Install ZMQ for PHP

wget http://download.zeromq.org/zeromq-4.1.0-rc1.tar.gz
tar -zxvf zeromq-4.1.0-rc1.tar.gz
cd zeromq-4.1.0 
./configure
make
make install

 

pecl install zmq-beta

 

Find php.ini :

php -i | grep ‘Configuration File’

 

Check if extension was added:

cat /usr/local/lib/php.ini | grep zmq
Should show:
extension=”zmq.so”

Setup a phpinfo.php file containing code phpinfo() in that folder, to check if library is loaded.

 

If server has a firewall, this requires opening some ports in firewall for TCP. Ex: 5555, 8080. Check scripts like push-server.php .

xmlrpc.php high cpu load

 

High load caused by xmlrpc.php seems to be a known issue that can occur on a WordPress site:
https://wordpress.org/support/topic/resolving-xmlrpcphp-ddos-attack-with-htaccess-redirect?replies=8
https://wordpress.org/support/topic/xmlrpcphp-files-cause-high-cpu-usage-and-high-resource-usage?replies=2

Some sites during attack become inaccessible or get broken and show Too Many Redirects error.

A quick fix is to add this to .htaccess :

RewriteRule ^xmlrpc\.php$ “http\:\/\/0\.0\.0\.0\/” [R=301,L]

 

Or just delete / disable file (set permissions 000).

 

More details about XMLRPC :
https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against -wordpress-xmlrpc.html

If you need XMLRPC you can use these to filter requests:
https://wordpress.org/plugins/stop-xmlrpc-attack/
https://www.wordfence.com/blog/2015/10/should-you-disable-xml-rpc-on-word press/