Bad traffic stopped before the server
Rules to challenge unverified visitors and rate-limit the old domain, block crawler patterns on uncacheable pages, and remove obsolete DNS records.
Case study · Hosting, Cloudflare & WooCommerce performance
A cloud server hosting several busy WooCommerce shops and business websites began hitting 90 to 100% CPU without warning. Pages slowed, then timed out, and client websites went offline while customers were trying to buy.
There was no single obvious cause. Traffic floods, crawlers, caching and the shops themselves all played a part. Solving it meant understanding the whole stack, not just one layer of it.
Discuss a performance problemThe situation
When a shared server runs out of capacity, every website on it suffers. The phones were ringing, and the first job was to get client sites working again without guessing at the cause.
The investigation
Each finding narrowed down the next question. Several separate problems had combined to overwhelm the server.
The shop’s old domain, kept only to redirect visitors, was receiving around 245,000 requests a day from automated crawlers. Every request was redirected to the live shop’s homepage, quietly adding load the main site’s figures didn’t show.
Cloudflare’s analytics showed fewer than 30 requests a minute reaching the server during a full CPU spike. That was far too little traffic to explain the load, so the cause had to be inside the server.
Slow-request logging showed crawlers working through endless combinations of WooCommerce product filters and add-to-basket links. Each of those pages has to be built from scratch, so every visit cost real server time.
A large mega menu and a slow theme feature were rebuilt on every page. The database cache had been switched off after it ran out of memory, so every page went back to the database again and again.
The server’s code cache was full, duplicate optimisation layers were doing the same work twice, and background tasks were running on visitors’ page loads.
What we changed
No single change would have solved this. The fix was a set of targeted improvements at each level of the stack.
Rules to challenge unverified visitors and rate-limit the old domain, block crawler patterns on uncacheable pages, and remove obsolete DNS records.
The mega menu is now cached, the slow theme feature was fixed, and crawlers are steered away from filter and basket links.
The cache was re-enabled with a sensible memory limit, so it can no longer grow until it crashes, and moved to a faster connection.
A larger code cache, fair limits per site, and duplicate optimisation layers removed where caching was already handled elsewhere.
Scheduled WooCommerce tasks now run on a proper server timer, instead of slowing down whoever happens to visit.
The largest shop’s image library was moved to separate cloud storage, freeing space and memory on the server.
The result
Server load dropped from peaks of 40 to 65 down to a steady 2.5 to 5, with CPU running at 15 to 40% instead of being pinned at 100%. Slow requests went from about 138 an hour to almost none.
Pages now build about twice as fast, and the busiest shop makes a tenth of the database queries it did before. Every client website on the server came back online and has stayed stable since.
Why it matters
When a server runs out of capacity, the easy answer is to buy a bigger one. Here, that would only have given the crawlers and bots more room to consume, with the monthly bill rising and the real causes still hidden.
Finding out what was actually using the server meant the existing one was more than enough. Problems like this also tend to bounce between suppliers: the host blames the website and the developer blames the host. Because we work across Cloudflare, the server and the WooCommerce code, we followed the evidence wherever it led and fixed each layer directly.
Tell us what is happening. We will look at the evidence across Cloudflare, the server and the website, and explain the sensible next step.
Call 0333 444 0283 or contact Digital Flair.