Case studies

Problem, cause, fix, result.

Real jobs from my work, anonymised. Where a cause is likely but not proven, I say so.

UK online store, WooCommerce on a VPS

17.8→~2server load

Problem: CPU and memory kept spiking and the store slowed down for real customers.
Cause: A site-copying scraper spread across roughly 4,400 IP addresses, plus aggressive crawlers, and WP-Cron running on every page view.
What I did: Identified and blocked the scraper network from the access logs
Rewrote robots.txt to rein in crawlers that respect it
Moved wp-cron to a real system cron job
Result: Server load dropped from 17.8 to about 2.

The same UK store, a few weeks later

2.7→1.3server load

Problem: Checkout was hammered with fake payment attempts.
Cause: About 9,300 POST requests from one source testing stolen cards, plus a headless scraper.
What I did: Blocked the source and the headless scraper
Added nginx rate limiting on checkout at 2 requests per second
Result: Load dropped from 2.7 to 1.3 and the fake orders stopped.

CloudPanel server, around 18 WordPress sites

4.24→0.79server load

Problem: All four CPU cores were stuck at 100%.
Cause: One compromised site: 5,095 hidden folders and an active backdoor.
What I did: Traced the load to the infected site through processes and logs
Found the hidden folders and the backdoor
Blocked PHP execution in paths where it should never run (cache, uploads)
Result: Load dropped from 4.24 to 0.79.

Hungarian tourism website

Problem: The site needed to leave its old server without breaking.
Cause: Old stack, plus an IPv6 conflict that surfaced during the move.
What I did: Migrated to a new server running CloudPanel and MySQL 8.4
Resolved the IPv6 conflict and updated DNS
Added rate limiting for heavy map pages that bots were abusing
Result: Site running on the new server, with the map pages protected from bot traffic.

Node.js application server

Problem: An XMRig miner reappeared even after the app had been migrated.
Cause: The likely source was an npm postinstall hook in the project's dependencies.
What I did: Tracked the miner process back to how it was being started
Identified the npm postinstall hook as the probable entry point
Result: Likely cause identified, so it could be removed at the source instead of after every deploy.

My own Postal mail server

Problem: Outgoing mail suddenly stopped reaching inboxes.
Cause: An SPF hardfail on the HELO hostname, and a firewall rule that had disappeared after a change.
What I did: Checked SPF for HELO and MAIL FROM separately, since receivers evaluate both
Published a correct SPF record for the HELO hostname
Restored the firewall rule and made it persistent
Result: Sending restored, and both fixes survive reboots.

FreeScout on a client server

Problem: Every search showed an empty white page.
Cause: Wrong permissions on cache folders, hidden because debug output was misconfigured.
What I did: Fixed cache folder permissions
Turned debug mode off in production
Result: Search works again.

Self-hosted bulk email platform

Have a similar problem?

Send me the domain and a short description of what's happening.