Magento 2 on Apache + Varnish getting continuous purge request

Question

I have configured Varnish on my ubuntu server with apache. But varnish is showing a lot of repetitive purge requests and the site is extremely slow. What could be the reason behind it? I have magento 2.

Here is the varnishncsa.log:

142.93.221.126 - - [27/Oct/2021:01:44:03 +0000] "PURGE http://domain.com/ HTTP/1.1" - - "-" "-"
142.93.221.126 - - [27/Oct/2021:01:44:01 +0000] "PURGE http://domain.com/ HTTP/1.1" - - "-" "-"
142.93.221.126 - - [27/Oct/2021:01:44:01 +0000] "PURGE http://domain.com/ HTTP/1.1" - - "-" "-"
142.93.221.126 - - [27/Oct/2021:01:44:06 +0000] "PURGE http://domain.com/ HTTP/1.1" - - "-" "-"
142.93.221.126 - - [27/Oct/2021:01:44:06 +0000] "PURGE http://domain.com/ HTTP/1.1" - - "-" "-"
142.93.221.126 - - [27/Oct/2021:01:44:06 +0000] "PURGE http://domain.com/ HTTP/1.1" - - "-" "-"

My VCL file:

#
# This is an example VCL file for Varnish.
#
# It does not do anything by default, delegating control to the
# builtin VCL. The builtin VCL is called when there is no explicit
# return statement.
#
# See the VCL chapters in the Users Guide at https://www.varnish-cache.org/docs/
# and https://www.varnish-cache.org/trac/wiki/VCLExamples for more examples.

# Marker to tell the VCL compiler that this VCL has been adapted to the
# new 4.0 format.
vcl 4.0;

# Default backend definition. Set this to point to your content server.
backend default {
    .host = "127.0.0.1";
    .port = "8080";
    .first_byte_timeout = 600s;
}

sub vcl_recv {
    # Happens before we check if we have this in cache already.
    #
    # Typically you clean up the request here, removing cookies you don't need,
    # rewriting the request, etc.
}

sub vcl_backend_response {
    # Happens after we have read the response headers from the backend.
    #
    # Here you clean the response headers, removing silly Set-Cookie headers
    # and other mistakes your backend does.
}

sub vcl_deliver {
    # Happens when we have all the pieces we need, and are about to send the
    # response to the client.
    #
    # You can do accounting or modifying the final object here.
}

Answer 1

An IP WHOIS showed that 142.93.221.126 is actually a DigitalOcean IP address. Is this the IP address of the machine on which your Magento setup is hosted?

If not, someone has unauthorized access to your PURGE endpoint.

Please share your VCL file so we can have a look at how PURGE is implemented and how access is protected.

If it turns out 142.93.221.126 is allowed to PURGE the cache, you might want to have a look at your Magento looks and increase the verbosity.