HTTP 509 error: understand, diagnose, and resolve

Procédure

What is error 509?

The HTTP error code 509 means that the site is exceeding the resource limits provided by its hosting plan. The server then temporarily refuses to process part or all of the requests associated with the hosting plan.

Two limits can trigger this error:

• Simultaneous connections: number of HTTP connections open at the same time
• Request volume: number of requests over a period of time

A limit, not a block

Error 509 is not a block and therefore cannot be lifted manually, either by the client or by support. It disappears automatically as soon as the site's usage drops back below the limits of its plan.

If the error returns regularly, the cause of the overuse is still present: it must be identified and addressed (see the following sections).

Common situations

In practice, error 509 most often appears in one of the following cases:

• Too much legitimate traffic for the plan: the site receives more visitors than its plan can handle.
• SEO and AI robots too active: crawlers explore the site intensively, sometimes thousands of pages per hour.
• DDoS attack: a large number of malicious requests tries to overwhelm the site.
• HTTP resource poorly optimized: a URL is heavily requested (advertising campaign, organic virality, etc.) but requires a large amount of resources to be processed (no page cache, poorly optimized SQL query, etc.).
• Bug generating a request loop: for example, an AJAX script that calls the same URL in a loop.
• Infected or hacked site: hackers use the site to host phishing landing pages or fraudulent campaign pages that attract significant traffic.

Diagnosing the source of the problem

The website access log is the main source for understanding which requests are causing the error.

1. From your cPanel interface, retrieve the access log associated with the website in question.
2. Identify the most frequently requested URLs: the same resource being called in a loop often indicates a bug or a targeted page.
3. Identify the most frequent IP addresses and user agents: names such as Googlebot, Bingbot, GPTBot, ClaudeBot or AhrefsBot indicate bots.
4. Compare with a browser-side analytics tool (Google Analytics or equivalent).

The comparison in step 4 is decisive. A tool like Google Analytics works in JavaScript: it only counts real visitors whose browser executes the script. If the access log shows far more requests than the visits measured by Analytics, the difference is very likely due to robots, an attack, or automated calls.

Unknown or suspicious URLs in the log (pages you did not create, paths to unusual PHP files) should make you think of a hack.

The two possible solutions

To permanently stop error 509, two options are available:

• Migrate to a VPS: suitable when the traffic is legitimate and the site has simply exceeded the capabilities of a shared hosting plan. A VPS offers dedicated resources, without these connection and request limits.
• Reduce consumption: suitable when the overuse comes from robots, attacks, a bug or poorly used caching. The tools described below make it possible to reduce the number of HTTP requests and connections.

Before considering a migration, it is recommended to check in the logs that the traffic is indeed legitimate: migrating a hacked site or one bombarded by robots does not solve the cause.

Tools to reduce consumption

Limit crawling with robots.txt

The robots.txt file, placed at the root of the site, tells SEO and AI bots which pages they can crawl. You can use it to forbid entire directories or certain AI bots you do not need. You can also define a minimum waiting time between crawling two pages.

Example:

User-agent: GPTBot
Disallow: /

User-agent: Claudebot
Crawl-Delay: 60

User-agent: *
Disallow: /panier/
Disallow: /*?filtre=

This is particularly useful when your website is overwhelmed by crawling bots. Indeed, since the rise of AI training bots, some bots carry out maximum crawling, sometimes unnecessarily. For example, AI bots are particularly known for trying every possible combination of filters and sorting on product listing pages.

Beyond the wasted bandwidth from this type of crawling, SEO and AI bots may consider that your website has far too many pages. They may thus stop crawling before finishing the exploration of your entire website, which hurts your SEO. It is in your interest to limit the pages crawled so that the bots can focus on the pages that provide the most value in terms of SEO and GEO.

Respectful bots follow these rules; malicious bots ignore them, which is why the following tools are useful.

LWS Protect

LWS Protect includes three useful protections against error 509:

• Robot rate limiting: limits the frequency of requests from SEO and AI bots without blocking them entirely.
• Aggressive Anti-DDoS: subjects browsers to a JavaScript challenge. Real visitors get through, automated scripts are stopped.
• Blocking IPs with poor reputation: filters addresses known for spam, attacks, or scraping.

See the LWS Protect documentation for more information.

Fastest Cache

The Fastest Cache caching system makes it possible to serve a pre-generated version of pages. The server no longer runs PHP / Node.js / Python or database queries for each visit, which reduces resource usage and loading time. This is particularly important for a page targeted by an advertising campaign.

If the page in question is dynamic (contains parts that vary depending on the connected visitor, the connected country, etc.), you can implement partial caching: first load the page skeleton and the static content that is identical for all visitors, then load the dynamic content via an asynchronous JavaScript request. You can thus cache the static content.

To learn more about using Fastest Cache, see the product documentation.

Cloudflare Under Attack mode

If the site goes through Cloudflare, “Under Attack” mode imposes a verification step on visitors before they can access the site. It is useful during a DDoS attack, but should be disabled once the attack is over because it slows down visitors’ first access.