When a Drupal page takes more than a minute to load, it is easy to assume that Drupal itself is slow.
Sometimes it is.
But a slow Drupal page can also be a perfectly reasonable HTML response surrounded by tens of megabytes of images, JavaScript, CSS, fonts, maps and third-party resources.
We recently looked at a Drupal page where the browser reported approximately:
Putting a Drupal site behind Cloudflare can make a substantial difference to performance and security.
But it does not mean unwanted automated traffic will suddenly disappear.
We recently investigated a Drupal site that was already behind Cloudflare but was still showing heavy server load, large numbers of PHP requests and rapidly growing cache tables.
At first glance, that seems contradictory.
If Cloudflare is sitting in front of the site, why are bots still reaching Drupal?
When a Drupal site suddenly starts consuming most or all of the available CPU, the obvious conclusion is that the website is receiving too much traffic.
Sometimes that is true.
But high CPU can come from several very different sources: PHP requests, database activity, cron, Drush commands, queue workers, bots, or a process that has simply got stuck.
We recently investigated a Drupal server where the load average had climbed above 20 and remained high for an extended period.
At first glance, it looked like a traffic problem.
It wasn't.