Stateful inspection is doing more work than people think in front of a busy wp box

three things i had to learn the hard way about a stateful inspection firewall sitting in front of wordpress:

1- the state table has a size, and a busy site with a lot of keepalive connections will fill it. a full table gives you timeouts that look exactly like php being slow

2- conntrack entries for udp hang around longer than you expect, and dns heavy plugins are the usual culprit

3- half the random 30 second stalls i chased for a month were the table, not the app

nothing exotic. check the counters before you rewrite a query.