Small WordPress Website Suddenly Bringing Whole Server Down When Site Enabled

  • Resolved robinwilson16

    (@robinwilson16)


    9 years ago

    Hello All

    I run a web server (Ubuntu 15.10) hosting around 35 websites on Apache and MySQL and all was ok until tonight when CPU suddenly shot to 100% (it normally sits around 1-2%) and disk reads were suddenly hitting 15MB/sec (they are normally just over 0MB).
    This made all 35 websites operate extremely slowly or just time-out.

    After looking through log files I isolated it to a small WordPress site with a database size of 2.2MB. From the modified dates of the files this site has not been updated for around a year.

    If I disable this website (sudo a2dissite SITENAME) then everything returns to normal and all the other websites operate normally but as soon as I enable it again it instantly maxes out the server and causes all the sites to timeout again.

    The Apache access log for the site in question contains this line repeated a few times per second:

    "POST /xmlrpc.php HTTP/1.0" 200 597 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"

The error log contains many entries saying this:

    PHP Parse error: syntax error, unexpected ‘wp_list_pages’ (T_STRING) in /home/WEBSITE/public_html/wp-content/themes/THHEMENAME/parts/shared/sitemap.php on line 4
    (I replaced the website name and theme name)

    The MySQL log appears to show many processes being started simultaneously and having to be forcefully closed if I restart the mysql service.

    The website has been sitting happily on this server for around 2 years now and never been a problem before.

    Please can anyone tell me what I can do to track down what may be causing this? I can browse the database fine in PHPMyAdmin and it hardly has anything in it.

    From what I can see in the logs could it be some sort of scheduled task it is trying to run which is getting stuck maybe?

    Thanks
    Robin

Viewing 4 replies - 1 through 4 (of 4 total)
  • Vishnu

    (@bukge)

    Disable all plugin
    Change to default theme

    Avoid installing theme from spammy website using wordpress directory to download theme

    Thread Starter robinwilson16

    (@robinwilson16)

    Hello bukge

    Thanks for the reply but the theme was a customised version of the default one so is safe. It has been running unchanged for at least the last 2 years. The same plugins have also been active the past two years without any issues.

    As I can’t even access the WordPress website now as it just crashes the server how would I change the theme and disable the plugins?

    Looking further into this it would appear the website may be being attacked:
    https://www.saotn.org/huge-increase-wordpress-xmlrpc-php-post-requests/

    The IP address is from the Netherlands and it involves accessing xmlrpc.php.

    I have attempted some of the fixes though but it doesn’t seem to help.

    Any other suggestions would be appreciated.

    Thanks
    Robin

    Thread Starter robinwilson16

    (@robinwilson16)

    Is there anyone that can help at all?

    It seems there was a security issue in the version of WordPress that was running according to this article:
    https://www.saotn.org/huge-increase-wordpress-xmlrpc-php-post-requests/

    However, I have now updated WordPress to the latest version and updated all themes and plugins yet the issue is still occurring.

    Every second this is in the access log:
    `
    POST /xmlrpc.php HTTP/1.0″ 200 597 “-” “Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)

    This WordPress website is still causing 100% disk utilisation and 100% cpu utilisation.

    Surely WordPress websites shouldn’t be able to be taken down so easily?

    Thread Starter robinwilson16

    (@robinwilson16)

    I have now managed to fix this issue.

    It appears the issue which could be exploited two years ago can still be exploited now.

    The best fix I can find is to redirect POST and GET requests for xmlrpc.php back to the caller using .htaccess.

    Adding this line to .htaccess solves the problem:
    `Redirect 301 /xmlrpc.php https://127.0.0.1

    This is taken from: https://www.linuxbabu.net/2014/07/wordpress-xmlrpc-php-attack/

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Small WordPress Website Suddenly Bringing Whole Server Down When Site Enabled’ is closed to new replies.