How to fix WordPress high CPU usage

What this problem looks like

CPU usage is requests times cost per request. Cutting either lowers load. Full-page cache slashes PHP executions for anonymous visitors. Fixing one plugin that runs ten SQL queries per page helps everyone.

xmlrpc.php, wp-cron.php, and admin-ajax.php are common attack and abuse endpoints that spike CPU on unsecured sites.

Step 1: Read hosting metrics

Identify whether spikes are sustained or burst. Bursts at the hour mark suggest cron. Constant high CPU with low traffic suggests search engine crawl misconfiguration or malware.

Step 2: Secure and cache public traffic

Enable full-page cache for anonymous users.
Use Cloudflare or host WAF to rate limit wp-login.php.
Disable xmlrpc if unused: add filter or security plugin toggle.
Block aggressive bots in robots.txt and firewall when legitimate.

php

add_filter( 'xmlrpc_enabled', '__return_false' );

Step 3: Fix WP-Cron properly

Disable default wp-cron trigger and use system cron to call wp-cron.php every five minutes. Open wp-config.php in your site root, next to wp-admin and wp-content. Search for DISABLE_WP_CRON first. If the line already exists, set it to true instead of adding a duplicate. If it does not exist, paste the constant above the line that says stop editing:

php

define( 'DISABLE_WP_CRON', true );

Step 4: Action Scheduler backlog

WooCommerce and Subscriptions queue thousands of actions. Failed or pending queues retry and burn CPU. Clear completed actions and fix stuck hooks.

The commands below need SSH access and will not work inside File Manager:

bash

wp action-scheduler run
wp action-scheduler clean --status=complete

Step 5: Plugin and query offenders

Related posts plugins, statistic widgets, and live visitor counters query on every page load. Replace with static blocks or server-side analytics. Query Monitor reveals plugins attaching to init with remote HTTP calls.

To isolate a CPU hog, rename wp-content/plugins to plugins.disabled via File Manager, SFTP, or FTP. If CPU drops, rename plugins.disabled back to plugins, then activate plugins one at a time in wp-admin.

When to stop DIY and hire help

CPU pegged after malware scan, DDoS, or unknown cron jobs needs incident response. BugShield finds WordPress CPU bottlenecks and hardens shops against repeat spikes at a confirmed price without hourly billing surprises.

Questions answered

WordPress high CPU usage FAQs

Answers about traffic, plugins, scheduled jobs, database queries, malware, hosting limits, and finding the process consuming server resources.

Why does WordPress CPU spike at night?

Scheduled backups, cron tasks, or overseas bot traffic while EU traffic is low. Check cron and access logs for those hours.

Will upgrading hosting fix high CPU?

Temporarily yes. Without fixing root cause, you only buy headroom until load grows again.

Can WooCommerce cause high CPU?

Yes. Uncached shop pages, session handling, and large Action Scheduler queues are common on busy stores.

Should I disable wp-cron on WooCommerce?

Disable the visit-triggered scheduler only if you configure real system cron to replace it. Search for existing DISABLE_WP_CRON in wp-config.php before adding a duplicate.

What causes WordPress high CPU usage?

Traffic spikes, bots, uncached pages, slow database queries, heavy plugins, scheduled jobs, backups, image processing, malware, or limited hosting resources can drive CPU.

How do I find what is using CPU on a WordPress server?

Compare process, access, PHP, database, cron, and application logs for the same time window, then reproduce the specific URL or background job on staging.

How do I tell real traffic from a WordPress CPU problem?

Match CPU spikes with request volume, URLs, user agents, cache status, and conversion data. A few slow requests suggest different action from a genuine visitor surge.

Can WordPress cron jobs cause sustained high CPU?

Yes. Overdue or repeatedly failing WP-Cron and Action Scheduler jobs can create a backlog. Find the owning task before clearing or rerunning it.

Can malware cause WordPress high CPU usage?

Yes. Spam generation, cryptomining, scanning, outbound attacks, and hidden PHP processes can consume resources. Investigate unexpected traffic, files, users, and scheduled tasks.

When should a developer investigate WordPress high CPU?

Get help when the host threatens suspension, the cause spans PHP and database work, or disabling live plugins and jobs would risk orders or customer access.

Keep troubleshooting

Learn how to fix WordPress high CPU usage.