Sudden increase in droplet bandwidth without making any changes

Hi there,

If bandwidth suddenly goes up, it almost always means real traffic is hitting or leaving the Droplet. DigitalOcean doesn’t add usage on its own.

Common causes are bots or crawlers, someone downloading or hotlinking content, or a background process sending data out more often than before. Sometimes a new open port or endpoint gets discovered and starts receiving traffic.

I’d start by checking your web and system logs to see what’s generating the traffic. From there, adding basic rate limiting, firewall rules, or putting Cloudflare in front of the server usually helps a lot.

Once you see where the traffic is coming from, it’s much easier to control and bring usage back down.

Heya, @azeemcv

The first things to check are whether the Droplet is exposed publicly and getting hit by bots (common on ports 22, 80, 443, databases, etc.). Even failed scans and connection attempts count toward bandwidth. Check your web server logs, auth logs, and iftop/nload to see where traffic is actually going.

Also look for things like backups syncing, log shipping, metrics exporters, or any cron jobs that might be uploading data regularly. If the Droplet hosts a website, verify nothing is hotlinking large files or that you’re not serving assets without caching.

Regards