by improving page load, caching and use of CDN

This is a real example of what can be done to get your sites running faster before upgrading the hardware.
Starting point - this blog mattjura.com with following specification: Server: Microsoft Windows NT 6.1.7601 Service Pack 1, IIS/7.5, .Net 4.0 and SQL Server 2008 R2 Express edition, 2GB RAM, 1GHZ CPU – running multiple sites. DotNetNuke

Stats before optimisation

WebPageTest.org results: Load time: 5.546s, First byte 1.491s, Start render 3.675s, Requests 66,

YSlow results: Overall performance score 70 Grade C
The page has a total of 46 components and a total weight of 558.8K bytes
Primed cache: HTTP Requests - 4, Total Weight - 56.2K

Google Page Speed results:
Page Speed Score of 54 (out of 100)
Not a good set of results but here are the steps to get the site running faster.

Server configuration - actions to complete

Enable content compression in: IIS Manager >> Compression
Add HTTP response headers in: IIS Manager >> HTTP response headers
(Enable HTTP keep alive and Expire web content after 7 days or as required)
Enable output caching in: IIS Manager >> Output Caching for the following file extensions .css, .gif, .jpg, .js and .png files (User-mode caching, using file change notifications)
This may not always be possible on the shared servers but if you do not ask you do not get.

Results:
WebPageTest results: Load time 3.82, First byte 1.489, Start render 2.751 Keep alive A, Compress Transfer A
YSlow results: Overall performance score 80 Grade C
Google Page Speed results: overall PageSpeed Score of 63 (out of 100)

DNN upgrade and configuration

Upgrade the site 6.02.05 >> 7.00.05 >> 7.03.04 (latest version)
Change the following settings in host >> host settings:
Basic settings - turn off copyright credits
Performance settings - cache setting heavy
Authenticated cacheability - Public
Client resource management - Enable Composite Files
Client resource management - Minify CSS
Client resource management - Minify JS
Scheduler mode - Timer Method
Enable Event Log Buffer - on
Auto sync file system - off
In Admin >> Site Settings turn off Enable Skin Widgets if not used

Results:
WebPageTest results: Load time 3.78, First byte 0.995, Start render 2.340 Keep alive A, Compress Transfer A, Effective use of CDN - yes
YSlow results: Overall performance score 83 Grade B
The page has a total of 34 components and a total weight of 331.9K bytes
Primed cache: HTTP Requests - 4, Total Weight - 23.4K
Google Page Speed results: overall PageSpeed Score of 88 (out of 100)

OK - getting better but still room for improvement.

Use Content Delivery Network

A CDN service will take all of your images, java script, and CSS (Cascading Style Sheets) and host them on to their network to quickly load them on your visitors browsers. Another benefit is that a CDN usually has a huge network of servers that are closer to your potential visitor ensuring that your site will load quickly wherever in the world they are visiting.
It has its drawback as you have to change your DNS settings to one supplied by CloudFlare however the process is very simple and takes 5 minutes. If your site has google ads or third party content you should try the rocket optimiser - free on all plans. Please check your site works as normal with rocket optimizer as it is still in beta at the time of writing this post.

Results:
WebPageTest results: Load time 3.01, First byte 0.995, start render 2.120 Keep alive A, Compress Transfer A, Effective use of CDN - yes
YSlow results: Overall performance score 94 Grade A !
The page has a total of 28 components and a total weight of 225.4K bytes
Primed cache: HTTP Requests - 2, Total Weight - 16.7K
Google Page Speed results: overall PageSpeed Score of 88 (out of 100)

Images, CSS, HTML

First to optimise the images, css files, and the code, implement sprites, optimise fav icon, replace deprecated menu.

Results:
WebPageTest results: Load time 2.361, First byte 1.230, start render 1.594 Keep alive A, Compress Transfer A, Effective use of CDN - yes
YSlow results: Overall performance score 95 Grade A !
The page has a total of 20 components and a total weight of 217.4K bytes
Primed cache: HTTP Requests - 2, Total Weight - 16.4K
Google Page Speed results: overall PageSpeed Score of 88 (out of 100)

How much has the speed of the site improved

WebPageTest results:
Load time improvement from 5.546 to 2.361 seconds
Start render improvement from 3.675 to 1.230 seconds
YSlow results:
Grade improvement from Grade C & score 70 to Grade A & score 95
Improvement from 46 components and a total weight of 558.8K bytes to 20 components and a total weight of 217.4K bytes
Google Page Speed
Improvement from PageSpeed 54 to PageSpeed 88

Note: "Without adding additional hardware I have managed to lower the load speed considerably. To improve it even more I could add more RAM and additional CPU on the server and move the database to its own full web edition SQL server, however with a current speed load below 3 seconds I could not justify the costs in this case. Please let me know if you have any other suggestions or what is your experience with the speed of your DNN sites".

I have recently been assigned to built a DotNetNuke web service to allow a windows application (or any type of web client for that matter) the ability to manage DotNetNuke user accounts (create, change roles, delete, retrieve email address, etc.).
Since I had a hard time finding a correct code sample or documentation that actually applies to DotNetNuke 7 and accessing it without being previously logged in to DotNetNuke, it was difficult to built anything. I finally found out how to do it correctly so I tough I would put my efforts to some use and write a blog post explaining how to do it step by step.

The basics

That said, let's begin by the basics and just make a publicly accessible web service that allows anyone to ping the web service and get a pong back. For that we will use the new DotNetNuke 7 Services Framework which makes it quite simple if you know how to use it.
In order to make a web service that will work withing DotNetNuke 7, you will need to fire up Visual Studio and create a Class Library project (c# or VB but all examples here will be in c#).
That done, we will then reference some required DotNetNuke 7 required libraries (using the Add Reference dialog box), here's the list:

• DotNetNuke.dll
• DotNetNuke.Web.dll
• System.Net.Http.dll
• System.Net.Http.Formatting.dll
• System.Web.Http.dll
  

Then we also need to reference the System.Web class from the .NET tab of the same dialog box.
Finally, we neet to set the output path of the project to the DotNetNuke bin directory and we are ready to code.
Here is the code, the explanations follow:

• We simply start with some using statements for our requirements as shown above
• We create a namespace for our service and whatever name we use here will be part of the url. I used MyService just for this example but use any name that makes sense for your service.
• Now we create a public class for our controller. You can create multiple controllers if you need to and the controller is just a group of related actions that make sense to group together. In my real project I have a PingController for testing purposes, a UsersController for any actions that relate to user accounts etc. Just use a name that makes sense since it will also show up in the url. Two things to be careful here:

• The name of your controller must end with the word Controller but only what comes before it will show in the url, so for PingController, only Ping will show in the url path.
• It must inherit DnnApiController so it will use the DotNetNuke Services Framework.

• Then we create the actual action, in our case, PublicPing. It is just a simple method which return an HttpResponseMessage and can have a few attributes. By default the new services framework will respond only to host users and you need to explicitly allow other access rights if needed, in this case the [AllowAnonymous] makes this method (or action if you prefer) available to anyone without credentials. The second attribute, [HttpGet] will make this action respond to HTTP GET verb, which is usually used when requesting some date from the web server.
• Finally in that action, you insert whatever code you action needs to do, in this case just return the string "Pong!", just remember that you need to return an HttpResponseMessage and not a string or int or other object.

Ok so our controller and action is done, now we just need to map that to an actual URL and that what the last part of the previous code does. In essence this code tells DotNetNuke to map a certain url pattern to the methods defined in your class. You can use that code as is just replacing MyService by whatever your service name is.

Testing:

That's all there is to it, your service is ready!  To test it, first compile it, then just navigate to http://yourdomain/DesktopModules/MyService/API/Ping/PublicPing and you should see "Pong!" in your browser as a response.

Passing parameters

Ok, so the basic code above is working but it doesn't do anything useful. Lets add something more useful by creating an action that will give us the email address for a specific user id.
Again, here's the code and the explanations will follow (place the code inside the same namespace as the previous one)

• First we build a UsersController class that will hold all actions related to user accounts, it is not absolutely necessary, you can have many actions in the same controller, however since this action is not at all related to our PingController, let'a make a new one more descriptive.
• We then make a GetEmail action (method) that will accept a userid parameter. The [RequireHost] parameter here will make it accessible only to host users, we'll see later other authentication options.
• The code in the method itself is pretty much self explanatory. The only interesting thing to note here is that because our class inherits DnnApiController, we already have a PortalSettings object available. That's the big advantage of making use of the DotNetNuke Services Framework. You will have a ModuleInfo object to represent your module (if there is one with the same name as your service, which is not necessary such in this case), a PortalSettings object that represents the portal at the domain name used to access the service (portal alias) and finally a UserInfo object representing the user that accessed the web service.

Testing:

If we now navigate to http://yourdomain/MyService/API/Users/GetEmail?userid=2 you should receive the email address back from the server unless of course that userid does not exist, make sure to test with a userid that actually exists for that portal. If you where not previously connected with a host account, then you will be asked for credentials.

Limiting access to certain roles

Ok, that works but you need to give host credentials to any person needing to use your webservice. To avoid that you can replace [RequireHost] by [DnnAuthorize(StaticRoles="Administrators")] which will limit access to administrators. Better but you still need to give them an admin account. So the easy way to give only limited access would be to create a new role in DotNetNuke just for your web service and replace Administrators by that specific role name in the authentication parameter.

Using HttpPost : (answer to a comment down bellow)

To answer Massod comment bellow, it is almost the same thing but you need to create an object to contain the posted data.
Let's make a simple ping that uses POST, first we need to create an object that will contain the posted data such as:

Then we create the service method something like this:

Note that normally, a post would only return ok and no message, I am just doing this so we can test here.

Now since this is a POST verb, we can't test it by only using url parameters, we need to make an html file with a form to test it out. It would be someting like this:

The important thing to not here is that you can't just create your POST method taking a string even if this is only what you need, you do need to create an object that will take your parameters.
Also don't forget that this is only for testing, you usually don't want to make this publicly available, you would normally use another parameter than [AllowAnonymous] such as  [DnnModuleAuthorize(AccessLevel = SecurityAccessLevel.View)] and [ValidateAntiForgeryToken] unless you really want that to be public.
Let me know if you have any more questions.

Fixing duplicate Display Names in DotNetNuke

Since DotNetNuke 6, it is possible to require unique display names. This allows social modules to display a name for a user without exposing the login UserName or the real person first and last names. If you site uses social features, it is important that those display names be unique to prevent a user to post content in the name of another user.
By activating this feature, users are no longer able to register with a Display Name already in use. However, there are 2 oversights. First, the user or an admin can change the Display Name after registration to anything else (including a Display Name already in use). Secondly, you may already have duplicates before you activate this feature, and they don't get automatically changed. In this blog post, I provide you with both solutions the these problems.
Prerequisites

BACKUP YOUR WEBSITE FILES AND DATABASE

This procedure has only been tested on DotNetNuke 7.3.3, so I recommend you first upgrade to this version. If you feel like trying it out on other versions, feel free to do it and post your results in the comments, but make sure you do that backup first.

1. Activating the feature

• First, we will activate the feature requiring unique display names.
• Connect to your website as an administrator
• Navigate to Admin -> Site Settings
• Click the User Account Settings tab
• In the Registration Settings section, tick Require Unique Display Name
• Click the Update button at the bottom
• Now, it will be impossible for user to register using a Display Name already used by another user.

2. Correcting the problem

• I created a patch or DotNetNuke 7.3.3 that will prevent users and admins to change the Display Name to something already in use. Like I said before, this is for DotNetNuke 7.3.3, feel free to test and comment on other versions, but make sure you have backup. I submitted a the bog repport DNN-5874 and patch (pull request 160 now pull request 177) to DotNetNuke and I hope it will be applied to DotNetNuke 7.3.4Upgrade DotNetNuke to version 7.3.3 (or try with another version and report in the comments)
• Download the file PatchDNN-5874.zip
• Extract that file to your root DotNetNuke folder overwriting the files
• (optional, if you site has other languages):

Go to Admin -> Languages
Translate those keys:
File                                                                                                                           Key
DesktopModules/Admin/Security/App_LocalResources/EditUser.ascx.resx      DisplayNameNotUnique.Text
DesktopModules/Admin/Security/App_LocalResources/User.ascx.resx          DisplayNameNotUnique.Text
We have now resolved this issue allowing users to change their display name to another one in use.

3. Fixing existing duplicates

• Now that the issue is resolved for the future, we need to resolve it for the past. Your site may already have duplicate display names before this patch. In order to solve that, I have created a small module that will display all duplicates and allow you to change them in batch by clicking a single button, it will append the UserID to the display name to all users except the first that registered with that display name.
• Download the file DuplicateDisplayNamesFix_00.00.01_Install.zip
• The source package is also available if you are a developer DuplicateDisplayNamesFix_00.00.01_Source.zip
• Install it like any other module (Host -> Extensions -> Install Extension Wizard
• Create a temporary page that is only visible by administrators (or use an existing admin page)
• Place the Duplicte Display Names Fix module on that page
• The module will display a list of all users with duplicate display names or a message if none are present
• You can export the list to Excel or CSV if you want to keep that information for your records (to send them an email for example)
• Now you can click the GO button to rename them. (this operation cannot be undone, make sure you have that backup.)

If you don't think to use the module again you can now uninstall it and delete the temporary page.

DNN 7.3 has been released and contains lots of changes for performance and stability, bug fixes and some new features.
I was first alerted to an issue with Url Master and DNN 7.3, who found that the API cleanup in 7.3 had removed an old DNN API that Url Master was leveraging, which meant that the site would stop working after the 7.3 Upgrade.   The error you get if you upgrade DNN without first upgrading Url Master to 2.8.2 is this:

500 Internal Server Error
The requested Url does not return any valid content.
Administrators
Change this message by configuring a specific 404 Error Page or Url for this website.

This is the default URL Master error output (unless you have debug mode enabled) which intentionally hides the actual exception for security reasons.  If you open the event log, you’ll find something like this:

Exception: Method not found: 'DotNetNuke.Entities.Portals.PortalAliasCollection DotNetNuke.Entities.Portals.PortalAliasController.GetPortalAliases()

The solution is that you need the latest version of the Url Master module, version 2.8.2, which uses a newer method to get the portal alias data.
Get the Url Master Module 2.8.2 Download

If you haven't upgraded to DNN 7.3 already, you must upgrade to 2.8.2 before upgrading.

Just download the 2.8.2 install package, and upgrade via the Host->Extensions page.  You do not need to update your licence – this version is available to *all* existing Url Master customers.

If you have already upgraded and have found that your site is dead with this error, then you will need to manually patch the files.  Here are the steps:

• Download the Url Master install package
• Extract the zip file locally on your computer to a folder, so you can see the files inside the zip
• Within the extracted zip file, you will see 4  files.
• Copy these 4 files into the \bin directory of your site that needs to be upgraded.  Use FTP or copy/paste or any other method to get it into the \bin directory.
• Once they are copied into the bin directory, try the site again.  It should start and run normally.
• Once your site is running again, install the (compressed) file as normal through the Host->Extensions page.  This won't change the versions installed, but it will bring your extensions catalog up to date.

I appreciate if people spread these instructions to those who are running Url Master and are intending to upgrade to 7.3 as a preventative measure.

GetTab Method without DNN Context

As you know, the simple method GetTab(int tabid) was obsolete and has been replaced by GetTab (ByVal TabId As Integer, ByVal PortalId As Integer, ByVal ignoreCache As Boolean). If you want to call the new method, we have to pass the additional parameter “PortalId”.
In common,  the object PortalSettings can be easy to get with DNN context, such as special dnn module & page; however, it may be inaccessible in some sceneries, such as separate aspx page or handler. Then is there any way to get the correct tab info with this new method? Now there is a simple trick to do it with passing into Null.NullInteger as the parameter PortalId. So the coding looks like that:

var tabController = new TabController();
var blogPage = tabController.GetTab(tabID, Null.NullInteger, false);

Deeping into the source code, you will find out that it always tries to get the correct PortalId for this tab/page object:

//if we do not know the PortalId then try to find it in the Portals Dictionary using the TabId
portalId = GetPortalId(tabId, portalId);
//if we have the PortalId then try to get the TabInfo object
tab = GetTabsByPortal(portalId).WithTabId(tabId) ??
        GetTabsByPortal(GetPortalId(tabId, Null.NullInteger)).WithTabId(tabId);

Hope this trick & tip helps if someone has the same issue.

Registered Script Control Error in DotNetNuke 7

If you’ve made the transition from DotNetNuke 6 to DotNetNuke 7 you’ve probably discovered that the AJAX Toolkit controls don’t play nice with DotNetNuke any more.  Fortunately the Telerik AJAX controls have been bundled with DotNetNuke for version 7.  I’ve discovered that converting to the Telerik controls has been beneficial and worth the upgrade.
Still, it can be a pain getting the code right.  One particular error that I ran into today was the Registered Script Control error.  It looks something like this:

"Script control ‘{controlname}’ is not a registered script control. Script controls must be registered using RegisterScriptControl() before calling RegisterScriptDescriptors().  Parameter name: scriptControl"

The error results from “stacked” AJAX controls.  Consider the following HTML

<%@ Register TagPrefix=”dnnui” Namespace=”DotNetNuke.Web.UI.WebControls” Assembly=”DotNetNuke.Web” %>
<%@ Register TagPrefix=”DNN” Namespace=”DotNetNuke.UI.WebControls” Assembly=”DotNetNuke.WebControls” %>
   <DNN:DNNTabStrip ID=”tabsProject” runat=”server” TabRenderMode=”All” Visible=”true”>
     <DNN:DNNTab runat=”server” Label-Text=”Properties” ID=”tabGeneral”>
       <dnnui:DnnAjaxPanel runat=”server” ID=”dapMain”>
         <asp:Label runat=”server” ID=”lblInfo”></asp:Label>
       </dnnui:DnnAjaxPanel>
   </DNN:DNNTab>
     <DNN:DNNTab runat=”server” Label-Text=”Properties” ID=”tabSecond”>
       <dnnui:DnnAjaxPanel runat=”server” ID=”dapSecond”>
         <asp:Label runat=”server” ID=”lblMessage”></asp:Label>
       </dnnui:DnnAjaxPanel>
   </DNN:DNNTab>
      </DNN:DNNTabStrip>

Let’s say that the second tab (tabSecond) should only appear under certain conditions; a record was created, a particular user is logged, whatever the condition is doesn’t matter, just that the tab should appear at certain times and not appear at other times.
In the code behind the condition block might look like this:

if (condition) then
tabSecond.Visible = False
end if

But this results in the Registered Script Control error.  Modify the condition block this way:

if (condition) then
dapSecond.EnableAJAX = False
tabSecond.Visible = False
end if

This should resolve the error

What was the issue?  I’m glad you asked.
The issue causing the error is that AJAX controls are registered with the AJAX script manager and cannot be unregistered, or moved.  Hiding an AJAX control is equivalent to moving it from the script.  In order to circumvent that we’re disabling AJAX on the control before it has a chance to be rendered and registered with the script manager.

Quick tips : Getting rid of spam users

After getting a couple of questions, I'd like to provide options for getting rid of spam users, which is cumbersome via UI, if thousands of registration have been added by a bot.
Unfortunately, it is not as easy as just deleting items from a single table, as user Information is distributed in multiple tables inside the database, therefore we need.
You are in a comfortable situation, if your site is using verified or private registration - in this case all spam users are unauthorized and you simply need to hit "delete unauthorized users" in Admin > User Accounts.
In all other cases, you will need to identify the users to delete from the database and mark as "deleted", in order to use "remove deleted users" (hard-delete) those users from all tables.

ALWAYS START WITH A DATABASE BACKUP!!

If your site only has a host and admin user you would run the following statement inside Host > SQL (check "run as script" in all DNN versions prior to 7.3):
UPDATE {databaseOwner}[{objectQualifier}UserPortals]
 SET   isDeleted = 1
 WHERE UserID NOT IN (SELECT UserID FROM  {databaseOwner}[{objectQualifier}Users
                                    WHERE isSuperuser = 1 OR UserName Like 'Admin')
If you may identify all users by registration date, e.g. since first of November, you would run
UPDATE {databaseOwner}[{objectQualifier}UserPortals]
 SET   isDeleted = 1
 WHERE UserID NOT IN (SELECT UserID FROM  {databaseOwner}[{objectQualifier}Users]
                                    WHERE isSuperuser = 1 OR UserName Like 'Admin' or CreatedOnDate < 2014-18-11)

Of course, this will become more difficult, if regular users registered the same time. You may consider creating a role "verifiedUsers" and move all regular users manually into this group. Now the command would look like

UPDATE {databaseOwner}[{objectQualifier}UserPortals]
 SET   isDeleted = 1
 WHERE UserID NOT IN (SELECT UserID FROM  {databaseOwner}[{objectQualifier}Users]
                                    WHERE isSuperuser = 1 OR UserName Like 'Admin' or CreatedOnDate < 2014-18-11)
   AND UserID NOT IN (SELECT UserID FROM {databaseOwner}[{objectQualifier}vw_UserRoles]
                                    WHERE RoleName Like 'verifiedUsers')

Afterwards you may use "Remove Deleted Users" link in Admin > User Management, to delete all rows.
For DNN Versions prior to DNN 7.3.1, you need to delete user folders manually, which reside nested inside users subfolder of the portal folder. Unfortunately, it is difficult to identify all folders from deleted users, but you may delete all empty folders without subfolder and files inside, as the folder for a still existing user will be re-created, once the user logs in again for the first time. You may use the following command (sing a command line on the server, while being inside the users folder)
for /f "delims=" %i in ('dir /ad /s /b') do @rd "%i"
Finally, you should enter file manager in DNN Admin menu and perform a recursive sync to get rid of all folder entries and folder permissions in the database

I am pleased to announce that DNN Platform 7.3.4 has been released. The 7.3.4 release is a stabilization release. DNN 7.3.4 is a smaller maintenance release than normal and is focused on addressing the most serious platform issues. It is expected that this will be the final platform release prior to DNN 7.4.0 which is expected to be released in January 2015. Once again the community has provided a number of significant fixes for this release. I look forward to increasing this level of participation coming in future releases.
You can find all of the issues resolved in this release in our issue tracker. Download 7.3.4 from the DotNetNuke Downloads page.

Major Highlights

• Fixed issue where site settings were not updating correctly in multi-language installations
• Fixed issue where partial site templates were not working correctly with child sites
• Fixed issue where links created in Telerik RadEditor were not correct
• Fixed issue where search results might be duplicated
• Fixed issue where user could not change default value for a profile property
• Fixed issue where a file uploaded from the web is not visible in the Host File Management
• Fixed issue where ControlBarController returned invalid JSON
• Fixed issue where you couldn't add a module in a spanish language site
• Fixed issue where a clustered index was missing from a search table
• Fixed issue where uploading an ICO file failed
• Fixed issue where HTML Editor Permissions were not working correctly
• Fixed issue where popups were not centered on the screen
• Fixed issue where popup iframe is not initialized correctly
• Fixed issue where AUM was not correctly handling 301 redirects
• Fixed issue where multiple region/country controls in a profile did not work correctly
• Added ability to save localized lists to resource file
• Added method to remove all subscriptions from a ContentItem

Security Issues

• None

Introduction

Recently there has been a lot of discussion in the community around DNN Spam registrations and methods and processes to prevent or fix the issues that are associated with them.  I've been debating on if/when I should actually write about this given that there is an Official DNN Software response on the issue, as well as many other community comments.  Well, when I had a server go down and guess what it was because of this very issue so I think its time to give my quick perspective and recommended action points for those of you that are running a DNN site.  These recommendations apply for ALL DNN versions!

Update Registration Mode Setting

If possible, set your registration mode to "none" if you don't need public registration.  This is a great first defense.  If this isn't possible, then go with the next best step and that is to create a custom registration page.  If you do this, though make sure that you follow the instructions in the next step.

Optional: Add IIS Request Filtering

One of the recommended "stop gap" items that DNN Corporation recommends for those that cannot set registration to "none" is to set a filter in IIS for request filtering.  I STRONGLY recommend this solution and am rolling this out to ALL DNN sites that I manage or have any control over that need to allow user registration.  This will prevent the most basic backdoor used by these scripters which should at least help limit things a bit.

Post Change Investigation & Resolution

This is the key, the above changes are quick & easy, but it is the investigation that is key.  I'm writing this post because of the investigation and resolution that I had to do tonight while on vacation.  I had a server that went down, with a clients database that grew from 45mb to almost 1gb in 7 days, had a user count grow from 2 users to 197,000 users in that same 7 day period.  All of this happened silently, without stressing server resources, without setting off any DDOS alerts or anything.  How did it become an issue today?  The site owner tried to make a change and then it fell on its face.

So, given that this can be a silent threat to your site, what do you need to look for, and what actions can you take to fix?  Lets look at these next.

Do you have impacted Users?

If you are lucky, your site will not have any impacted users and you can stop here.  However, if you go to "Admin" -> "User Accounts" and see that you have 50,000 users when you should only have 10 you have some work to do.  This is the fastest way to look at things and identify what is going on.  If you have rogue users you will need to do two things to truly 'clean' your installation from these user accounts.

Delete the User Accounts

The first step in resolution is to get rid of the users that are impacting the site.  How you accomplish this is going to vary a bit.  If you have 5, 10, 20 SPAM users, just manually use the DNN delete features, but make sure to note the User Id value for each user.  If you have a lot of users, for example in my case more than 100K users to remove, you are going to want to investigate a scripting solution.

I will not post direct SQL here as you NEED to be a user with proper SQL knowledge to do this, but you can do this VERY fast and very clean within DNN.  Simply set all of the users that you need to remove to "Deleted" in the database, then use the "Remove Deleted Users."  Now, this process of having DNN remove the users might need to be repeated as there is a 30 second timeout on DNN database queries.  In my case it took 10 attempts to remove all.

Delete the Folders & Re-Sync Files/Folders

This is one area that is not often remembered by administrators with fake accounts.  Each user that is created in more current versions of DNN have a folder created for them inside of the users folder within DNN.  You will want ot go in and delete all of these folders from the filesystem.  Then once that is completed you will want to go to "Admin" -> "File Manager" and sync the filesystem.  This is imperative as more entries in the folders and permissions table will slow down areas of the site that interact with these tables.

Conclusion

We need to see what the final fix is for this issue, but in the meantime we need to be vigilant and keep our own sites as protected as possible.  Given the nature of this issue I am being a bit vague in recommendations as the exact solution isn't going to be the same for all users and sites.

DotNetNuke is a widely adopted open source platform for building web sites and web applications with a Content Management System build on .NET. WebMatrix is a free tool that allows you to create, customize, and publish webpages. It gives a number of different ways that you can create websites. One of the features is providing existing open sources applications such as DotNetNuke, as well as WordPress, Joomla, DotNetNuke or Umbraco. In this tutorial, you will see how quick and easy it is to get your DotNetNuke application up and running! And show how to install, configure and publish a DotNetNuke application with WebMatrix.
If you do not already have WebMatrix, it can be downloaded for free at www.microsoft.com/web/webmatrix.
When you launch WebMatrix you will see several options on how to create a new application. To create a DotNetNuke application, select “App Gallery.”

We will now choose the “DotNetNuke Community Edition” icon to install the application. You can give your application a name or keep the default name.

You will be prompted to select a database. Select “SQL Server” and make sure the “Windows Integrated Authentication” radio button is selected and click Next.

You will be prompted to install DotNetNuke. To do this you must click the “I Accept” button.

Now we wait while DotNetNuke is installed. This make take up to a couple minutes.

Once the installation is complete we will get a confirmation.

Clicking the “OK” button will take us to our WebMatrix workspace with the DotNetNuke application loaded.

To configure our DotNetNuke application, we will use the Installation Wizard. To run our installation wizard, click the “Run” button on the Menu Ribbon. Note: make sure you run the root folder of the application. Running our application will open the DotNetNuke Installation Wizard. Here we will have three different options for installation: custom, typical and auto. For this article, we will use the typical installation.

To successfully install our DotNetNuke application, we must first pass a permissions check. The installation wizard will notify you if you passed the check or not.

After we pass the permissions check, we must enter our database information. In this example we’ll use a SQL Server 2005/2008 (Express) File.

Once the database connection is created, the installation wizard will install the database for you. The installation of the database can take quite a few minutes.

Once the database installation is complete, a confirmation message will appear at the bottom of the window. The “next” button will once again be enabled. We must click “next” in order to continue with the installation wizard.

We now will have to create a Host account. Fill in the form and hit the “next” button. It is a good idea to write this information down.

Once your installation is complete you will be able to access your portal and log in.

In order to customize our application, we now need to login to our site as an admin. You should have been automatically logged in when your site was created. Once you are logged in as an admin you will have access to more features that allow you to customize your page. A tool bar will be present at the top of the screen.
We can add a new page to our site by adding the required information of name, what template, and where to insert the page to our application.
Mouse over the Pages link at the top and click the “Add” link which will show us a form where we can fill out information about our page.

After filling out the information, select “Add Page” so that we are directed to where we can add content to the page. Do so by clicking on the “Edit Content” link. This will cause an edit box to appear where you can add text and images with styling options that code the HTML for you (if you are in the “design” tab).

Once we are done customizing our site, we can publish our application. There are several companies that are offering free WebMatrix hosting. You can find this information under the Publish icon on the ribbon or by clicking the link on your WebMatrix workspace.

And We created our DotNetNuke application.