cPanel Bandwidth Limit Exceeded AlmaLinux [Solved]

Understanding cPanel Bandwidth Limits on AlmaLinux

Bandwidth in cPanel measures total bytes transferred out from your account each month, covering HTTP, HTTPS, FTP, and mail. AlmaLinux runs the same Apache or LiteSpeed web server as prior CentOS builds, so the metering code is identical—WHM's bandwidth module reads access logs and sums the tenth field (bytes sent) per virtual host.

When you exceed the plan limit, cPanel suspends the account and replaces your site with a 509 Bandwidth Limit Exceeded page. The suspension remains until the monthly counter resets or the hosting provider manually lifts it after you upgrade or purchase additional transfer.

Most shared hosting plans cap bandwidth at 50GB to 500GB monthly. A single viral post or hotlinked asset can burn through that in hours. I've seen a 2MB image embedded on a high-traffic forum consume 80GB in a weekend because it loaded on every page view.

Identifying Traffic Sources in AWStats and Raw Logs

The first command shows which specific files are moving the most data. The second reveals if a single IP is hammering your server. The third exposes external sites hotlinking your content—if you see a forum domain or image aggregator in the referrer list, someone embedded your asset.

Cross-reference high-traffic IPs against known bot lists (use 'whois' or an online lookup). Legitimate search engine crawlers obey robots.txt and throttle themselves. Scrapers and content thieves do not.

• awk '{sum[$7] += $10} END {for (url in sum) print sum[url], url}' access_log | sort -rn | head -20
• grep '" 200 ' access_log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20 # top IPs by request count
• awk '{print $11}' access_log | sort | uniq -c | sort -rn | head -10 # top referrers

Blocking Hotlinks and Referrer Leeches

Replace 'yourdomain.com' with your actual domain. The rule checks the HTTP referer header; if it's not empty and doesn't match your domain, the request gets blocked. Test by embedding an image on another site you control—the browser should show a broken image or 403 error.

One caveat: empty referrers are allowed because some privacy tools and direct URL pastes strip the header. If you block empty referrers, legitimate users copying links may see broken content.

• RewriteEngine on
• RewriteCond %{HTTP_REFERER} !^$
• RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
• RewriteRule \.(jpg|jpeg|png|gif|mp4|pdf)$ - [F,L]

Stopping Bot Traffic with User-Agent Blocks

For AlmaLinux systems with ConfigServer Firewall (CSF) installed, you can block by IP directly in the firewall. Add the offending IP to /etc/csf/csf.deny and restart CSF with 'csf -r'. This stops the traffic at the kernel level before Apache even sees it, saving CPU cycles.

If the bot rotates IPs across a subnet, block the CIDR range. Find the ASN with 'whois <IP>' and add the entire block to csf.deny if it's a known bad actor. Be careful—blocking too broadly can affect legitimate users on shared hosting or VPNs.

• RewriteEngine On
• RewriteCond %{HTTP_USER_AGENT} (MJ12bot|AhrefsBot|SemrushBot|DotBot|BLEXBot) [NC]
• RewriteRule .* - [F,L]

Rate Limiting and Traffic Shaping on AlmaLinux

This limits the /downloads directory to 512KB/sec per connection. A user downloading a file gets smooth throttled delivery instead of saturating the pipe. It's a middle ground between blocking outright and letting traffic run wild.

• <IfModule mod_ratelimit.c>
• <Location /downloads>
• SetOutputFilter RATE_LIMIT
• SetEnv rate-limit 512
• </Location>
• </IfModule>

Offloading Static Assets to a CDN

The CDN fetches the file from your origin once, caches it globally, and serves all subsequent requests from the edge. Your cPanel bandwidth meter only counts the initial fetch plus any dynamic or uncached requests. Test by checking the X-Cache header in the CDN response—'HIT' means it's cached, 'MISS' means it fetched from origin.

• Before: <img src="https://yourdomain.com/images/photo.jpg">
• After: <img src="https://yourzone.b-cdn.net/images/photo.jpg">

Monitoring and Alerting for Future Overages

Parse the JSON output for the current month's bytes. Compare against your plan limit and send an alert via mail or a monitoring service webhook when you cross a threshold. Run this hourly so you notice traffic spikes in near real-time.

External monitoring tools like UptimeRobot or Hetrix can poll your site and alert on response time changes, which often correlate with bandwidth saturation. If your site slows to a crawl at the same time bandwidth spikes, you've got a traffic attack or a sudden viral hit.

Document your baseline after optimization. If you normally use 20GB per month and suddenly jump to 150GB, investigate immediately—don't wait for the suspension email. Check AWStats, review new referrers, and look for unusual user-agent strings in the access log.

• uapi --user=username Bandwidth get_retention_periods_and_accounts_currently_being_processed