Monitoring

auditd for WordPress: who changed wp-config.php, and which process ran it After an incident, file timestamps say that wp-config.php changed at 03:12, but not who changed it or how: an SFTP user, a compromised plugin through PHP, a cron job. The Linux audit system records such events in the kernel, with the user, the process…

MySQL replication with GTID for WordPress: set up, monitor, fail over A replica of the WordPress database gives a second copy that is seconds behind, a place to run heavy reports and backups without touching the primary, and a server to switch to when the primary fails. GTID-based replication (global transaction identifiers) makes the last…

Limit PHP-FPM, cron and imports with systemd slices and cgroups v2 On a server that runs several WordPress sites, one site’s runaway import or a crawler storm on another can take all CPU and memory, and every site becomes slow. Linux cgroups v2 can cap a group of processes, and systemd exposes them through simple…

sysctl and TCP settings for a busy WordPress server: what actually matters Lists of “kernel tuning for high traffic” circulate with dozens of sysctl values, most of them copied from servers with very different workloads. On a WordPress server, the limits that are reached in practice are few: the connection backlog when a traffic spike…

The Linux OOM killer and swap on a WordPress server When a Linux server runs out of memory, the kernel’s out-of-memory killer picks a process and kills it. On a WordPress server, the process with the most memory is usually MySQL, so the site goes down with “Error establishing a database connection”, although the real…

InnoDB buffer pool for WordPress: size it, then check that it works The InnoDB buffer pool is MySQL’s memory cache for table and index pages. When the working set of a WordPress database (the posts, the meta, the options, the WooCommerce lookup tables that are actually read) fits into it, queries are served from RAM.…

File integrity checks for WordPress: find modified and injected files After a hack, the first question is “which files were changed?”. Without a reference, nobody can say whether wp-includes/functions.php is original or has three extra lines at the end. WordPress publishes checksums for every core release, WP-CLI compares against them, and for plugins and themes…

Log rotation for WordPress, Nginx and PHP-FPM with logrotate and journald Logs grow quietly. A busy site writes hundreds of megabytes of Nginx access log per week, a plugin with a notice in a loop fills debug.log with gigabytes, and one day the disk is full and MySQL stops. Two tools keep logs in check…

MySQL triggers as an audit log for WordPress options Some changes in a WordPress database come from nowhere: the admin email is suddenly different, users_can_register is on, a plugin appears in active_plugins. A logging plugin records what happens through WordPress, but not what a script, a database tool or an attacker with database access changes…