HTTP 509 Bandwidth Limit Exceeded

Quick reference

How bandwidth caps work on shared hosting

Shared hosting plans allocate a fixed amount of data transfer per billing period — typically measured in gigabytes per month. Every HTTP response sent by the server counts against this quota: HTML pages, images, CSS, JavaScript, file downloads. When the total outbound data for the month reaches the cap, the hosting provider’s infrastructure stops serving requests and returns 509 to all visitors.

The cap resets on the billing cycle (commonly the first of the month or the account anniversary date). Until it resets, every request to the site returns 509. The site owner is notified by email or dashboard alert and can either wait for the reset, purchase additional bandwidth, or upgrade their hosting plan.

This behavior is most common on low-cost shared hosting plans that were prevalent in the 2000s and early 2010s. Modern shared hosting and VPS plans typically offer unmetered or very high bandwidth allocations that effectively eliminate this issue for most sites.

What triggers bandwidth exhaustion

Viral traffic: A blog post or image shared widely on social media can drive hundreds of thousands of page views in hours. Each page view transfers 100–500KB of HTML, CSS, JavaScript, and images. A popular post can exhaust a 10GB monthly cap in a single day.

Large file downloads: Software packages, media files, or large documents downloaded repeatedly. A 1GB installer downloaded 100 times uses the same bandwidth as 100,000 typical page views.

Bot and crawler traffic: Aggressive crawlers that ignore robots.txt and hit thousands of pages per hour consume significant bandwidth without contributing to legitimate traffic. Security scanners and scrapers compound the problem.

CDN bypass: A CDN in front of the origin is supposed to cache and serve most requests. If the CDN is misconfigured and forwards every request to the origin instead of caching, the origin’s bandwidth is consumed at CDN-scale rates far beyond what the hosting plan was designed for.

Hotlinking: Other sites embedding images or files from your hosting origin, causing your server to serve traffic generated by their visitors. Each external site embedding one of your images routes all their visitors to your server.

Diagnosing bandwidth exhaustion

Log into the hosting control panel (cPanel or equivalent) and check the bandwidth usage section. It shows total usage for the current period and which directories or file types consumed the most bandwidth, identifying whether the spike came from page traffic, file downloads, or specific large files.

# If you have shell access, check which paths consumed the most bandwidth:
awk '{print $10, $7}' /var/log/apache2/access.log |   awk '{bytes[$2]+=$1} END{for(p in bytes) print bytes[p], p}' |   sort -rn | head -20

# Check for hotlinking: requests where referer is external
awk '$11 !~ /example\.com/ && $7 ~ /\.(jpg|png|gif)$/ {print $11, $7}'   /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -20

Fixing and preventing 509

Immediate resolution: Contact the hosting provider. Many will temporarily restore service while you upgrade your plan, or will do it once as a courtesy.

Upgrade hosting: Move to a plan with a higher bandwidth cap or to a VPS/cloud host where bandwidth billing is by consumption rather than hard cuts. AWS, DigitalOcean, Linode, and similar providers charge per GB beyond a generous free tier without cutting service.

Add a CDN: Cloudflare’s free tier, or CloudFront, caches static assets and HTML. Most repeat visitors hit the CDN cache without touching the origin server. A properly configured CDN can reduce origin bandwidth consumption by 80–95%.

Prevent hotlinking in nginx:

location ~* \.(jpg|jpeg|png|gif|webp)$ {
    valid_referers none blocked ~\.example\.com;
    if ($invalid_referer) {
        return 403;
    }
}

Block bad bots: Maintain a robots.txt and use server-level rules to block known scraper and scanner user agents. Rate-limit crawl frequency to reduce bandwidth from any single bot source.

Optimize asset sizes: Compress images (WebP instead of PNG, optimized JPEG), minify CSS/JS, and set long Cache-Control headers on static assets so browsers do not re-download them on every visit.

509 vs 429 vs 503

Frequently asked questions

What does HTTP 509 mean?

509 is a non-standard code used by shared hosting providers (primarily cPanel-based) to indicate the site has exceeded its monthly bandwidth allocation. All requests return 509 until the billing period resets or the hosting plan is upgraded.

How long does a 509 error last?

Until the bandwidth cap resets (typically the first of the month or billing anniversary) or the site owner purchases additional bandwidth or upgrades their hosting plan. Contacting the hosting provider often results in a temporary bypass.

Will Google de-index my site if it returns 509?

Extended 509 downtime can affect crawling and indexing. Googlebot receiving repeated 5xx errors may reduce crawl frequency and, for extended outages (days to weeks), may drop pages from the index. Resolve the bandwidth issue quickly and request a recrawl via Google Search Console.

What is the standard code for bandwidth limits?

There is no standard HTTP code specifically for bandwidth limits. 429 Too Many Requests is the closest for rate limiting, and 503 Service Unavailable is often used as an alternative. Most modern hosting services avoid bandwidth hard cuts entirely, preferring overage billing.

Related guides

HTTP 429 Too Many Requests · HTTP 503 Service Unavailable · HTTP 427 Unassigned

Standards reference

Definitions from the IANA HTTP Status Code Registry. 509 is not in any RFC; usage documented from cPanel and shared hosting provider documentation. · HTTP 509 quick reference →