WordPress plugin WP Statistics forces Server to its knees

[German]A brief hint for WordPress administrators who use the WP Statistics plugin. The new versions 13.x will probably bring your web server to its limits – the server will be down. It has shutdown my blogs from Sunday afternoon to Monday morning.

Nasty Sunday afternoon surprise

Actually, Sunday could have been great – weather good, took a walk, was still briefly in the blog at 15:00 and moderated comments, then had something to eat. Grabbed my smartphone after the meal and checked my mails as usual … and the notifications 'Your blog is down' arrived. The blog shows just a 'Error to connect to database' message.

Occasionally there were misleading explanations when calling the blog pages,like this text:

Error while establishing a database connection
This either means that the username and password information in your wp-config.php file is incorrect, or we cannot reach the database server on localhost. It could be that your hosting's database server is down.

Later I got the server error 503 'Service Unavailable' and hints for capacity problems of the hosting package (see following screenshot).

I couldn't get into the dashboard of WordPress either. Only FTP access to the web package and access to the dashboard of the hoster were possible. But there I see nothing in terms of server load etc. After many exchanges with the hoster's support teams – from Sunday afternoon till Monday morning, I received the feedback:

The table wp1wp_statistics_visitor has 3,694,093 entries, so the queries there take a long time. As a result, the website is only partially accessible or not accessible at all. You must therefore clean up the table here.

We hope to have helped you with this information.
For further questions please do not hesitate to contact us.

A typical quick support answer, which left a poor user in the cold. It took me several more phone calls, until I learned that the server was brought to its knees by constant database queries. The table name from the feedback brought me to the right direction – the WordPress plugin WP Statistics. So I just logged on to the PHP database administrator and tried to empty the table in one (of two databases). This purges the statistics, but I wanted to get the blogs running again. Deleting them also brought the server to its knees and I was kicked out of the database administrator. But at least one blog came back at least for a short time.

Plugin killed via FTP

When I tried to log back into the database administrator, nothing worked – I couldn't even get past the login. After the 1st-Level-Supporters at HostEurope contacted the 2nd level support and the system group, I got the final hint:

there are several processes running, which access the database – I should stop that

and the PHP database administrator would probably not work, I should use SSH

I was about to ask the supporters to delete the tables when two things happened. The PHP database administrator called again and I was able to initiate a table for emptying. And I had the idea to disable the WordPress plugin WP Statistics via FTP, which runs in several blogs in the hosting package.

To do this, I started the FTP interface of the hoster (with Filezilla I couldn't reach it) and moved the subfolder of the plugin wpstatistics in the folder wp-content/plugins to another location. You can also deactivate the plugin by renaming the folder (see this page). And suddenly my blogs were running again. .

I wasn't alone

I asked in a German WordPress  Facebook group and Daniel Ruf postet a link to this German forum post (thanks) – within this plugin section there are more postings from users affected:

WP Statistics … Server down since the day before yesterday

Hello folks!

Since yesterday / the day before yesterday the plugin "Wp Statistics" is knocking out our servers regularly. It regularly executes the wp_statistics_visitor statement and is also regularly slow. This causes long loading times and a lot of load on the MySQL server… This is executed at least every 3 seconds and needs one second.
When you switch off the plugin, the query is automatically stopped.
It asks for the location where ip = " and last_Counter >= '2019-12-01' whatever that means. When I activate it again, the queries start again. Finally the server is paralyzed (gateway timeout).
——————-
Statement: # Time: 201130 11:27:47
# User@Host: fiwo_wordpress[fiwo_wordpress] @ localhost [] Id: 2821
# Query_time: 1.812797 Lock_time: 0.000087 Rows_sent: 0 Rows_examined: 2943518
SET timestamp=1606732067;
SELECT location FROM wp_statistics_visitor WHERE ip = " and last_counter >= '2019-12-01' ORDER BY ID DESC LIMIT 1;
runtime 1.8 seconds

Was exactly my error, even if I did not have the log data. Veronalabs, the developer of the plugin, writes that they are working on fixing the bug. You can download the old version 12.6.13 of the plugin from a list box at the bottom of this page. 

Then go to Plugins – Install in the WordPress Dashboard and upload the ZIP archive of the plugin download via Upload Plugin (see picture above). Make sure that no Auto Update is set and also ignore the 'Update Now' in the plugin list. Then wait until the developer provides an error-free plugin version. And above all resist the impulse to quickly go to the plugins' update page and then run an update. Maybe it helps others.