twinscience.com
Twin Science's bilingual WordPress site — performance and security work across WordPress, Divi, WPML and WooCommerce behind Cloudflare.
twinscience.com is Twin Science's public site in Turkish and English, built on WordPress with Divi, WPML and WooCommerce behind Cloudflare. I develop and look after it alongside the web platform. In September and October 2026 I profiled it end to end — database, cache, markup and scheduled jobs — and then hardened it against a bot flood.
Context
It is the first thing schools and parents see: the landing pages that ads and campaigns point to, the product pages and the shop, in both languages.
Problem
Uncached pages took almost six seconds to generate, and one Divi image lookup ran 217 queries per page, each scanning thousands of rows because WordPress does not index the column it searched. Visitors arriving with newer ad-click IDs bypassed the page cache entirely, only a few dozen pages were ever cached, and scheduled jobs — the WooCommerce queue among them — had silently stopped. Later, automated scanners went after exactly the pages that cannot be cached, until the server had no capacity left for real visitors.
Approach
Database. a composite index on the posts table turned the image lookup from a scan of 3,784 rows into a range read of 2.
Cache. the modern ad-click parameters (wbraid, gbraid, ttclid and others) joined the cache's allow-list, and the plugin's stalled preload was replaced by a warming script that walks both languages' sitemaps on a schedule.
Markup. the school-logo and award carousels were rendered once per tab in both languages. Moving them out of the tabs took the page from 291 images to 119; lazy loading is on, with the LCP image excluded.
Scheduled jobs. the cron entry was broken and had stopped every scheduled task for five and a half days. It now runs through WP-CLI.
Security. an automated SQL-injection and file-discovery scan got nowhere. I blocked its sources at the web server and at Cloudflare, added injection signatures to the existing firewall rule, rate-limited the uncached paths and put WordPress file discovery behind a challenge.
Outcome
Uncached page generation went from 5.9 s to about 3.1–3.4 s, database time from 1.75 s to 0.10 s and queries from 308 to 170. Ad and campaign landings dropped from 3.8 s to 115–176 ms, cached pages grew from about 37 to 600, and the /en/ HTML shrank by 29%. During the bot flood, server load fell from 22.8 to 1.5.