Too many requests are making it through to server

Security
#1

I have the following page-rules set up for my domain

1
blazor-university.com/wp-*
Cache Level: Bypass

2
blazor-university.com/*
SSL: Full, Auto Minify: HTML, CSS & JS, Rocket Loader: On, Browser Cache TTL: a day, Always Online: On, Cache Level: Cache Everything, Edge Cache TTL: a month, IP Geolocation Header: On

My server often returns 503 errors because it is overloaded, I noticed that the AWStats say in May I’ve had 18,336 visitors and served 103,623 pages.

I wouldn’t expect anything like this number of hits on my server. What am I doing wrong?

1 Like
#2

Because you have everything in “/wp-includes” bypass the cache.

2 Likes
#3

What a stupid mistake. Thank you!

#4

May I ask for a little more of your time, please?

Some of my files are showing cf-cache-status DYNAMIC, for example when loading the root page https://blazor-university.com I see the following

BYPASS - /favicon.ico
DYNAMIC - /wp-content/themes/gillian/js/widget-img-links.js?ver=20160820

How do I ensure these are cached too?

My rules are now as follows

1
blazor-university.com/?s=*
Cache Level: Bypass

2
blazor-university.com/*
SSL: Full, Auto Minify: HTML, CSS & JS, Rocket Loader: On, Browser Cache TTL: a day, Always Online: On, Cache Level: Cache Everything, Edge Cache TTL: a month, IP Geolocation Header: On

#5

ICO files should be automatically cased, as well as JS files. If they dont it is either caching headers sent by your server which prevent caching or page rules.

Considering your page rules do not seem to prevent it, it probably is the caching headers. Check whatever your server sends, and also use the search here, as that topic has been covered a few times already.

#6

Thanks for your help!

Is there something obvious you can see in these response headers? I can’t see what it is.

HTTP/2 200 OK
date: Sun, 24 May 2020 11:35:05 GMT
content-type: text/javascript
x-server: 3047
last-modified: Wed, 27 Nov 2019 22:25:51 GMT
etag: W/“cc-5985b7ab6008f”
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri=“https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct”
server: cloudflare
cf-ray: 5986b613dcede58b-MAN
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 02e810206a0000e58bb9950200000001
X-Firefox-Spdy: h2

#7

This is a request to Cloudflare, you need to get the headers which your server sends. Again, please use the search, there is reason why it is there :wink:

#8

I have searched, but I didn’t find what I was looking for.

#9

Does your server IP address end in 137?

#10

Yes, that is correct.

#11

It is a bit unrelated, but in that case the first concern would be that you dont have a valid certificate on your server and hence cant use the only secure encryption mode “Full strict”. That is something you should address.

#12

At the moment I don’t have a certificate on the server. I use the HTTPs option on CloudFlare to get around that problem.

Could my problem be related to that?

#13

You do have a certificate but it is self-signed and hence not secure. You should replace that with a proper certificate (can also be an Origin certificate which you download from Cloudflare).

It shouldnt be the main reason for the issue however. Your ICO file, for example, is only a redirect to a PNG file and that file actually gets cached.

#14

Hi Sandro. Thanks for all your time on this, I really appreciate it!

Here are the header responses for the file I mentioned earlier
/wp-content/themes/gillian/js/widget-img-links.js?ver=20160820

   Accept-Ranges: bytes
   Connection: Keep-Alive
   Content-Length: 204
   Content-Type: text/javascript
   Date: Fri, 29 May 2020 17:00:46 GMT
   ETag: "cc-5985b7ab6008f"
   Keep-Alive: timeout=5, max=98
   Last-Modified: Wed, 27 Nov 2019 22:25:51 GMT
   Server: Apache
   X-SERVER: 3047

And these are the CloudFlare response headers

HTTP/2 200 OK
date: Sun, 24 May 2020 11:35:05 GMT
content-type: text/javascript
x-server: 3047
last-modified: Wed, 27 Nov 2019 22:25:51 GMT
etag: W/"cc-5985b7ab6008f"
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5986b613dcede58b-MAN
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 02e810206a0000e58bb9950200000001
X-Firefox-Spdy: h2

Is there something you can see that is wrong with the headers from my server that would cause this?

Many thanks!

#15

That file actually gives me a HIT, however I’d really prefer if you could install a proper certificate as I am not overly comfortable supporting an insecure setup to be honest.

Issueing an Origin certificate takes a few minutes and configuring it on the server shouldnt take much more.

#17

I didn’t think my host made that a simple process, but I found the instructions and have followed them. The origin site should be SSL now, and my SSL option is set to FULL.

I think all of my responses are coming back as HIT now. Is that what you are seeing too? If so, was not having a certificate on my host the cause of the problems?

#18

The certificate shouldnt have been the issue, however the certificate you installed only covers your naked domain. You must have removed the wildcard. Revoke that certificate and get a new one issued with blazor-university.com and *.blazor-university.com. That will also cover “www”.

Then set the SSL option to “Full strict”.

#19

Okay, done both of those things.

#20

Looks secure now. And I do get hits too, though that still should not be HTTPS related, but having a proper certificate in place is still important, otherwise the site is not really secure.

I think you are all set :slight_smile:

#21

I appreciate your help very much, thank you! I would never have worked this out without your help!

May I send you a tip to buy yourself a beverage of your choice?