Oh hey, I wrote that last issue linked! What crazy Deja vu. Here’s me discovering the issue that led me to find some wild behavior. Basically Firefox loaded favicons 4x the number of tabs opened to that website. It would do this every time I opened or closed any tab. https://aggressivelyparaphrasing.me/2022/12/12/why-does-my-l... It was resolved a while back so maybe it’s similar symptoms but different root cause, or…
Wordpress handles 404s really slowly? I'm kind of surprised it works at all then, as at least in my logs there's a very steady stream of bots probing it for vulnerabilities by trying random URLs.
Over time, I found that BetterLinks was slowing down my site significantly (600ms) . It wasn’t like this when I first investigated. It became slow over the course of a year or so. I ended up replacing it with Simple 301 Redirects. I think this is a separate issue though, unrelated to my original overload, but looked very similar to when Firefox DOSed my site.
I experimented with CDNs to cache things reverse proxy style as a catch all. Eventually I caved and enabled Cloudflare CDN because QUIC.cloud kept having problems where a POP node kept hitting 403 Forbidden. I’d say the site is pretty functionally performant now.
I think most sites that claim Wordpress handles high loads really well have at least two layers of caching in front of it and are running on dedicated boxes. Remove both of those and suddenly it’s super easy to DOS.
Another common DOS exploit is to repeatedly spam the Forgot Password form, since there’s a lot of guaranteed processing with that and it’s not cacheable. I hid mine behind a captcha which helps a lot.