I should pre-empt this topic by saying that my expertise is limited, and if I say things that don’t make sense, please excuse me!
I will try to lay out as much information, and the issues that we are facing with our website and hopefully we can try work out if there are solutions to my issues.
Ok, starting point. we are using Wordpress & Woocommerce. I use Cloudways as hosting and have used Cloudflare for some time now, but never really gone outside of the default settings. In Cloudways, we have 16GB Ram, 320GB SSD Disk, 6TB Transfer, 6 Core Processor. Just writing what we have direct from Cloudways, as I don’t fully know what any of that means.
Our website has on average 12k page views, and around 2k users per day. Not sure if this is useful, but wanted to put as much information as I can to help with the troubleshooting.
For the most part, our website runs relatively ok but then there are weeks like this one where things seem to be really sluggish. We have issues with uploading images, and making changes within Wordpress. We recently started to receive more than regular 502, 503, 524 errors. To the point where it was really ridiculous.
Going into Cloudways I could see that CPU was 100%…
and looking at the Idle CPU over the last week, there are definite moments where it’s almost at 0% availability.
I looked over the past 6months and there was a decent amount of time (in my opinion at least) where it was below 20%, so followed the advice and increased our server size. That’s one of my go to solutions, ha. If the cost is $30 a month to double our server size, I will go down that route to try resolve matters. The small cost outweighs the amount of time it would take me to fully understand and get to the bottom to the problem (hence my previous post to try get one-to-one assistance).
So before I made the change, I was on 8GB Ram, 16GB SSD Disk, 5TB Transfer and 4 Core Processor (see above for current).
Surprisingly (to me) this didn’t actually resolve the matter. The CPU usage was still 100% and we were still receiving error messages and sluggish website.
I raised a chat with Cloudways Support, and they looked into the matter and saw that we were getting a large volume of non-legitimate traffic requests. They mentioned that in the logs there were links for viagra/escort services, which isn’t related to our site and they suggest that we had been infected by malware, which obvs sent my heart rate to the moon. They said to set the I am Under Attack mode in Cloudflare to bring down the number of requests, which I did.
At this point, I ran some Malware scans from a previous WP plugin that we used back in 2017 when we had an issue. Nothing came back as weird, no issues. I also signed up with Sucuri (as cloudways suggested) to check and they found no issues either. I spoke with the Malware plugin dev, and he mentioned that it is something that our hosting provider will need to mitigate to prevent the DDoS attacks from affecting our site accessibility
Cloudways have said there is nothing that they can do about the DDoS attacks themselves, but again pointed me Sucuri and back to Cloudflare to apply some WAF, Argo, and some other rules in order to take this under control. I know we don’t have WAF set up, but know that we have Argo switched on.
I tried to do some reading to understand what I need to set-up to help, and found Rate Limiting, as that seemed to sound like it was something that I could use but didn’t know what settings to use, and playing around I found that it was affecting our checkout process on the woocommerce side. Once I saw that it impacted the checkout process, and potential customers, I switched it off.
I think at this stage, I decided I don’t know wtf I am doing and should really find a professional to help me out. Again, back to my post earlier looking for one-to-one assistance.
There is a lot to unpick here, that’s why I am honestly not sure that this is the right place as I’m sure there could be 10 different opinions about a number of the issues I have mentioned above, and I’m sure there are things that I might have inadvertently missed too.
If there is anything that can be done to help, I would love to hear your thoughts.
tl;dr: I need a beer