What this problem looks like
CPU usage is requests times cost per request. Cutting either lowers load. Full-page cache slashes PHP executions for anonymous visitors. Fixing one plugin that runs ten SQL queries per page helps everyone.
xmlrpc.php, wp-cron.php, and admin-ajax.php are common attack and abuse endpoints that spike CPU on unsecured sites.
Read hosting metrics
Identify whether spikes are sustained or burst. Bursts at the hour mark suggest cron. Constant high CPU with low traffic suggests search engine crawl misconfiguration or malware.
Secure and cache public traffic
- Enable full-page cache for anonymous users.
- Use Cloudflare or host WAF to rate limit wp-login.php.
- Disable xmlrpc if unused: add filter or security plugin toggle.
- Block aggressive bots in robots.txt and firewall when legitimate.
add_filter( 'xmlrpc_enabled', '__return_false' );Fix WP-Cron properly
Disable default wp-cron trigger and use system cron to call wp-cron.php every five minutes.
Add crontab entry: */5 * * * * curl -s https://yoursite.co.uk/wp-cron.php?doing_wp_cron >/dev/null 2>&1
define( 'DISABLE_WP_CRON', true );Action Scheduler backlog
WooCommerce and Subscriptions queue thousands of actions. Failed or pending queues retry and burn CPU. Clear completed actions and fix stuck hooks.
wp action-scheduler run
wp action-scheduler clean --status=completePlugin and query offenders
Related posts plugins, statistic widgets, and live visitor counters query on every page load. Replace with static blocks or server-side analytics. Query Monitor reveals plugins attaching to init with remote HTTP calls.
When to stop DIY and hire help
CPU pegged after malware scan, DDoS, or unknown cron jobs needs incident response. BugShield finds WordPress CPU bottlenecks and hardens shops against repeat spikes.