Wordpress site spawning many php-cgi.exe processes with no site traffic

Here's the scenario:

I have three (3) separate WP websites running on a 64-bit Win 2008 R2 Server. All sites are setup identically using:
- FastCGI
- InstanceMaxRequests = 10000
- PHP_FCGI_MAX_REQUESTS =10000
- Separate app pools (integrated)
- All app pools identical in settings

While testing for the last few hours all sites has close to zero traffic...but...when I look at the process manager I find this:

Site #1 - one php-cgi.exe process running
Site #2 - dozens of php-cgi.exe processes running (always up to the Max Instances value)
Site #3 - dozens of php-cgi.exe processes running (always up to the Max Instances value)

Many of the processes are at zero cpu usage but are hogging memory.

The strange thing is that no matter what I do on site #1 (connecting with multiple browsers etc.) the site uses just one or two processes, and shuts them down pretty efficiently when done.

On sites #2 and #3 I can stop the app pool, make sure all processes are gone, then within a few seconds of restarting the app pool they have once again spawned the maximum number of php-cgi.exe processes (depending on what I have set as the Max Instances - I've tried it with many values from 0 to 50, and the results never vary). BTW, when I have Max Instances set to 0, sites 2 & 3 will spawn enough processes to spike the CPU at 100%.

Here's what I have tried, with no luck:

- Updating WP and all Pluings to most current versions
- Deactivating all plugins entirely
- Changing theme to a fresh WP 2014 theme
- Installing WordFence and blocking any IP ranges outside the USA (although there was only two hits from those the entire evening).
- Scanning with WordFence to find any security flaws (it came up with a clean bill of health)

So, what am I missing here?  Where do I look to figure out why one site runs beautifully and the other two act up?
LVL 6
worthyking1CTOAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jason C. LevineNo oneCommented:
Are you logged into the WordPress Dashboard when these processes spawn?
0
worthyking1CTOAuthor Commented:
It makes no difference. They spin up regardless of whether I am logged into the WP dashboard or not.
0
worthyking1CTOAuthor Commented:
Okay, i solved it. After digging through the server logs I discovered that the source of the problem was an attack on the xmlrpc.php file.  I know that (according to WP) there is no security issue any longer with this but it seems some idiot hackers still like to keep banging on it trying to get something to happen.

The two sites in question both had non-stop traffic coming primarily for the Ecatel Ltd. network in the Netherlands and one or two other random IPs from France, si I simply blocked those IP ranges using the Windows Firewall as I don't want this traffic to even reach as far as IIS.

Logs are back to being real small and CPU is normal. WP is spawning php-cgi.exe processes only as needed and recycling them normally.

Here's a decent thread describing the same issue (although with Linux solutions rather than Win 2008):
https://wordpress.org/support/topic/xmlrpcphp-attack-on-wordpress-38
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
worthyking1CTOAuthor Commented:
Being that there were no solutions provided by the membership I had to keep cracking until I solved it myself.  truthfully, I should have looked at my logs right at the beginning but the WP angle threw me off my normal game.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
WordPress

From novice to tech pro — start learning today.