Tips on WordPress wp-cron.php

WordPress's default wp-cron.php works by checking in the background, every time a visitor comes to your site, whether there is "a job to do". This is not a problem on low-traffic sites, but it causes serious problems on high-traffic sites or, conversely, on sites with no visitors at all:

1. Performance Loss: Checking cron on every page load puts unnecessary load on the server.

2. Security Risk: wp-cron.php can be triggered from outside, so malicious people can slow your site down by sending fake requests to it (DoS attack).

3. Scheduling Errors: If nobody visits your site, scheduled posts are not published and backups do not start.

Here is the "Real Cron" configuration that solves this problem for good:

Step 1: Disable the Cron Inside WordPress

First we need to stop WordPress from checking cron on every visit. To do this, add this line to your wp-config.php file:

define( 'DISABLE_WP_CRON', true );

Step 2: Create a Manual Cron on the Server

Now we will make the server (Plesk or cPanel) run this automatically every 5 or 10 minutes.

If You Use Plesk:

1. Websites & Domains > Scheduled Tasks: open this section.

2. Add Task: click it.

3. Task Type: Choose "Run a PHP script".

4. Script Path: httpdocs/wp-cron.php: select this file.

5. PHP Version: Choose the PHP version your site uses.

6. Schedule: Choose "Per minute" and set */5 (every 5 minutes) or */10.

If You Use cPanel (Cron Jobs):

Set the command below to run every 5 minutes under "Common Settings":

wget -q -O - https://yoursite.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1

Extra Security Measure (.htaccess)

If you have set up a real cron, you can stop outside bots or attackers from triggering this file manually. Add this to your .htaccess file:

# Block outside access to wp-cron.php
<Files wp-cron.php>
    order allow,deny
    deny from all
    # If you know your server IP (optional):
    # allow from 1.2.3.4 
</Files>