How to Fix 509 Bandwidth Limit Exceeded Error
What 509 Bandwidth Limit Exceeded means
The 509 code is not an official HTTP status — it is served by hosting control panels, most famously cPanel, when a hosting account burns through its monthly data transfer allowance. Every byte the server sends counts: page views, images, stylesheets, videos, PDF downloads, email attachments on the account, even bots crawling the site. Hit the cap and the host replaces your site with a plain 509 page, refusing all visitors until the allowance refreshes or someone pays for more.
This is different from a traffic crash like a 503. A 503 means the server is overwhelmed right now; a 509 means the account ran out of its monthly data budget, full stop. That is why the error does not clear when you reload or restart anything — it lifts when the calendar turns over, when the host resets the quota, or when the plan changes. The site itself is almost always fine and comes straight back once the allowance returns.
Common causes
- A traffic spike: a viral post, a sale, or a mention on a big site can multiply page views overnight — and every view costs bandwidth, so a busy week can eat a whole month's quota in days.
- Hotlinking and bandwidth theft: other sites embed your images or files directly in their pages, so their visitors download from your server. You pay the bandwidth; they get the content.
- Oversized media files: uncompressed photos, huge PDFs, and video files hosted directly on the server chew through data allowances far faster than normal pages do.
- Bots and scrapers: aggressive crawlers, scrapers, and AI training bots can download your entire site over and over, quietly consuming a surprising share of the monthly quota.
- A quota that no longer fits the site: a growing site on a starter shared plan simply outgrows a few gigabytes of monthly transfer — the allowance is fine for a hobby site but not for a real audience.
How to fix 509 Bandwidth Limit Exceeded — step by step
The whole fix takes about thirty minutes: find where the data went, stop the leaks, and make the site cheaper to serve.
- Open your host's bandwidth report and note the reset date. In cPanel go to Metrics, then Bandwidth, and see exactly how much data your sites transferred and which one blew past the limit. The same panel shows when the monthly quota resets — if the reset is only a day or two away, the site may simply come back on its own. Note the peak days too: a single-day spike points at a viral post or a bot wave, while a steady climb all month points at real growth the plan can no longer hold.
- Find the files and traffic eating the quota. Open Awstats or Webalizer from the same Metrics area and sort by bandwidth. Nine times out of ten the culprit is obvious: a handful of huge images, a PDF or video file being downloaded constantly, or one directory getting hammered. If a single file dominates the chart, that is your bandwidth hog. Check the referrers list as well — if most of that traffic comes from other websites rather than your own pages, you are being hotlinked.
- Turn on hotlink protection to stop bandwidth theft. Hotlinking means other sites embed your images or files directly, so their visitors download from your server and you pay the bandwidth. In cPanel open Security, then Hotlink Protection, and enable it for your domain — this blocks outside sites from loading your images, videos, and downloads while keeping your own pages working. Add your own domains to the allowed list, including any CDN or staging subdomain you use, so nothing of yours breaks.
- Compress the big files and move downloads off the server. Run your largest images through a compressor and resize anything wider than it needs to be — a 4 MB camera photo displayed at 800 pixels wide is pure wasted bandwidth on every view. Move videos to YouTube or Vimeo and embed them instead of hosting the files yourself. Shift big downloads like ebooks and software installers to a free file host or a CDN, and delete anything in the uploads folder that is not actually used on the site anymore.
- Put a free CDN in front of the site. A content delivery network caches your images, stylesheets, and scripts on servers around the world, so repeat and distant visitors stop downloading from your hosting account. Sign up for a free Cloudflare plan, point your domain's nameservers to it, and turn on caching with a browser cache rule of a week or more for static assets. Your origin bandwidth can drop by half or more overnight, which keeps you under the quota without touching the site itself.
- Wait for the reset, ask the host, or upgrade. If the monthly reset is near, you may only need patience — but expect the 509 to return if the quota still does not fit. Some hosts will reset the bandwidth early or sell a one-time top-up; ask support before paying for a full upgrade. If the graphs show you outgrowing the plan every month, move up a tier: a site that routinely needs 50 GB of transfer will never be happy on a 10 GB plan, and no amount of compression fixes a quota that is simply too small.
Did this fix it? Quick checklist
- The bandwidth report shows which site or file ate the quota, and you know the date the monthly allowance resets
- Hotlink protection is on, the biggest images are compressed, and videos or large downloads are hosted off-server or on a CDN
- A free CDN is caching static assets so repeat visitors barely touch your origin bandwidth
- The plan is upgraded if usage keeps outgrowing it — or the reset date is marked and a repeat spike is watched for
One last thing worth checking: open the raw access logs for the worst day and look for a single IP address or user agent making thousands of requests — a scraper or a misbehaving bot can burn a month of bandwidth in a weekend. Blocking the offender in .htaccess or through your security plugin, and rate-limiting wp-login.php and xmlrpc.php on WordPress, often produces the biggest single drop in transfer. And remember: if you are seeing the 509 on somebody else's site, none of this applies to you — only the site owner can fix it, so send them a quick note that their site is down.
Frequently asked questions
What does 509 Bandwidth Limit Exceeded mean?
It means your website transferred more data this month than its hosting plan allows. Every page view, image load, and download counts against the quota, and once it is gone the host blocks the site with a 509 page until the quota resets or the plan changes. The site itself is not broken — it just ran out of data allowance, like a phone plan that hit its cap.
I see a 509 error on someone else's website. Can I fix it?
No — a 509 is entirely a server-side limit, so there is nothing a visitor can do. Clearing your cache, switching browsers, or reloading will not help because the host has shut the site down at the account level. The only fixes are on the site owner's side: wait for the monthly bandwidth reset, or contact the owner and let them know their site is down.
Why did my bandwidth run out so suddenly?
The most common sudden causes are hotlinking — other sites embedding your images so their visitors drain your quota — a viral post or a scraper downloading your whole site, or one huge file like a video or PDF being shared around. Check your host's bandwidth stats sorted by file and referrer: the hog is usually one obvious entry at the top of the list.
Will the site come back on its own after a 509 error?
Usually yes, when the monthly bandwidth quota resets — most hosts start a new allowance on the first of the month, and the site comes back automatically. But the underlying mismatch does not fix itself: if you hit the cap once, you will likely hit it again next month unless you cut usage with compression, hotlink protection, and a CDN, or move to a plan with a bigger quota.