HTTP 509 is ‘Bandwidth Limit Exceeded’ - a non-standard status code (used by some shared hosts and CDNs) that the server returns when the hosting plan’s monthly bandwidth allocation is exhausted. The fix: upgrade the plan, reduce traffic, or move to a provider with unmetered bandwidth. The team that hits 509 on a shared host is on the wrong plan for their traffic; the team that hits 509 on their own server has a billing issue or a runaway process.
Table of contents
- What 509 means
- How to check if it is really 509
- The fixes (in order of likelihood)
- If it is your own server
- How to prevent 509 in the future
- How this fits the rest of the stack
- FAQ
What 509 means
509 is the IANA-allocated code for ‘Bandwidth Limit Exceeded’. It is non-standard (not in the main RFC list) but used by:
-
cPanel/WHM shared hosting (when an account’s monthly bandwidth is exhausted)
-
Some CDN edge nodes (when a plan’s bandwidth cap is hit)
-
Some older Apache configurations with mod_bw
The body of the 509 response usually says ‘This site has exceeded its bandwidth allocation’. The team that sees 509 in a browser knows the problem immediately.
How to check if it is really 509
curl -I https://example.com/
Output: HTTP/1.1 509 Bandwidth Limit Exceeded (or similar). The body usually has the details.
Alternative: wget --server-response https://example.com/ 2>&1 | head. The team that scripts a check uses curl with -w '%{http_code}' to extract just the status code.
The fixes (in order of likelihood)
-
Upgrade the hosting plan - if on a metered shared host, the bandwidth cap is the cap. The team that is on a $5/month plan with 1 TB bandwidth hits this when traffic spikes. Upgrade to the next tier or to a plan with unmetered bandwidth.
-
Reduce traffic - if the cap cannot be lifted, reduce what is served. The team that serves large uncompressed images enables gzip/brotli; the team that serves the same large file to many users puts it behind a CDN; the team that has hot-linked images on other sites enables hotlink protection.
-
Move to a provider with unmetered bandwidth - most cloud providers (AWS, DigitalOcean, RunxBuild) charge for bandwidth at the egress rate but do not have a hard cap. The team that is hitting the cap on a shared host usually has a real workload that belongs on a VM.
-
Add a CDN - Cloudflare, Fastly, BunnyCDN, etc. The team that puts a CDN in front of a bandwidth-capped site shifts most of the traffic to the CDN’s free or low-cost bandwidth.
If it is your own server
The team that runs their own server (no hosting cap) and sees 509:
-
The web server is configured to return 509 (Apache mod_bw, custom nginx config). Check the config.
-
A monitoring system is interpreting bandwidth as a 509. Check the alert source.
-
A WAF or DDoS protection layer is returning 509 when bandwidth exceeds a threshold (some providers do this, e.g., Cloudflare’s Under Attack mode).
The team that uses cPanel-style metered hosting has 509 because of the cap. The team that runs their own server almost never sees 509.
How to prevent 509 in the future
-
Monitor bandwidth - alert at 80% of monthly cap, not 100%. The team that has the alert set up has time to upgrade or move before the cap hits.
-
Use a CDN - the CDN serves most of the static content, and the origin only serves dynamic requests. The origin’s bandwidth drops to a fraction of the total.
-
Compress responses - gzip or brotli. The team that enables compression on nginx drops bandwidth by 60-80% for text content (HTML, CSS, JS).
-
Cache aggressively - Cache-Control headers on static assets, application-level caching for dynamic content. The team that has a 1-hour cache on the homepage serves 24x fewer requests per day per visitor.
FAQ
Is 509 a standard HTTP status code?
Technically yes (IANA-allocated for ‘Bandwidth Limit Exceeded’) but not in the main RFC 7231 list. It is widely supported by hosting control panels (cPanel, Plesk) but is not commonly used by mainstream web servers (nginx, Apache return 503 or a custom page for the same condition).
How is 509 different from 503?
503 is ‘Service Unavailable’ - a generic error meaning the server is temporarily down. 509 is more specific - the server is up but has hit a bandwidth cap. 503 is universally supported; 509 is a hosting-specific code.
Will a CDN fix 509?
Yes, for the most common case. A CDN serves most of the static content, so the origin’s bandwidth drops significantly. The team that has the 509 cap on a shared host puts Cloudflare (free tier) in front and the cap is rarely hit.
What is the default cPanel bandwidth cap?
Depends on the plan. Common defaults: 1 TB/month for entry-level shared, 5-10 TB/month for mid-tier, unmetered for VPS/dedicated. The team that is on a 1 TB cap and serves a 1080p video to 10,000 visitors hits the cap in a single afternoon.
Can I return 509 from nginx on purpose?
Yes, with a custom error page: error_page 509 /bandwidth_exceeded.html;. The team that simulates a 509 to test the client experience does this. In production, returning 503 with a custom body is more standard than 509.
How this fits the rest of the stack
For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.
Useful related references: