Siege Load-testing

Siege command line:

siege -f links.csv -c 150 -t15m -d 7 -iv -m "Company1 Mar 31 2020" -l

-c - concurrent users
-t15m - test time
-d 7 - 7sec delay for each user
-i - INTERNET user simulation, hits URLs randomly
-m - MARK, mark the log file with a string
-l - log file, if it isn't specified, then default is used: /var/siege.log

I'm increasing concurrent users number with step 50 within each test.

Tips&tricks:

I got unexpected good results with higher concurrent users number after previous bad with lower ones.
The reason were FPC cache (redis in my case) and OpCache.
So, tricks are cleaning FPC and OpCache caches before each test.
In my case,
redis-cli -p 6380 FLUSHALL 
and restarting php

Jmeter plugins

Useful links
https://thetesttherapist.com/2018/07/14/get-max-number-of-user-concurrency-in-jmeter/
https://www.logicify.com/en/blog/apache-jmeter-a-powerful-tool-for-performance-and-load-testing/

Install
https://jmeter-plugins.org/install/Install/
Configure
https://jmeter-plugins.org/wiki/PluginInstall/#Configure-JMeter
Install Active Threads Over Time Listener
https://jmeter-plugins.org/wiki/ActiveThreadsOverTime/
Pick "3 Basic Graphs" in Plugins Manager

Additionally, considering 404 as an acceptable response
https://i.stack.imgur.com/hCLl3.png
https://stackoverflow.com/questions/31317077/how-to-test-an-expected-404-response-with-jmeter

Magento Site Load-Testing via Jmeter

1) gather links of the site;

All needed links are in url_rewrite table. I need the result file with random link lines from the table.
So, I will use RAND() function in select query. It will be enough if I use only category, product, cms_page links, so I will use such entity_type from the table as ones. I need avoid duplicates, so I will use distinct in the query.

    Finally, the result query is
mysql -uuser_name -p -hdatabase -e "select distinct request_path from url_rewrite where entity_type='caterory' or entity_type='product' or entity_type='cms_page' order by RAND();" db_name > load_test.log

2) I noticed that product records begins with slash as the fist character. I need to remove it.
 Such script should help there

./remove_first_slash.sh > load_test-ready.log

#!/bin/bash
for request_path in $(cat load_test.log); do
    tmp_val=$(echo "$request_path" | cut -c -1)
    if [[ "$tmp_val" == "/" ]]; then
        tmp_clear=$(echo "$request_path" | cut -c 2-)
        echo "$tmp_clear"
        continue
    fi
    echo "$request_path"
done

3) use it with Jmeter

Tips&tricks:

I got unexpected good results with higher concurrent users number after previous bad with lower ones.
The reason were FPC cache (redis in my case) and OpCache.
So, tricks are cleaning FPC and OpCache caches before each test.
In my case,
redis-cli -p 6380 FLUSHALL 
and restarting php

Apache Jmeter

Useful links:
https://jmeter.apache.org/usermanual/build-web-test-plan.html
https://www.blazemeter.com/blog/three-ways-to-generate-random-variables-in-jmeter/
https://www.blazemeter.com/blog/how-run-load-test-50k-concurrent-users/
https://www.blazemeter.com/blog/what%e2%80%99s-the-max-number-of-users-you-can-test-on-jmeter/

https://www.xtivia.com/blog/fixing-jmeter-socket-errors/

Http Cookie Manager

clear cookie

Http Header Manager

User-agent
Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25

CSV Data Set Config

Visible Names: request1

Http request

Path: ${request1}

Results

Vew Result Tree
View Results in Table
Summary Report
Aggregate Report

PHP Ioncube extension

It uses for encoding a code
1) Check an extension folder
php -i | grep extension_dir
2) download lib from https://www.ioncube.com/loaders.php site
3) make ini file in mods-available folder with
zend_extension = /usr/lib/php/20170718/ioncube_loader_lin_7.2.so
4) make symlinks to apache2 cli fpm folders
5) restart php, nginx, apache2

Composer dump-autoload

Magento 2.3.3 Commerce
Useful links
https://phpprofi.ru/blogs/post/52
https://getcomposer.org/doc/03-cli.md#dump-autoload-dumpautoload-
https://magento.stackexchange.com/questions/284911/cant-run-any-commands-in-terminal/301796#301796

After

composer dump-autoload --optimize

php7.2 bin/magento setup:di:compile

throws error

Class Magento\Framework\App\ResourceConnection\Proxy does not exist

It works with composer dump-autoload

Also, I noticed if I run composer dump-autoload --optimize twice , second running was longer than first and compiling worked afterwards.

Nginx security headers

Usually, I added

X-Frame-Options SAMEORIGIN

There was a task with CWE-693: Protection Mechanism Failure
I added security headers for strong security.

Useful links
https://www.keycdn.com/blog/http-security-headers
https://devdocs.magento.com/guides/v2.3/config-guide/secy/secy-xframe.html
magento 1 since 1.9.2 version

Tested the site headers via https://securityheaders.com/
Added to nginx.conf in
http block

add_header x-xss-protection "1; mode=block" always;

to vhost.conf in
server block

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header x-content-type-options "nosniff" always;
add_header feature-policy "autoplay 'none'; camera 'none'" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Links related Referrer-Policy
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
http://okiseleva.blogspot.com/2018/07/referrer-policy.html

It's the most difficult security header Content-Security-Policy

add_header Content-Security-Policy "default-src 'self'; img-src * 'self' data:; style-src 'self' 'unsafe-inline'; script-src * 'unsafe-inline' 'unsafe-eval'; frame-src *; object-src *; connect-src *; media-src *; font-src *;";

Links related Content-Security-Policy
https://benjaminhorn.io/code/content-security-policy-what-it-is-what-it-does-and-how-to-implement-it/
https://ole.michelsen.dk/blog/secure-your-website-with-content-security-policy.html

Error with img-src https://forum.framework7.io/t/content-security-policy-directive-img-src-self-data-https/5678

Short instruction for setting Content-Security-Policy header parameters:

Set to default-src 'none';
Open develop panel F12, check console log and add rules with all supported directives

Supported directives

default-src: Define loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback) script-src: Define which scripts the protected resource can execute object-src: Define from where the protected resource can load plugins style-src: Define which styles (CSS) the user applies to the protected resource img-src: Define from where the protected resource can load images media-src: Define from where the protected resource can load video and audio frame-src: Define from where the protected resource can embed frames font-src: Define from where the protected resource can load fonts connect-src: Define which URIs the protected resource can load using script interfaces