• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3790
  • Last Modified:

Wordpress site spawning many php-cgi.exe processes with no site traffic

Here's the scenario:

I have three (3) separate WP websites running on a 64-bit Win 2008 R2 Server. All sites are setup identically using:
- FastCGI
- InstanceMaxRequests = 10000
- Separate app pools (integrated)
- All app pools identical in settings

While testing for the last few hours all sites has close to zero traffic...but...when I look at the process manager I find this:

Site #1 - one php-cgi.exe process running
Site #2 - dozens of php-cgi.exe processes running (always up to the Max Instances value)
Site #3 - dozens of php-cgi.exe processes running (always up to the Max Instances value)

Many of the processes are at zero cpu usage but are hogging memory.

The strange thing is that no matter what I do on site #1 (connecting with multiple browsers etc.) the site uses just one or two processes, and shuts them down pretty efficiently when done.

On sites #2 and #3 I can stop the app pool, make sure all processes are gone, then within a few seconds of restarting the app pool they have once again spawned the maximum number of php-cgi.exe processes (depending on what I have set as the Max Instances - I've tried it with many values from 0 to 50, and the results never vary). BTW, when I have Max Instances set to 0, sites 2 & 3 will spawn enough processes to spike the CPU at 100%.

Here's what I have tried, with no luck:

- Updating WP and all Pluings to most current versions
- Deactivating all plugins entirely
- Changing theme to a fresh WP 2014 theme
- Installing WordFence and blocking any IP ranges outside the USA (although there was only two hits from those the entire evening).
- Scanning with WordFence to find any security flaws (it came up with a clean bill of health)

So, what am I missing here?  Where do I look to figure out why one site runs beautifully and the other two act up?
  • 3
1 Solution
Jason C. LevineNo oneCommented:
Are you logged into the WordPress Dashboard when these processes spawn?
worthyking1Author Commented:
It makes no difference. They spin up regardless of whether I am logged into the WP dashboard or not.
worthyking1Author Commented:
Okay, i solved it. After digging through the server logs I discovered that the source of the problem was an attack on the xmlrpc.php file.  I know that (according to WP) there is no security issue any longer with this but it seems some idiot hackers still like to keep banging on it trying to get something to happen.

The two sites in question both had non-stop traffic coming primarily for the Ecatel Ltd. network in the Netherlands and one or two other random IPs from France, si I simply blocked those IP ranges using the Windows Firewall as I don't want this traffic to even reach as far as IIS.

Logs are back to being real small and CPU is normal. WP is spawning php-cgi.exe processes only as needed and recycling them normally.

Here's a decent thread describing the same issue (although with Linux solutions rather than Win 2008):
worthyking1Author Commented:
Being that there were no solutions provided by the membership I had to keep cracking until I solved it myself.  truthfully, I should have looked at my logs right at the beginning but the WP angle threw me off my normal game.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now