As a website grows, it usually needs more processing power, memory, concurrent processes, and data transfer. When demand exceeds the limits included with a hosting plan, the website may respond slowly, display temporary errors, or become unavailable.
Important: High usage does not always mean that the site has too many visitors. Inefficient extensions, automated jobs, unoptimized images, bot traffic, malware, and outdated software can produce similar symptoms. Before upgrading, it is useful to identify what is consuming the resources and correct the underlying cause whenever possible.
In this guide
- Common causes of high resource usage
- Ways to reduce CPU and other resource usage in WordPress
- What if resource usage remains high?
Common causes of high resource usage
Increased traffic
More visitors are generally a positive sign, but every request requires the server to deliver files, query the database, or execute code. If many people visit at the same time, the website may reach the plan's CPU, memory, or concurrent-process limits.
A content delivery network (CDN) can reduce part of this workload. It stores copies of static assets—such as images, stylesheets, and JavaScript files—on servers in different regions and delivers them from a location closer to the visitor. This may also improve the experience of an international audience.
Inefficient scripts, plugins, or themes
Poorly optimized code may run too many database queries, repeat unnecessary operations, or keep processes active longer than needed. In WordPress, a plugin or theme may be described as “optimized” without guaranteeing good performance on every website and configuration.
To reduce the risk:
- Install only the extensions the website actually needs.
- Choose actively maintained products with a good reputation and compatibility with your versions of WordPress and PHP.
- Remove unused plugins and themes; deactivating them does not always remove all related files or scheduled tasks.
- Keep WordPress core, themes, and plugins updated.
- Have a developer review slow queries, external requests, repetitive processes, and scheduled jobs in custom code.
Install counts and reviews can be helpful indicators, but they are not substitutes for performance testing, compatibility checks, and a reliable backup policy.
Bots, attacks, and malware
Automated bots may send thousands of requests to login pages, forms, internal search features, or specific files.
During a brute-force attack, for example, numerous username and password combinations are tested. This can increase CPU and memory usage even when the site has very few real visitors.
Recommended safeguards include:
- Limiting failed login attempts.
- Enabling multi-factor authentication for administrative users.
- Protecting forms and login pages with CAPTCHA or equivalent controls.
- Using a web application firewall when appropriate.
- Requiring strong, unique passwords.
- Reviewing access logs for repeated requests and suspicious sources.
Malware can also consume resources by sending spam, running hidden processes, changing files, or creating unauthorized access.
If you notice unknown files, unexpected changes, redirects, new administrator accounts, or unexplained activity spikes, arrange a security scan and contact support.
Image creation and processing
Displaying images primarily uses data transfer, while processing them on the server can also require significant CPU and memory. Resizing, compressing, converting formats, generating thumbnails, or creating images on demand may cause usage spikes, especially when several jobs run at once.
To reduce the workload:
- Resize images to appropriate dimensions before uploading them.
- Compress them and use modern formats when they are compatible with the website.
- Avoid uploading large batches at once if the server creates several versions of every image.
- Schedule bulk processing during quieter hours.
- Consider an external image optimization or transformation service when the volume justifies it.
Image hotlinking
Hotlinking occurs when another website displays an image by using the file URL from your server. The image appears on someone else's page, but every view still uses your account's data transfer.
You can prevent this with the hotlink protection feature in cPanel or with server rules. Add your own domain, subdomains, and any authorized services to the allowlist so legitimate images are not blocked.
After enabling protection, test the website, email templates, and integrations that load images externally.
Ways to reduce CPU and other resource usage in WordPress
Control post and page revisions
WordPress saves earlier versions of content so changes can be restored. These revisions take up database space and, when they accumulate on a large website, may make certain administrative and backup operations more demanding.
You do not have to disable them completely. A balanced alternative is to keep a fixed number of revisions. Add the following line to wp-config.php, before the comment that tells you to stop editing:
define('WP_POST_REVISIONS', 5);In this example, WordPress keeps up to five revisions for each item. Change the number to suit your workflow. Back up the file before editing it and confirm that the constant has not already been defined. Limiting future revisions does not automatically remove revisions already stored in the database.
Keep the entire website updated
Updates may fix security vulnerabilities, compatibility problems, and inefficient operations.
Review the following regularly:
- WordPress.
- Plugins and themes.
- The PHP version and its extensions.
- Integrations, libraries, and custom code.
Create a backup before a major update and, whenever possible, test the change in a staging environment. Current software does not guarantee low resource usage on its own, but it reduces known risks and helps maintain compatibility between components.
Protect the login area
Repeated requests to wp-login.php or similar paths can create a steady server load. Automated traffic is the most common source, although websites with memberships or large user bases can also experience legitimate login spikes.
Limit failed attempts, enable multi-factor authentication, add CAPTCHA when appropriate, and avoid predictable administrative usernames. On membership and e-commerce websites, configure these controls carefully so legitimate customers are not locked out unnecessarily.
Configure caching
Without caching, WordPress may need to execute PHP and query the database whenever a visitor requests a page. A cache temporarily stores an already generated version so it can be delivered with less server work.
Depending on the platform, you may use page, object, browser, or server-level caching. LiteSpeed Cache is a strong option when the hosting platform uses LiteSpeed and is configured to support its features. A different solution may be more appropriate on other server stacks.
Review scheduled tasks and background processes
WordPress and its plugins use scheduled jobs to send email, create backups, publish content, synchronize data, and perform maintenance. A job that runs too frequently, is duplicated, or becomes stuck can increase usage without being visible to visitors.
Review WP-Cron activity, backups, security scans, imports, synchronization jobs, and report generation. Avoid running several demanding tasks at the same time, and store backups outside the hosting account whenever possible.
Optimize the database carefully
Very large tables, slow queries, accumulated transients, or data left behind by removed plugins may affect performance.
Create a complete backup before cleaning or optimizing the database.
What if resource usage remains high?
If the website has been optimized and still exceeds its limits, the demand may be legitimate or the current plan may no longer provide enough capacity. Ask for a report showing which limit is reached, when it occurs, and which processes or sources generate the activity.
Depending on the findings, the next step may be to increase the resources of the shared plan, use a higher-capacity managed service, migrate to a VPS, or implement a specialized architecture.
A VPS provides allocated virtual resources and greater control, but it may also require additional administration, updates, monitoring, and security management.
The appropriate upgrade is not determined by visitor count alone. Concurrency, application type, database activity, storage, data transfer, background processes, and the required level of management should all be considered.
Need assistance?
If your account frequently reaches its limits, contact our support team.
We can help you review the symptoms and explain the options available for your website.
