php

WP_HOME only fools new pages; old URLs live in the database. WP-CLI search-replace with dry-run and skip-columns=guid is the fix.

TL;DR: Moving a WordPress production dump locally means changing WP_HOME and WP_SITEURL won't fix URLs already stored across posts, meta, and serialized options. Raw SQL REPLACE() is risky because it breaks PHP serialized length prefixes and can overflow column limits. Instead, use wp search-replace with a --dry-run first, always skipping the guid column since those permalinks must never change.

An hourly wave of 504s looked like an attack. The logs pointed at a dormant rate limit and a PHP-FPM pool out of workers.

TL;DR: Hourly 504 waves looked like a DDoS but were actually PHP-FPM worker exhaustion, worsened by request_terminate_timeout killing slow requests. Nginx rate limiting never fired because Cloudflare hid real client IPs, collapsing everyone into one $binary_remote_addr bucket. Fixes: enable Cloudflare caching, tune PHP-FPM pool settings, and rotate container logs with copytruncate.