Your host says you exceed the CPU limit: what to do

What the CPU limit means

On shared hosting your site shares a server with others, so the host counts how much CPU time PHP and MySQL use per day. Every page view costs milliseconds or seconds of CPU. The limit is usually exceeded not because of customers but because of everything else.

Who usually eats the CPU

• bots: SEO crawlers, price scrapers, vulnerability scanners. They open thousands of filter and search pages, and each one is a full PHP run;
• cron jobs: product imports, currency updates, feed generation every 5 minutes when once an hour or a day would do;
• WordPress: wp-cron on every visit, Heartbeat in the admin, attacks on xmlrpc.php and wp-login.php;
• OpenCart: product counts in categories, heavy filters, thumbnail generation, modules calling external APIs;
• slow database queries without indexes: one such query on every page multiplies by every visit.

How to find the cause

• look at CPU usage by hour in the hosting panel: a flat load around the clock means bots or cron, daytime peaks mean visitors;
• open the access log and count requests by IP and User-Agent: if bots top the list, you’ve found it;
• check the cron schedule in the hosting panel;
• turn on the MySQL slow query log if your host allows it.

What helps the most

• limit or block bots you don’t need (robots.txt, rules in .htaccess or nginx);
• keep filter and internal search pages out of the index;
• run heavy cron jobs less often and never through the browser;
• in WordPress, disable wp-cron on every request, run it from the host’s cron and restrict xmlrpc;
• in OpenCart, turn off the category product counter and review your modules;
• move to PHP 8 with OPcache: the same code simply runs faster.

More on OpenCart in why OpenCart is slow. If you’d rather not dig into it yourself, I do website speed audits and optimization with measurements before and after.