Publishing Pages really slow (minutes > does not finish) Reproducable

[lummie.co.uk]

Ok, This is a weird one. I've been having problems with publishing / updating certain posts/pages on two of my sites (on different servers but same hoster). When I update the page or copy the html to a new page, the publish/update never finishes, if I stop it using the stop button or navigate away, I end up with half a post, (not stopping at any particular point). After hours of investigation, and reading other peoples problems with 2.7.1 being slow... I have a reproducable case on my blog.

I don't have ssh access to the server unfortunately, but I did enable wp_debug and that didn't show up anything.

Here (​http://netoxide.co.uk/wpbug.zip ​http://netoxide.co.uk/wpbug.zip) is a zip file containing two text files.

Open works.txt in an editor, copy all the text, in wordpress create a new PAGE (haven't tested it with new post) in html view paste the text in, give it a title of 'works' and publish. Within a couple of seconds, the page should be published.

Now do the same thing but with fails.txt, copy the contents, create a new PAGE, title it 'fails', paste in the text and publish it.
On my server this sits there forever, until you get bored and stop it.

Now, I can here you crying out there must be something wrong with my server. Maybe so. But here is the WEIRD BIT:

Copy the fails.txt, create a new PAGE and give it a title 'fails2', all the same as before.
Now before you publish, there are a list of LI elements, about the 4th paragraph
The first li element reads "How about a blog, that you can add to from anywhere....."

change the word 'from' to 'frox' (yup that's right change the m to a x)

On my server the page will now publish no problem.

I asked on the forum for someone else to attempt to replicate this but didn't get any feedback so far.

I have had this problem on another site, but haven't had chance to narrow down the cause by removing blocks of text until it works.

Sounds like a Security package running on the web server.

It see's "FROM" in the data you're sending, and thinks you're trying to do a SQL Exploit, Then just silently drops the connection (And the browser doesn't get told, so it just waits on the line for a response).

Can you check to see if your server is running any such applications? mod_security is the one that comes to mind.

I was following the same track, I checked another article that was messing up and guess what, the words 'where' and 'set' caused problems and as soon as I changed them to whxre and xet it successfully published.

I then created a new post with only the following text:
update into from set stuff where here
and guess what it fails.
change them to non-SQL words and it works.

I'll contact the hosting guys and see id mod_security is enabled.

Hosting have replied...

"We believe we have identified a problem causing our intrusion detection hardware to be filtering in an over-zealous manner. This is being investigated now and we hope to have this resolved ASAP."

So I am guessing it is not wordpress based and is down to the server. I'll close the bug once I get confirmation it is fixed and is not a wp problem. Thanks for your help.

How about we just re-open if it does end up being a WP issue :)

Definitely sounds like the IDS is kicking in, pretty common problem really with any issues like this.

yup it was the hosting provider, now resolved, thanks for yuor help DD32