‘‘Your Shared Hosting account is Suspended with all your websites now dead !’’

You try and go to one of your sites and get the dreaded: 508 Resource Limit Reached or worse This Account Has Been Suspended for Abuse of Shared Hosting TOS. Your host is now keeping your sites at ransom and you have tried everything to optimize your sites however keep exceeding your shared hosting resources.

You contact your host and you get the following responses:

• You have exceeded your resource limit for shared hosting
• Your CPU usage is too high
• Your entry processes have exceeding your hosting limit
• Your number of concurrent processes exceeded your shared hosting limits
• You Have Exceeded Shared Hosting Reasonable Use Policy

You contact your host again in desperation and they say:

• Your sites are causing the issue, you need to optimize your Wordpress sites.
• Check your plugins they could be the issue - disable all of them and see which is causing the issue.
• There's nothing wrong with our hosting or network
• Use SSH and run tail and do blah and then blah to determine which of your scripts are causing the issues.
• Troll through your access logs and see what the issue is and block IP addresses one by one
• Upgrade to a VPS and then we'll unsuspend your sites
• Our marketing says 'unlimited' however of course on shared hosting that means fair use
• What do you expect for $40 per year ?
• Your 100 visitors per day is causing strain on shared hosting
• We suspended your account without notice to protect other customers and as you have continually exceeded resource usage (which you did not know about) we have had to take action.
• No, your email will not work whilst your account is suspended

This is just some of the hair pulling scenarios I have experienced with shared hosting companies. The reason many people use shared hosting is because it is managed. Well managed is probably not the right word. It's really because there is a control panel installed which makes the installation of Wordpress easy as well as the creation of addon domains.

A VPS (virtual private server) is generally not an option because a reasonably priced VPS is usally unmanaged (who has the time to learn all the technical details about system administration) and a managed VPS can be very expensive. Your gut feeling is that your sites and scripts shouldn't be bringing your shared hosting package to a grinding halt.

So how did I bring my CPU and entry processes down to allowed limits and avoided the my sites being brought down on a regular basis ?

My setup:

I host the majority of my sites on a single host's shared hosting plan (this page is hosted elsewhere). I have approximately 15 Wordpress sites and 10 HTML/PHP sites which also use MySQL database for lookup queries. My main host seems to suffer from regular DOS (denial of service) attacks and when that happens I can be almost certain my sites will not be accessible.

It doesn't appear they have sufficient preventive measures in place to mitigate DDOS attacks. For me to move all my sites to another shared hosting plan is tiresome. So I needed to find a way to bring high usage down. I have spent so many hours trying to debug the root causes and will share with you exactly what I have found and implemented to solve my problems so you do not have to continually beg your host to re-activate your account.

Wordpress Solution

Wordpress is a great CMS however it's current design has a few vulnerabilities that can cause high CPU and entry process usage. One issue is that the Cron service will run whenever a page is loaded whether the vistor is real or not. I implemented the following to bring my Wordpress system usage back to normal.

• Installed a Cron limiting plugin to limit the Cron execution to every N pages - in my case every 500 pages was required
• Installed a search and analytics bots blocking plugin and enabled blocking of all.

You might think this is too simple however if you have successfully had your sites indexed in the major search engines, that will attract an avalanche of automated bots from search engines to companies gathering competitive analytics that will bring your sites to their knees. Your Robots.txt won't help in most cases. Those 2 simple actions brought my Wordpress installs back to normal usage.

PHP Script Solution

My PHP based sites were a little more complex to resolve however this is what I did:

• Obtained a list of aggressive bot user agents and blocked all those visits using the php 'exit;' statement. In other words stop processing my scripts and cease further CPU or process usage on my host.
• Wrote some PHP code to rate limit any IP address that was hitting my site continually more than once every second. If an IP was visiting the site twice a second, the second time I terminated the script using the 'exit;' php command. Somewhat brute force however this did not affect 'real' people visitng those sites.
• Any visits to a site exceeding 1000 visits per day were temporary banned at the IP level for a day and if excessive visits were recorded, IP was permanently banned via hard coding in the script.

I added this code set to the beginning of my PHP sites as an include file and ensured it was the first code executed. This has also radically reduced the CPU and entry process usage.

I hope this solves your shared hosting excessive usage issues and will update this page with any new techniques.

Cpanel Hosting

Update 17 Jan 2018 - my host received a bot flood today and my sites survived ! I can see all the hits in the host logs however my PHP bot slow down worked - hooray !