We run a dozen fairly low-traffic concrete cms sites (currently using 9.4.5), all with page-caching enabled, alongside a bespoke, mission-critical ERP on an enterprise-level cluster of high-end servers. For this reason, the biggest performance issue of using concrete cms - the elephant-in-the-room o…

Not strictly related, but I usually protect our websites with this Nginx rule: location ~ /\. { return 404; } What does it do? Whenever a request for a file/directory that starts with a dot (eg /.git or /.env or /application/.env), we let nginx handle the request, which quickly returns a 404 resp…

That’s a good idea which should ease the load a little with botnet attacks, although obviously aggressive spidering won’t be looking for dot-files. As you say though, this doesn’t address the bigger issue.

It will be fixed in 10.0 Make Page Not Found Page cacheable opened 07:43PM - 10 Dec 21 UTC (UTC) [image] evancooper Type:Enhancement …

What about Add "Early 404 - Page Not Found" responses for selected request paths by mlocati · Pull Request #12867 · concretecms/concretecms · GitHub ?

Nice. Pulls together many aspects of the discussion into one elegant solution. A speculation. Would it be feasible to deliberately provide a slow response without taking up server resources or hindering genuine traffic? Would being deliberately slow actually punish the bots?

[image] JohntheFish: provide a slow response without taking up server resources Nope. For example, if you put something like sleep(1); then you’ll keep a web server process/thread waiting for a second. Since the webserver processes/threads are not infinite, that would definitely be a probl…

Way too many sql queries, especially for page_not_found.php

Developing with Concrete

hissy October 27, 2025, 12:48am 4

It will be fixed in 10.0