Tracing an unexpected rise in hosting bandwidth

Record the affected period and compare it with a normal baseline. Check the plan’s own bandwidth definition because a panel chart does not necessarily include every type of network traffic.

1. Open Bandwidth and compare the available time ranges and protocol breakdowns. Note when the rise began and which service contributes most.
2. For web traffic, inspect Raw Access or analytics for frequently downloaded large files, repeated endpoints and unusual request volume.
3. Review recent legitimate changes such as publishing video files, releasing a downloadable archive or starting a marketing campaign.
4. If traffic is unwanted, apply a narrow correction such as removing an accidentally public backup, fixing a loop or using an appropriate security rule. Preserve evidence before cleaning suspected compromise.
5. Monitor the same period and protocol after the change. Contact support before the allocation is exhausted if normal demand requires more capacity.

The chosen action should reduce the identified traffic source without preventing legitimate visitors or mail delivery. Keep evidence that explains the rise rather than only a screenshot of the total.

Metrics may update on a schedule and can differ from CDN figures because cached requests do not all reach the server. A higher counter alone does not prove an attack. If the source remains unclear, provide support the period, protocol and representative log entries.

Compression can reduce bytes for suitable content, but it does not address an abusive requester, exposed private file or application loop. Correct the actual source as well as improving delivery efficiency.

• Downloading raw access logs for an incident investigation
• Using Visitors reports to diagnose repeated missing-file requests
• Reading CPU and concurrent connection fault information
• Finding the error behind a cPanel website’s 500 response

• cPanel: Bandwidth
• cPanel: Raw Access