'Resource limit reached': why hosts slow down or suspend websites

The email from your host arrives on a Monday morning: your account has been throttled, or worse, suspended for excessive resource usage. Or a customer sends a screenshot of a plain white page saying resource limit reached. Either way, the site is not doing its job, and the obvious reaction is to buy a bigger plan. Sometimes that is right. Often it just hides a problem that will return.

This guide covers the usual reasons a website exhausts its allowance, how to trace the real cause using logs and panel tools, and how to tell when an upgrade is genuinely the answer.

What actually happens when a limit is hit

Hosts react in stages. At first, the server slows your processes down, so pages take longer. If requests keep piling up beyond your concurrent process allowance, new visitors see an error, commonly an HTTP 508 or 503 page. If heavy usage continues for hours or days and affects other customers on the server, the host may suspend the account until you fix the cause.

A suspension is not usually a punishment. On shared servers, it protects everyone else. The notice often mentions which script or process was responsible, so read it closely before replying.

The five usual suspects

1. Bots and aggressive crawlers

Not all traffic is human. SEO tool crawlers, AI data scrapers, vulnerability scanners and fake search bots can request thousands of pages an hour. Unlike people, they hit uncached URLs such as search results, filter combinations and calendar archives, which are the most expensive pages to generate.

Login pages attract brute-force attempts too. Repeated POST requests to wp-login.php or xmlrpc.php on WordPress sites are a very common source of CPU spikes.

2. Cron storms

Scheduled tasks can pile on top of one another. WordPress, for instance, runs its built-in scheduler (WP-Cron) on page visits by default. On a busy site that can trigger many overlapping runs. A server-side cron job set to every minute that takes three minutes to finish will also stack up copies of itself until the account chokes.

3. Heavy or badly behaved plugins

Some extensions do far more work than their purpose suggests: related-post widgets that run complex queries on every view, statistics plugins that write to the database on each hit, broken link checkers that crawl your whole site, and backup plugins that zip gigabytes during business hours.

4. Genuine traffic spikes

A festival sale, a TV mention or a post going viral on WhatsApp can multiply traffic in minutes. This is the good kind of problem, but a site without page caching can fall over at a surprisingly modest number of simultaneous visitors.

5. Malware or a compromised account

Hacked sites are often used to send spam or attack other servers, burning CPU in the background. If usage is high while your analytics show little traffic, treat a compromise as a serious possibility.

Diagnosing the cause step by step

Work through these checks in order. Most problems reveal themselves by step three.

1. Note the time of the spike. Your panel’s resource usage page shows when limits were hit. Write down two or three exact time windows.
2. Open the raw access log for those windows. In cPanel it is under Metrics, then Raw Access. Look for one IP address or user agent making hundreds of requests, or repeated hits to the same URL.
3. Check which URLs were busiest. Repeated requests to login pages, xmlrpc.php, search pages or URLs with long query strings point to bots.
4. Review scheduled tasks. Compare cron job times with the spikes. Check how long each task takes and whether it can overlap with itself.
5. Look at the error log. PHP fatal errors, memory exhaustion messages and database timeouts often name the plugin or file involved.
6. Test by disabling suspects. On a staging copy, or during a quiet hour, deactivate recently added plugins one by one and watch whether usage settles.
7. Scan for malware. Use your host’s scanner or a reputable security plugin, and look for unfamiliar PHP files in upload folders.

Fixes that usually work without upgrading

• Turn on full-page caching so most visitors receive a stored copy instead of triggering PHP and database work.
• Put a CDN or firewall in front of the site. Cloudflare’s free plan, for example, can challenge suspicious bots and cache static files.
• Block or rate-limit abusive crawlers by user agent or IP, and disable xmlrpc.php if nothing on the site uses it.
• Protect the login page with login attempt limits and two-factor authentication.
• Replace WP-Cron with a real cron job running every 5 or 15 minutes, and add locking so long tasks cannot overlap.
• Move backups and heavy imports to off-peak hours, or run them off the server entirely.
• Remove or replace resource-hungry plugins, particularly ones that duplicate what another tool already does.

When upgrading really is the right call

After caching, bot filtering and plugin clean-up, look at the graphs again for a week. An upgrade makes sense when:

• Usage remains close to the limit during normal business hours with real human traffic
• Your analytics show steady growth in visitors, orders or logged-in users
• The site relies on pages that cannot be cached, such as carts, dashboards or member areas
• You need background workers, custom software or settings that shared hosting does not allow

Moving up a shared tier is a quick fix. For stores and portals with steady growth, a VPS usually gives more predictable performance because the resources are reserved for you rather than shared.

Getting your site back online today

If you are suspended right now, reply to your host’s notice, ask which process or script triggered it, and request temporary reactivation so you can fix it. Then enable caching and bot protection first, since those two steps resolve a large share of cases. Keep a short note of what you changed and when, so you can see which fix made the difference.

If the graphs still look wrong afterwards, our team can review logs and recommend whether a larger Linux hosting plan or a VPS suits your traffic better.

Frequently asked questions

What does a 508 resource limit is reached error mean?

It means your hosting account was handling as many simultaneous requests as its plan allows, so the server refused new ones for a moment. It often clears in seconds, but repeated occurrences point to bots, slow pages or an undersized plan.

Can a host delete my website for using too many resources?

Hosts normally suspend rather than delete, and they usually send a warning first. Check your host’s terms of service for the exact policy, and keep your own off-server backups regardless.

How do I find which plugin is using the most CPU?

Error logs and slow query logs often name the culprit. Otherwise, disable plugins one at a time on a staging copy while watching resource usage. Query Monitor is a well-known free WordPress plugin that shows slow database queries by component.

Will Cloudflare stop my site from hitting resource limits?

It can reduce the load considerably by caching static files and filtering some bad bots. It will not fix slow uncached pages, runaway cron jobs or heavy plugins, so treat it as one part of the solution.