Can we always trust wordpress plugins and themes?
I've launched several blogs using wordpress as the site engine and it was quite easy and pleasant. I've even did one quite complex website that was not really a blog and that had it's share of challenges to make it work on wordpress. Usually to launch a site several extra plugins are needed or a free/paid theme for it's design and so far everything just worked fine.
Yesterday was the day of doom. Suddenly one friend who just sent a newsletter with bunch of links going back to his site, said that it's not responding. I've checked the site and it just wasn't loading. After I've started digging and looked into php-fpm logs I saw that it's logging all requests coming to the site as slow because they took more than 5s in one particular line of Koi theme-utils.php file..
It turns out that every time the admin (I just had no time to check it without an active session) loads the page, curl_exec is used to call home and check theme's version. It would be good if they atleast have used reasonable timeout on that.. but no, it had the default timeout of 30s. So for 30s the site was just hanging there and waiting for themify.me to respond and well it wasn't. The quickest fix was just to add return true in the first line of that function and everything came back to normal.
The moral of the story is - wordpress is cool platform for blogging and it has a lot to offer, but be aware that if you can't check all the plugin and theme code that you use.. well then better be prepared for some surprises down the line. Of course maybe you'll get lucky and nothing similar will happen to you, but you've been warned.