Category Archives: Backend

Deep dives into PHP scripting, MySQL database optimization, server management, and controlling bot traffic to safeguard performance and crawl budget.

Why MySQL FULLTEXT Search Returns 0 Results (And How to Fix It)

phpMyAdmin SQL to alter table to InnoDB for database optimization

When optimizing custom database search queries by replacing standard SQL LIKE '%keyword%' queries with MySQL MATCH() AGAINST() full-text search, you might encounter a frustrating wall: the query returns 0 results, even when the search terms exist repeatedly across your database.

You created the FULLTEXT index, wrote the SQL query, and verified the matching records exist - yet MySQL returns an empty result set.

Here is why MySQL silently drops valid search terms in Natural Language Mode, and how to resolve

Posted in Coding, Server Admin & Security | Tagged 50% Threshold Rule, boolean mode, database, full-text search engine, fulltext index, InnoDB, keyword search, like vs fulltext, MyISAM, MyISAM vs InnoDB, mysql, mysql query optimization, natural language mode, natural relevance scores, slow mysql queries, sql, table storage engine | Leave a comment

The Latest WordPress Core Exploit (wp2shell) and Why Forced Updates Break Websites

WordPress critical bug, security issues, report

One of the biggest promises of WordPress is automatic security updates. When a critical vulnerability is discovered, millions of sites can be patched automatically without site owners having to lift a finger.

But when those background updates unexpectedly break active websites, that convenience quickly becomes a liability.

That is exactly what unfolded following the recently disclosed wp2shell vulnerability chain.

While issuing rapid patches was the right decision from a security standpoint, the automated push inevitably triggered unexpected compatibility crashes, fatal

Posted in Compare Website Builders, Website Security | Tagged Allowed memory size exhausted, automatic security updates, broken wordpress website, cache, cdn, fatal errors, forced updates, max_execution_time, memory_limit, mysql, php, plugin, sql, sql injection, third-party plugins, WordPress, wordpress bugs, wordpress core, wordpress core exploit, wordpress core vulnerability, wordpress hacked, WordPress REST API, wordpress vulnerabilities, wp2shell | Leave a comment

How to Whitelist Googlebot, Bingbot in CSF

WHM ConfigServer Security & Firewall, CSF ignore file

One way to prevent server load spikes and maintain fast performance is to block problematic IP addresses and IP ranges. However, you have to make sure that legitimate crawlers, such as Googlebot and Bingbot, are not accidentally blocked from accessing your websites. Don't crash your SEO! We covered this important step in, “How to Stop High Server Load from Distributed Botnets, Scrapers, and Database Queue Locks”. If you don't know how to do this whitelisting, this tutorial is for

Posted in Coding, Server Admin & Security | Tagged bingbot, ConfigServer Security & Firewall, csf, csf.ignore, csf.rignore, domain masks, firewall, Googlebot, ignore, ignore files, ignore ip, lfd, nano text editor, reverse dns ignore, seo, terminal, whitelist crawlers, whm | Leave a comment

How to Edit .htaccess on the Site Level or Add Rules Globally

In "How to Stop High Server Load from Distributed Botnets, Scrapers, and Database Queue Locks" we talked about how to fix your high server loads. That included adding rules to your site's .htaccess file, or updating the rules globally. If you don't know how to do that yet, this guide is for you.

Crucial First Step: Make a Backup

Before touching .htaccess, always make a copy. A single typo in this file will cause a "500 Internal Server Error" and take

Posted in Coding, Server Admin & Security | Tagged .htaccess, 500 Internal Server Error, apache, apache configuration, cpanel, file manager, global apache configuration, global rules, include editor, nano text editor, post virtual host include, pre main include, pre virtualhost include, show hidden files, terminal, whm | Leave a comment

How to Stop High Server Load from Distributed Botnets, Scrapers, and Database Queue Locks

When a server load spikes to 30, 50, or 100+, most sysadmins panic and start haphazardly restarting services or blocking random IP addresses. However, modern attacks are rarely as simple as a single bad IP.

Today’s botnets use distributed Layer 7 (HTTP) floods, rotating through hundreds of unique IPs with only 1 connection each, exploiting web server application queues, fake WordPress scanners, background AJAX polling scripts, and WordPress admin-ajax.php endpoints that lock up MySQL.

This comprehensive guide covers how to diagnose,

Posted in Coding, Server Admin & Security | Tagged .htaccess, 127.0.0.1, 403 Forbidden errors, 404 errors, ajax, ajax polling, ajax requests, apache, apache rate limiting, automated system tasks, bingbot, botnets, cache, caching, cpu, cpu load, cron jobs, csf, csf whitelist, CT_BLOCK_TIME, CT_LIMIT, CT_PORTS, database polling, database queue locks, ddos attacks, distributed attack, Googlebot, high server load, http, ip address, Jeypack, layer 7, linux, load averages, mibew messenger, mod_evasive, mysql, operator refresh time, php, processes, RAM, scrapers, script, server attack, server load, server load spike, subnet attack, sysadmin commands, whitelist, whm, xmlrpc.php | Leave a comment

The Ultimate Guide to MySQL Query Optimization

PHPMyAdmin MySQL Explain Analyze command for optimizing slow queries

At its core, query optimization comes down to one goal: Make the database read as few rows as possible.

If MySQL reads 300,000 rows to return 5 results, it is slow. If it reads 5 rows to return 5 results, it is lightning fast.

In The Developer’s Guide to Identifying Slow MySQL Queries, we covered the mechanics of finding your slowest queries using server logs and gave a brief introduction to the EXPLAIN command.

But once you’ve identified a slow query,

Posted in Coding, Server Admin & Security | Tagged boolean mode, composite indexes, covering index, deferred join, ESR, explain, explain analyze, fulltext, indexes, like vs fulltext, match against, mysql, mysql database, mysql query optimization, natural language mode, order by, RAM, slow mysql queries, where | Leave a comment

Why cPanel AWStats Shows 90%+ of Website Visits as 0–30 Seconds (And Why It’s Normal)

cPanel, Awstats traffic statistics, showing 90+% for the 0-30s Visits Duration category

If you have ever opened your website analytics and looked at the Visits Duration report, you may have felt a sudden wave of concern.

You see that the majority of your visits - sometimes 90% or more - appear in the shortest duration category:

0 seconds to 30 seconds.

Does that mean visitors are leaving immediately? Is your content failing? Is your website not engaging people?

Before assuming the worst, it helps to understand what your analytics system is

Posted in Search Engine Optimization (SEO), Website Traffic | Tagged AI crawlers, awstats, bots, cpanel, cpanel awstats, crawlers, disables cookies, engage visitors online, engagement, google analytics, javascript, server-level vs script-based analytics, tracking script, visit duration, web hosting, website visitors | Leave a comment

Why is This Strange AI Prompt Showing Up in My Google Search Console?

Bot, scraper query showing an impressions peak on Google Search Console, performance report

If you opened your Google Search Console (GSC) performance report recently, like one of our “Ask David!” submitters did, you might have noticed a sudden, bizarre spike in impressions for an exact query string that looks something like this:

visit the website at [[website]] and extract the company's brand name as it appears on-site. normali

Seeing a massive, raw instruction template ending in a broken word like "normali" can immediately trigger alarm bells. Did my site get hacked? Is my

Posted in Ask David!, Search Engine Optimization (SEO), Website Traffic | Tagged ai scrapers, AI scraping, data-mining, Google Search Console, gsc, hacked | Leave a comment

The Hidden Cost of WordPress Security: Why Security Plugins Aren’t the Whole Answer

WordPress vs UltimateWB - fragmented, high maintenance vs integrated, low maintenance, high performance platform

If you run a website, you know that security isn’t optional. For millions of WordPress users, the immediate reaction to securing a site is to install a security plugin. It’s practically a rite of passage.

But there is a conversation that many developers and web hosts avoid having until it's too late: the real cost of application-level security.

We aren't just talking about subscription fees. We're talking about the hidden performance tax, the administrative burden of constant updates, and the

Posted in Compare Website Builders, Website Security | Tagged abandoned plugins, backdoor, backups, compatibility issues, cpu, CPU spikes, database, firewall, firewall rules, javascript, maintenance, malcar, malicious code, malware, performance tax, plugin, plugin compatibility issues, plugin vulnerabilities, RAM, security plugin, security stack, solid security, subscription fees, waf, web application firewall, website security, wordfence, WordPress, WordPress plugin vulnerabilities, wordpress security | Leave a comment

Over 1.6 Million WordPress Sites Hit: The OptinMonster and ShapedPlugin Supply Chain Attacks

Illustration of a WordPress factory assembly line being hijacked by a hacker to distribute compromised updates.

For years, the gold-standard advice for WordPress website security has been simple: If you want to keep your site safe, stick to major, highly reputable brand names. A massive company has the infrastructure, team, and budget to audit their code and protect your perimeter.

But recent events have exposed a massive flaw in that logic.

When hackers shift from attacking individual sites to targeting the software creators themselves, relying on a big brand's reputation no longer guarantees safety. In fact,

Posted in Compare Website Builders, Technology in the News, Website Security | Tagged 2FA, Awesome Motive, backdoor, cdn, database, Easy Digital Downloads, javascript, MalCare, malware, optinmonster, php, Product Slider, PushEngage, Real Testimonials Pro, shapedplugin, Smart Post Show Pro, supply chain attacks, TOTP, updraftplus, vulnerability, woocommerce, wordfence, Wordfence Login Security, WordPress, WP 2FA | Leave a comment

Category Archives: Backend

Why MySQL FULLTEXT Search Returns 0 Results (And How to Fix It)

The Latest WordPress Core Exploit (wp2shell) and Why Forced Updates Break Websites

How to Whitelist Googlebot, Bingbot in CSF

How to Edit .htaccess on the Site Level or Add Rules Globally

Crucial First Step: Make a Backup

How to Stop High Server Load from Distributed Botnets, Scrapers, and Database Queue Locks

The Ultimate Guide to MySQL Query Optimization

Why cPanel AWStats Shows 90%+ of Website Visits as 0–30 Seconds (And Why It’s Normal)

Why is This Strange AI Prompt Showing Up in My Google Search Console?

The Hidden Cost of WordPress Security: Why Security Plugins Aren’t the Whole Answer

Recent Posts

Categories