Black Friday: 7 server checks before the traffic spike

# Three requests in a row on a public page: the second should be faster
for i in 1 2 3; do
  curl -s -o /dev/null -w "HTTP %{http_code}  TTFB %{time_starttransfer}s\n" https://example.com/
done

# Cache headers returned by the server
curl -s -o /dev/null -D - https://example.com/ | grep -iE "^x-.*cache|^cache-control|^age:"

# The cart must answer no-cache
curl -s -o /dev/null -D - https://example.com/cart/ | grep -i "x-litespeed-cache"

sudo apt install redis-server

# Redis must listen locally only
ss -ltnp | grep 6379
redis-cli ping

# Example value: size it to your VPS memory
maxmemory 256mb
# Recommended by the Redis documentation as the default choice for a cache
maxmemory-policy allkeys-lru

sudo systemctl restart redis-server

wp plugin install redis-cache --activate
wp config set WP_REDIS_HOST "127.0.0.1"
wp config set WP_REDIS_PORT "6379"
# A prefix matters if several sites share the same Redis
wp config set WP_REDIS_PREFIX "shop_"
wp redis enable
wp redis status

redis-cli INFO stats | grep -E "keyspace_(hits|misses)|evicted_keys"

// load.js
import http from 'k6/http';
import { check, sleep } from 'k6';

const BASE = __ENV.BASE_URL;

export const options = {
  // Example stages: start from last year's peak, taken from your analytics
  stages: [
    { duration: '2m', target: 20 },
    { duration: '5m', target: 20 },
    { duration: '2m', target: 50 },
    { duration: '5m', target: 50 },
    { duration: '1m', target: 0 },
  ],
  thresholds: {
    // Fewer than 1% errors
    http_req_failed: ['rate<0.01'],
    // 95% of responses with a first byte under 800 ms
    http_req_waiting: ['p(95)<800'],
  },
};

export default function () {
  // A cached page, a product page, a search (never cached)
  const pages = ['/', '/product/example/', '/?s=gift&post_type=product'];
  for (const path of pages) {
    const res = http.get(`${BASE}${path}`);
    check(res, { 'status 200': (r) => r.status === 200 });
    sleep(1);
  }
}

docker run --rm -i grafana/k6 run -e BASE_URL=https://example.com - <load.js

# si/so columns: swap; wa: disk wait. One line every 5 seconds
vmstat 5

# Web server errors during the test window
sudo tail -f /var/log/nginx/error.log

systemctl is-active qemu-guest-agent

# Record which plugins auto-update, so you can restore them after the sale
wp plugin auto-updates status --all --enabled-only --field=name > ~/auto-update-plugins.txt

# Pause plugin and theme auto-updates
wp plugin auto-updates disable --all
wp theme auto-updates disable --all

# After the sale: restore the original settings
xargs -r wp plugin auto-updates enable < ~/auto-update-plugins.txt

# Consistent dump of an InnoDB database, without locking tables
mysqldump --single-transaction --quick --routines --triggers shop | gzip > ~/shop-$(date +%F).sql.gz

# Restore into a throwaway database, timed
mysql -e "CREATE DATABASE restore_test"
time (gunzip -c ~/shop-$(date +%F).sql.gz | mysql restore_test)

# Compare order counts: wp_wc_orders if the store uses HPOS,
# otherwise wp_posts with post_type = 'shop_order'
mysql -N -e "SELECT COUNT(*) FROM shop.wp_wc_orders"
mysql -N -e "SELECT COUNT(*) FROM restore_test.wp_wc_orders"

# Clean up
mysql -e "DROP DATABASE restore_test"

#!/usr/bin/env bash
# ttfb-check.sh — run it from a different machine than the monitored server
set -u
URLS=("https://example.com/" "https://example.com/cart/")
THRESHOLD=0.8                                 # seconds
WEBHOOK="https://hooks.example.com/your-webhook"  # Slack or Mattermost incoming webhook
STATE=/var/tmp/ttfb-check
mkdir -p "$STATE"

for url in "${URLS[@]}"; do
  key=$(printf '%s' "$url" | md5sum | cut -c1-12)
  result=$(curl -o /dev/null -s --max-time 10 -w '%{http_code} %{time_starttransfer}' "$url")
  code=${result%% *}
  ttfb=${result##* }
  if [ "$code" != "200" ] || awk -v t="$ttfb" -v s="$THRESHOLD" 'BEGIN { exit !(t > s) }'; then
    n=$(( $(cat "$STATE/$key" 2>/dev/null || echo 0) + 1 ))
    echo "$n" > "$STATE/$key"
    # Alert on the third consecutive failure, not on a single blip
    if [ "$n" -eq 3 ]; then
      curl -s -X POST -H 'Content-Type: application/json' \
        -d "{\"text\": \"$url: HTTP $code, TTFB ${ttfb}s\"}" "$WEBHOOK" > /dev/null
    fi
  else
    echo 0 > "$STATE/$key"
  fi
done

sudo install -m 755 ttfb-check.sh /usr/local/bin/ttfb-check.sh
# One measurement a minute: alert after three minutes of slowness
( crontab -l 2>/dev/null; echo "* * * * * /usr/local/bin/ttfb-check.sh" ) | crontab -

NS=$(dig +short NS example.com | head -1)
dig +noall +answer example.com A @"$NS"
dig +noall +answer www.example.com A @"$NS"
# The second field of each line is the TTL, in seconds

wp core version
wp plugin list --update=available --fields=name,version,update_version

# /etc/fail2ban/jail.local
[DEFAULT]
# Your fixed addresses (office, agency) must never be banned
ignoreip = 127.0.0.1/8 ::1 203.0.113.10

[sshd]
enabled = true
backend = systemd

# In the http block — example rate, adjust it
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

# In the server block, before the generic PHP location
location = /wp-login.php {
    limit_req zone=login burst=5 nodelay;
    include snippets/fastcgi-php.conf;
    # Match the socket to your PHP version
    fastcgi_pass unix:/run/php/php8.4-fpm.sock;
}

# Add to /etc/fail2ban/jail.local
[nginx-limit-req]
enabled = true
backend = auto
logpath = /var/log/nginx/error.log

sudo nginx -t && sudo systemctl reload nginx
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd
sudo fail2ban-client status nginx-limit-req

sudo fail2ban-client set nginx-limit-req banip 198.51.100.7
sudo fail2ban-client set nginx-limit-req unbanip 198.51.100.7