
The number of WordPress concurrent users shared hosting supports is not one figure. It is your PHP worker count divided by execution time, then divided by your cache-bypass rate. A cached blog handles thousands. An uncached membership site handles about 175.
To stop an XML-RPC bot flood, allowlist Jetpack first, then deny xmlrpc.php in .htaccess so LiteSpeed refuses the request before WordPress loads and no PHP worker is consumed.

To disable WordPress AI features in WordPress 7.0, add define( 'WP_AI_SUPPORT', false ); to wp-config.php. It overrides the wp_supports_ai filter, blocks every AI provider call site-wide, and a plugin cannot re-enable it.

To disable WordPress Heartbeat safely, throttle its interval to 60 seconds and deregister it on the front end with one heartbeat_settings filter — this cuts admin-ajax.php load about 75% while keeping autosave and post locking.

We measured before telling anyone to disable wp-cron. An empty WP-Cron check costs 18 ms, just 1.17% of an uncached page load. On 100% of the WordPress installs we audited, the default was fine.
