Symptoms
- High CPU, memory pressure, load average, disk I/O, or database connections.
- Slow requests, 502/503 responses, PHP worker exhaustion, or hosting alerts.
- Usage rises on a schedule or after a deployment, campaign, import, scan, or bot event.
Likely causes
Possibilities include legitimate traffic, aggressive bots, uncached dynamic requests, WP-Cron backlogs, Action Scheduler jobs, slow database queries, PHP errors, backup or security scans, image processing, external API timeouts, a plugin loop, or constrained hosting. Resource usage alone does not identify which one.
Diagnostic steps
- Define the affected resource, time window, baseline, and customer impact.
- Correlate process, web access, PHP, database, cron, and application logs.
- Review request paths, status codes, user agents, cache hit ratio, slow queries, and external calls.
- Inspect WP-Cron and Action Scheduler queues for repeated or overdue work.
- Profile on staging or use a production-safe application monitor; avoid broad live deactivation.
- Check disk capacity, inode usage, database size, autoloaded options, and backup schedules.
Resolution steps
Address the measured source: rate-limit abusive traffic, fix the failing job or query, introduce appropriate page/object caching, move scheduled work to system cron, optimize images, repair external-call timeouts, adjust worker capacity, or upgrade hosting when verified demand exceeds the plan.
Escalation conditions
Escalate with a bounded time window, graphs or command output, top processes and request paths, relevant log excerpts, recent changes, traffic context, and actions already tested. Redact IPs or customer data when they are not necessary.
Customer-safe explanation
“The server is spending more capacity than expected, but the usage graph does not reveal the cause by itself. We are correlating requests, scheduled jobs, database work, and recent changes to find the specific workload before changing the site.”