Two problems I see with Wordpress.

Page load speed

With every page making multiple requests to the database (up to 8 requests currently for me), the number of requests per second is pretty much limited to how many SQL queries per second you can execute. On a slower machine with only a couple of internal disks, you might find this to not be so great.

Spam

By default, Wordpress has not got many decent ways of dealing with spam. The Blacklist features seems to just eat everything for me, and requiring people to register is a pain in the bum for normal humans who just want to make a quick comment.

WP-Cache

The first you can address with WP-Cache. This well written plugin will automatically create cached versions of your pages so that subsequent visits will use the cached version. Check out this:

Before WP-Cache:

Concurrency Level:      10
Time taken for tests:   307.903498 seconds
Complete requests:      1000
Failed requests:        1
   (Connect: 0, Length: 1, Exceptions: 0)
Write errors:           0
Total transferred:      22184006 bytes
HTML transferred:       21961340 bytes
Requests per second:    3.25 [#/sec] (mean)
Time per request:       3079.035 [ms] (mean)
Time per request:       307.904 [ms] (mean, across all concurrent requests)
Transfer rate:          70.36 [Kbytes/sec] received

After WP-Cache:

Concurrency Level:      10
Time taken for tests:   10.276118 seconds
Complete requests:      1000
Failed requests:        0
Write errors:           0
Total transferred:      22333970 bytes
HTML transferred:       22042388 bytes
Requests per second:    97.31 [#/sec] (mean)
Time per request:       102.761 [ms] (mean)
Time per request:       10.276 [ms] (mean, across all concurrent requests)
Transfer rate:          2122.40 [Kbytes/sec] received

The number to look at there is the Requests per second, as you can see its about 30 times faster using WP-Cache. I’ve not seen any problems with using this plugin, other than you must disable gzip compression. But, thats ok, because you could use something like mod_gzip to compress on the apache side anyway.

Bad Behaviour

Spam sucks, and with a default WP install you basically need to configure WP so that it eats comments, like I had.

In comes Bad Behavior, a plugin that analyses the headers from the HTTP client and does some “clever stuff” to determine whether its a spammer or not. If they are, they get denied.

Works in conjunction with WP-Cache (and has instructions on how to make it work correctly).

Don’t know how this will work, but we’ll see.

I used to get a LOT of comment spam, so I hope this cuts it down somewhat.

WP-Hashcash

I installed WP-Hashcash after I wrote this article and am finding it also very effective in dealing with spam.

It uses a complex Javascript that is executed on the client side to verify a value computed on the server side. If they don’t match, you’ve not run the javascript, so you’re not a real browser and you must be a script/robot making a post - therefore it denies you.

Its worth mentioning that there ARE javascript interpreters for Perl, so I think that this will become an arms race - as soon as enough people are using this method to protect their sites, it will become worthwhile for the spammers to implement the Javascript evaluation code in their spam scripts, and WP-Hashcash will become useless.

Still, until that happens, it appears to be 100% effective against spam.