olespete
Member
OP
Trust No One
- Joined:
- Jun 2024
- Posts:
- 270
- From:
- Unknown
Wordfence eating ALL my CPU allowance on Hostinger shared plan. Went from 20% to 95% overnight, site barely loads now. Disabled every other plugin, still hammered. What could go wrong: backdoor in the plugin, compromised update server, supply chain attack, bitcoin miner injected into scan engine. I warned people about nulled plugins but this was "from the official repo" supposedly!
Running fail2ban on my home server but shared hosting no root access so I'm BLIND here. Need to audit file integrity, can't without shell. 👀
Anyone else seeing Wordfence CPU spikes this week or am I the canary in the coal mine
airgapped, encrypted, faraday'd, still worried
RAJ
Member
- Joined:
- Jul 2024
- Posts:
- 294
- From:
- Mumbai, IN
Hey guys, tough spot. Any leads on alternative security plugins? I got clients on Hostinger too, need to check their sites now. Margins are thin so I can't afford CPU overage charges, you know? 🙏
Might switch some accounts to InterServer if this keeps happening. What panels do they use, anyone know?
your margin is my opportunity
steveipw
Member
- Joined:
- Jun 2024
- Posts:
- 163
- From:
- Denver, US
Your Wordfence scans are probably thrashing disk. Hostinger's shared nodes likely use:
- RAID-10 with slow spinners
- No SSD cache tier
- Oversubscribed SATA backplane
ZFS with L2ARC would absorb this. I picked up a 2U Supermicro with 8x4TB HGST drives at auction last month, $220. Added Intel Optane for log device. For that money you get hardware you control.
But first: check your Wordfence version hash against upstream. Nulled releases circulate with miners.
zfs send | zfs receive. repeat.
hankels
Member
52 VPS and counting
- Joined:
- Jun 2024
- Posts:
- 301
- From:
- Phoenix, US
What is your Hostinger plan spec, the CPU limit they promise?
seedbox, NAS, tape, and three offsite
lucgone
Member
Le Baguette
- Joined:
- Jul 2024
- Posts:
- 296
- From:
- Lyon, FR
"official repo" you checked the hash though?
Vive la résistance... électrique
olespete
Member
OP
Trust No One
- Joined:
- Jun 2024
- Posts:
- 270
- From:
- Unknown
"official repo" you checked the hash though?
That tracks. I found three
wordfence_scanRunning
entries with Unix timestamps from 2022, all marked true. Plugin probably thinks scans never finished, keeps spawning new ones.
Still want to know if anyone else saw spikes this week though. Pattern matters.
airgapped, encrypted, faraday'd, still worried
hankels
Member
52 VPS and counting
- Joined:
- Jun 2024
- Posts:
- 301
- From:
- Phoenix, US
Hostinger's "CPU limit" is 100% of one core on Premium, but they throttle at ~70% sustained on Business too. I have monitoring on four Phoenix VPS and the shared nodes there show IO wait spikes every Tuesday 02:00 UTC. Wordfence default scan time? 02:00 local.
Not a conspiracy. Just bad defaults meeting oversubscribed hardware.
seedbox, NAS, tape, and three offsite
RAJ
Member
- Joined:
- Jul 2024
- Posts:
- 294
- From:
- Mumbai, IN
Throttle at ~70% sustained
This is why I asked about InterServer. They use DirectAdmin now, switched from cPanel. $2.50 first month, price lock guarantee. But Secaucus or LA only, no Mumbai. My clients want local latency.
Hostinger Mumbai node has been solid for me until now. Checking three sites tonight.
your margin is my opportunity
