This is one of the most irritating things to troubleshoot in cPanel, WHM, or whatever Linux hosting you’re using. What the heck is using all the processing bandwidth and ram. Your server is running along just fine, then just like that, everything is maxed and nothing loads.
Here are a few tips.
Obviously, make sure the theme and plugins are up-to-date. Old stuff causes issues with PHP updates and server software. Sometime you won’t see an update, but then if you update to a newer version of PHP, mysql, Imagick or something they are suddenly they are there. So Keep an eye on them.
Once that’s done, open your cPanel and look for the terminal. Open it up and type top -c. This is your best friend in figuring our what is using resources. It will spit out a realtime list with a server path to whats being called. Usually you’ll see something hitting a /index.php or /wp-cron.php in a specific folder over and over again.
top -c
wp-cron.php
If you’re seeing a bunch of stuff like: public_html/wordpress/cron or public_html/wordpress/wp-cron.php, you’ve got something rouge phoning home, or something remote trying to reach your server over and over again. Open up the cPanel file editor and navigate to your home directory and find the wp-config.php file. Add this to disable plugins and WordPress from sending communication from your site. You’d be surprised how many plugins send usage analytics back home. And not surprising either is how easy it is to abuse and hack those features.
define('DISABLE_WP_CRON', true) ;
xmlrpc.php
XML-RPC is a core WordPress API that has been enabled by default since WordPress 3.5 was released in 2012. It allows developers to remotely use XML and HTTPS protocols to connect to and interact with your WordPress website. Yeah, turn that off. In your WordPress directory look for .htaccess (make sure hidden files are visible), and add this to turn that off.
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>index.php
This one sucks. More than likely it’s a rouge bot(s) indexing your site or attacking the index file over and over again. Rouge bots are any bot that hit your website at no benefit to you. These bots consume server resources especially if they hit your website or wp-login page excessively. Blocking them can put less stress on your server and potentially save you bandwidth, hosting costs, and speed up your site. This can also prevent bad bots from appearing in your Google Analytics data.
A couple of solutions: Use CloudFlare as your DNS provider, Install Sucuri or WordFence or some other Firewall Plugin with excessive IP blocking, Install Blackhole for Bad Bots.
Send me a message