Context
- Seasonal traffic spikes when campaigns push fans to vote.
- Reputation on the line if ballots fail or results look rigged.
- Team needed seasonal resets and exports without developer help.
Problem
- Old stack buckled under surges and produced timeouts.
- Weak replay protection let bad actors stuff ballots.
- No clean way to archive a season and start the next.
What we did
- Designed lean vote tables with keyed lookups and audit logs.
- Added rate limits, nonce checks, and IP/session controls to block replays.
- Sized PHP-FPM, MySQL, and caching for spike traffic with CDN offload.
- Built reset and export scripts the crew can run before each season.
Result
- Throughput jumped past ten times the prior peak without downtime.
- Fraud checks run inline without blocking real fans.
- Team rolls a new season with one reset and export workflow.
Before / After / Impact
- Before: Brittle voting tool that crashed and allowed ballot stuffing.
- After: Hardened WordPress app with rate limits, audits, and load-balanced delivery.
- Impact: Clean seasons with zero critical tickets and trustable tallies.
Nerd notes
- Custom vote schema tuned for single-index lookups and export speed.
- Rate limiting layered at Nginx, PHP, and app levels with audit logging.
- CDN caching for assets; dynamic endpoints isolated behind WAF rules.
- Seasonal reset scripts archive ballots and purge caches before relaunch.
Status
Live and battle-tested.