Find the cause before paying for more. On small sites the usual culprits are bots, a heavy plugin or a backup running at a busy hour. Upgrade only when real visitors need the capacity.

The email from the host

The message from the hosting company is polite and alarming. The account has exceeded its resource limits, the site has been slowed down, and it may be suspended if this continues.

Sometimes there is no email at all. Visitors simply see an error saying a resource limit has been reached, or a page that takes half a minute to appear.

The owner's first thought is usually that it cannot be right. The site gets a few hundred visits a week.

That is the most useful clue there is. When a quiet site runs out of room, real customers are rarely the reason.

What the host is counting

Shared hosting puts many sites on one server, so each account gets a fixed share. The limits differ by host and plan, but they usually cover the same things.

The third is the one small sites hit most. Every request that builds a page in PHP holds a process until it finishes, and when the allowance is full, the next visitor waits or gets an error.

Why quiet sites hit the limits

Bots, mostly. Automated programs try password after password on the login page, copy pages, fill in forms and follow every link they can find.

Each of those requests costs as much as a real visit, and they arrive in bursts no human audience produces.

Then there are heavy plugins: statistics plugins that log every page view in the database, related-post plugins that search the whole site for every page, link checkers that crawl the site on a schedule.

And scheduled jobs at the wrong time. A backup that compresses the entire site at six in the evening competes with every visitor who arrives then.

Reading the host's numbers

Most hosting control panels have a resource usage page with a graph for each limit and a record of the times the account hit one.

Note those times, then open the access logs for the same minutes. The logs list every request: where it came from, which page it asked for and what program asked.

Patterns jump out. Hundreds of requests to the login page from a handful of addresses. A crawler requesting every page of an events calendar years into the future. A spike at exactly the minute the backup starts.

If the control panel shows nothing useful, ask the host. A good one will say which limit was hit, when, and by which script.

A worked example

A microgreens grower supplies restaurants and a few dozen households from a greenhouse at the edge of town. Weekly orders go through the website, where the order form opens on Sunday afternoon and closes at noon on Monday.

Three Sundays running, the site crawled around six in the evening, and the host sent a warning that the account was exceeding its processor limit.

The host's graphs showed the limit being hit every Sunday from six until about seven. Sunday evening was also when many households placed their weekly orders, but the orders were not the problem.

A backup plugin had been set, when the site was built, to copy the whole site every day at six, photographs and all. A statistics plugin was recording each visit in the database.

And the logs showed steady password guessing on the login page, around the clock.

The backup moved to three in the morning and stopped copying the cache folder. The statistics plugin went, since Analytics already counted visits, and the login page got a limit on failed attempts.

The Sunday slowdowns stopped, and the grower stayed on the same plan.

Dealing with bots

Limit failed logins, so a program guessing passwords is locked out after a few tries. On a WordPress site that does not use the remote publishing feature, block the file that handles it, a favourite route for password guessing.

Block crawlers that bring nothing, using the host's tools or the server's own settings, and leave the major search engines alone.

Page caching helps with everything else. The site saves finished pages and hands them out without running PHP each time, so a burst of requests costs a fraction of what it did.

Plugins and schedules

List the plugins and ask of each one what it does, and whether something else already does it. Statistics plugins duplicate Analytics, and some sliders and page builders load on every page whether used or not.

Move backups and other heavy jobs to the quietest hours, or rely on the host's own backups if they are dependable and stored elsewhere.

WordPress runs its scheduled tasks when visitors arrive, which means at busy times. A developer can switch that off and run the tasks from the server's own scheduler at set hours.

When the answer is a bigger plan

Some sites genuinely outgrow shared hosting: an online shop with real peaks, a large catalogue with a busy search, a members' area where every page differs for each person and cannot be cached.

The sign is that the limits are still being hit after the bots, plugins and schedules are dealt with, and that the times line up with real customers.

Then a larger plan, or a virtual private server with its own guaranteed share, costs less than the orders lost when the site stalls at its busiest hour.

The counter-case

Some plans are simply too small. A cheap account on a crowded server can hit its limits with a tidy, well-run site, and stripping features to fit it is a false economy.

And a site that has just been mentioned somewhere popular may hit limits from real people for a day or two, which is a good problem and passes.

The order still holds: find out what is using the account, remove what should not be there, and then pay for the capacity real visitors need.

Before upgrading the plan

  1. Ask the host which limit was hit and when.
  2. Match those times against the access logs.
  3. Block password guessing and useless crawlers.
  4. Move backups to the quiet hours.
  5. Remove plugins that duplicate other tools.
  6. Turn on page caching where it fits.
  7. Upgrade the plan only for real visitors.

Step two is where the answer usually appears. Once the minutes of each warning are set against the requests that arrived in them, the cause is rarely in doubt.

Another plan limitation that shows up in front of visitors is covered in shared SSL that shows the host's name.

Frequently asked questions

What does a resource limit warning mean?

The account has used more processor time, memory or simultaneous processes than its plan allows. The host slows the site, shows visitors an error, or suspends it.

Why would a quiet site hit the limits?

Usually bots guessing passwords or crawling every page, a heavy plugin, or a backup running at a busy hour. Real customers are rarely the cause on small sites.

Where can I see what the site uses?

Most control panels have a resource usage page with graphs and the times limits were hit. Match those times against the access logs to find the cause.

Can a backup slow the website down?

Yes. A full backup compresses every file in the account, and running it at a busy hour competes with visitors. Move it to the quietest hours.

When should I move to a bigger plan?

When limits are still hit after bots, plugins and schedules are dealt with, and the times match real customers, such as order peaks in an online shop.

What can a good host tell me?

Which limit was hit, at what times, and by which script. A good host can answer all three, and the answer usually points straight to the cause.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Warning emails about resource limits?

Forward us the host's message. We will find what is using the account and tell you whether the site or the plan needs changing.

Start a Conversation