If you have received an alert that your website is hitting its resource limits (such as CPU, Memory, or Entry Processes), it can feel alarming—especially if you believe your website is small or has low human traffic.
In most cases, low "human" traffic does not mean low overall traffic. Websites are frequently visited by automated background crawlers, web scrapers, search engine spiders, uptime monitors, and bad bots that can quietly consume your plan's resources behind the scenes.
This step-by-step guide is designed for cPanel users to help you easily locate and diagnose what is causing traffic or resource spikes on your account using built-in cPanel tools.
Step 1: Check the "Visitors" Tool for Real-Time Activity
The quickest way to see who (or what) is currently loading your website is to check the Visitors tool in cPanel.
- Log in to your cPanel dashboard.
- Scroll down to the Metrics section and click on Visitors.
- Locate your domain in the list and click the Magnifying Glass / View icon (or click the log file link) next to it.
- This will open a detailed, chronological list of recent requests made to your website. Look through the columns for:
- IP Address: Are there hundreds of requests coming from the exact same IP address?
- URL / Requested File: Are they repeatedly hitting heavy files (like xmlrpc.php, wp-login.php, or large database-driven pages) instead of normal images and homepages?
- Status Code: Look for 200 (successful) or 503 (server limit reached) responses.
Tip: If you see thousands of lines from a single IP or a strange visitor pattern within a few minutes, your site is actively being scraped or crawled.
Step 2: Use AWStats to Identify Automated Bots & Scrapers
While the Visitors tool shows recent activity, AWStats breaks down your traffic over days and months and highlights which search engines, automated spiders, and bots are consuming your bandwidth.
- In your cPanel dashboard, navigate to the Metrics section and click AWStats.
- Click View next to your primary domain name.
- Scroll down the summary page to look at the following sections:
- Days of the month / Hours: Did traffic spike at a specific hour of the day?
- Robots/Spiders visitors: Expand this section to see a list of known bots (such as search engine crawlers or data scrapers like AhrefsBot, SemrushBot, GPTBot, or Bytespider) visiting your site.
- Check the Bandwidth column next to these bots. If a single bot has consumed gigabytes of data or thousands of hits, it is heavily straining your hosting plan's resources.
Step 3: Check Your Raw Access Logs for Deep Analysis
For a deeper look, or to download a file to inspect traffic patterns, Raw Access Logs give you a complete, line-by-line record of every connection to your website.
- In cPanel, go to the Metrics section and click Raw Access.
- Under Download Current Raw Access Logs, click on your domain name to download a compressed (.gz) text file of your server logs for the current day or month.
- Extract and open the file using a text editor (like Notepad or TextEdit). Each line represents a request and includes:
- The visitor's IP address.
- The exact timestamp.
- The HTTP method (e.g., GET or POST).
- The page being requested.
- The User-Agent string at the end of the line (which tells you the browser, device, or bot type making the request).
- Search the text file for repetitive entries, foreign IP blocks, or aggressive user-agents that are hammering your site.
What to Do Next?
Once you have used these tools to identify what is causing the resource spike (such as a runaway scraper, aggressive bot, or brute-force attack), you have a few options:
- Self-Service Mitigation: You can use cPanel tools like IP Blocker to block malicious IP addresses, or review your application settings (like installing a security plugin for WordPress) to challenge bad traffic.
- Professional Assistance: Configuring custom rate limits, advanced firewall rules, or deep system-level optimisations falls outside standard free hosting support. If you would like our engineering team to investigate, implement advanced rate limits, or block abusive bot networks on your behalf, you can request this as a paid, managed support service by submitting a ticket through your client portal.
