Disable cron or move to CLI

[Krinkle]

I noticed in Fastly Observer for releases.jquery.com that there's a handful of "Pass" requests once every few minutes (i.e. not cache-miss requests, but uncachable requests, despite having a fallback TTL).I set up a temporary log bin, to look at what these are and they turn out to be POST requests, such as:

16:39
    /xmlrpc.php POST
    /wp-cron.php?doing_wp_cron=*** POST
16:50
    /xmlrpc.php POST
    /wp-cron.php?doing_wp_cron=*** POST
16:51
    /wp-cron.php?doing_wp_cron=*** POST
    /wp-cron.php?doing_wp_cron=*** POST

We can drop these at the edge, since the builder communicates directly with the origin anyway, and the default web-based cron can be turned off in WordPress. We can then turn it back on via a systemd time once a day or something.

https://developer.wordpress.org/plugins/cron/understanding-wp-cron-scheduling/ https://developer.wordpress.org/plugins/cron/hooking-wp-cron-into-the-system-task-scheduler/

Looking at wp_options where option_name='cron' shows sites typically have the following recurring tasks:

hourly wp_privacy_delete_old_export_files # unused in our headless setup
daily wp_scheduled_auto_draft_delete
twicedaily wp_https_detection
twicedaily wp_version_check
twicedaily wp_update_plugins
twicedaily wp_update_themes
daily recovery_mode_clean_expired_keys
weekly wp_delete_temp_updater_backups
weekly wp_site_health_scheduled_check

[Krinkle]

• Disabled the default web-based cron in favour of systemd cron timers https://github.com/jquery/infrastructure-puppet/commit/eca15ef83517b469939ee4d2b20a707a10a413a3.
• Updated Fastly to deny POST and various other methods with HTTP 405.