diff --git a/docs/roadmap.md b/docs/roadmap.md
index 0cb1312..38a23ab 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -275,6 +275,17 @@ Counted 2026-10-25 over the 73 running containers:
   authentik and immich)
 - [ ] Memory limits, once there are daytime numbers: the night ones miss
   immich's machine learning at work (it idles at 234Mi)
+- [ ] WordPress (scoutingmbg.nl) was OOMKilled at 08:27:59 UTC on
+  2026-10-25, its third restart: a crawler asked for 88 pages and assets
+  within a few seconds (normally ~6 a minute), Apache started a PHP worker
+  for each, and the container went past its 1Gi limit (500s first, then
+  the kill; back within seconds). Unrelated to the NetworkPolicies; memory
+  sat at ~500Mi before. Fixes, in order: cap Apache's prefork workers
+  (`MaxRequestWorkers` ~16, so a burst queues instead of filling memory),
+  a page cache plugin. Rate limiting per visitor in Envoy doesn't work
+  yet: node001 passes TLS through, so every request arrives from
+  46.224.26.65; that needs the PROXY protocol from node001's nginx to Envoy
+  (ClientTrafficPolicy `enableProxyProtocol`)
 - [x] Probes for gitea (`/api/healthz`), freshrss (TCP, since
   mod_auth_openidc answers 401 to non-browsers) and serpbear (`/login`)
   (2026-10-25). Liveness only after 5 failures 30s apart, to ride out the