Hello,
Our site is continuing to experience 503 errors when there is an increase in traffic. Our web host believes that the Newspaper theme is the cause, please see the below and advise.
the admin-ajax.php script is still being execution unusually high amount of times.
Code:
11618 http://spurs-web.com/wp-admin/admin-ajax.php /home/neilv206/public_html/wp-admin/admin-ajax.php
The admin-ajax.php call is generated by the theme from what I can tell.
Code:
admin-ajax.php?td_theme_name=Newspaper&v=7.3
Code:
176.35.25.203 – – [25/Jul/2018:08:58:02 -0500] “POST /wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=7.3 HTTP/1.0” 200 13 “https://www.spurs-web.com/spurs-news/tottenham-target-ready-to-depart-current-club/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299”
Each request towards the website generates such admin-ajax.php call, which is unusual. What I can suggest you is to contact the theme developers and ask them to check this abnormal behavior further.
I think you need to cut back on things which call ajax in the theme, and also consider using tools like the Limit Login Attempts plugin, and also disable XMLRPC, which can cause overloads.
Note right now that bots are pummeling WordPress sites looking for older versions which are not secure, BootStrap 3 which is not secure, several insecure plugins, and some vulnerabilities in odd versions of PHP, etc.
Generally, the idea is to limit the type of modules being called, don’t use mega menus, don’t use stuff that connects to external sites (JetPack, or “how many likes on xxx”), infinite loading, randomization queries, etc. For instance, no more than two modules on sidebar, disable stuff like “popular posts” and “more from author…” stuff.
All that ‘dynamic’ stuff is a query to the PHP system. Anything with ajax calls has to actually use the WP ajax script … so, your audit needs to start by turning as much off that is glitz and serves no intrinsic purpose, then evaluate what you can live with vs not having dedicated server to manage DDoS and other stuff.
ALSO, just as important: read the “hardening WordPress” section in the docs on WordPress.org, as that can help quite a bit as well.
In our case we needed to run IPtables + Fail2Ban + (D)DoS Deflate – to stop being pummeled by bots, some hitting up to 1800 connections in 5 minutes to a news portal.
