High CPU Usage on Hostinger/Bluehost: How to Find Which WordPress Plugin is Causing It

Adnan Naseem
WordPress Developer & SEO Expert

You wake up, check your email, and see a terrifying message from your web host: "Your account has been temporarily suspended due to high CPU usage." Or perhaps you try to log into your WordPress admin dashboard, only to be greeted by a blank white screen or a massive 503 Service Unavailable error.
If you are using shared hosting like Hostinger, Bluehost, or SiteGround, you don't have unlimited server resources. When your website hits its RAM or CPU limits, the host throttles your site to protect the other websites on the same server. The natural instinct is to assume you are getting hacked or that your site has suddenly gone viral.
The truth? It is almost never traffic. 95% of the time, high CPU usage is caused by a single, poorly coded WordPress plugin running a massive background process.
Most hosting support teams will tell you to simply "upgrade to a more expensive dedicated server." Don't fall for it. Today, I am going to show you exactly how to diagnose your site, find the specific plugin draining your CPU, and fix the hidden settings that are suffocating your server.
Table of Contents
1. How to Identify the Culprit (Without Guessing)
The worst thing you can do is blindly deactivate and reactivate your 30 plugins one by one. This takes hours and rarely reveals background tasks that only spike the CPU every few hours.
Instead, we are going to use a free, lightweight diagnostic plugin to find the exact bottleneck in seconds.
Install the free plugin: Query Monitor
Query Monitor is the holy grail for WordPress developers. Once you install and activate it, it adds a new menu to your top admin bar. Here is how to use it:
- Open any page on your website (or the admin dashboard).
- Hover over the Query Monitor numbers in the top admin bar.
- Click on Queries by Component.
This screen will show you exactly how much database time each individual plugin is taking. If you see that your cache plugin is taking 0.01 seconds, but a related posts plugin is taking 4.5 seconds to load, you have instantly found your CPU killer. Deactivate it immediately.
2. The "Usual Suspects": Plugins Known to Spike CPU
If you cannot access your WordPress dashboard to install Query Monitor because you are locked out with a 503 error, you need to use your host's File Manager (or cPanel) to manually rename plugin folders to deactivate them. Start with these common offenders:
| Plugin Category | Why They Cause High CPU Usage |
|---|---|
| Security Plugins (Wordfence) | Plugins like Wordfence use a "Live Traffic" tracking feature. It logs every single bot and human that visits your site in real-time. On a shared Hostinger or Bluehost plan, this constant database writing will crash your server. (Fix: Turn off Live Traffic in settings). |
| Backup Plugins (UpdraftPlus) | If a backup plugin compresses your entire 2GB website into a zip file at 2 PM during your peak traffic hours, your CPU will max out at 100%. (Fix: Schedule backups for 3 AM when traffic is lowest). |
| Broken Link Checkers | These plugins constantly crawl every single link on every single page of your website in the background. They are notorious CPU killers. (Fix: Delete the plugin. Use a free external desktop tool like Screaming Frog or Xenu to check links). |
| Related Post Plugins | Many related post plugins run complex database queries every time a page loads to find matching tags. (Fix: Use your theme's built-in related posts feature, or offload it to a service like Jetpack). |
3. Fix #1: Limit the WordPress Heartbeat API
The WordPress Heartbeat API is a background process that allows your browser to talk to the server in real-time. It is responsible for auto-saving your posts while you write and telling you if another user is currently editing a post.
By default, the Heartbeat API sends a request (called a "tick") to your server every 15 seconds. If you leave your WordPress dashboard open in a background tab while you go eat lunch, your browser will send hundreds of PHP requests to your server, eating up your CPU limit for no reason.
The Fix: You need to slow this heartbeat down. You can install a free plugin like Heartbeat Control, or if you use a premium caching plugin like WP Rocket, FlyingPress, or LiteSpeed Cache, go into their settings and find the Heartbeat options. Change the frequency from 15 seconds to 120 seconds, and completely disable it on the frontend of your site.
🚀 Pre-Publish Formatting Tip
If you are contacting your host's support team for help and need to paste massive chunks of messy error logs or code snippets into their chat box, use our free Advanced Format Cleaner first. It strips out messy HTML spacing, making your error logs readable so support can actually help you.
4. Fix #2: Replace WP-Cron with a Real Cron Job
WordPress needs a way to trigger scheduled tasks, like publishing scheduled posts, checking for theme updates, or sending out newsletter emails. To do this, it uses a file called wp-cron.php.
However, WordPress doesn't have a real server clock. Instead, wp-cron.php runs every single time a user visits your website. If your site gets 100 visitors in one minute, WP-Cron fires 100 times, checking the database for tasks that don't exist. This results in massive CPU spikes.
The Fix: Disable the internal WP-Cron and replace it with a real server-level cron job.
- Open your
wp-config.phpfile via your host's File Manager. - Add this line of code before the "That's all, stop editing!" line:
define('DISABLE_WP_CRON', true); - Go into your Hostinger or Bluehost cPanel dashboard.
- Find the tool called Cron Jobs.
- Set up a new Cron Job to run every 30 minutes (or twice an hour), pointing it to your
wp-cron.phpfile (e.g.,wget -q -O - https://yourwebsite.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1).
Now, your server handles the schedule peacefully twice an hour, instead of 1,000 times a day triggered by random web traffic.
5. Fix #3: Offload Traffic to Cloudflare
Sometimes, high CPU isn't caused by plugins at all; it's caused by malicious bots. Spam bots, scrapers, and automated scripts crawl the web constantly. If 50 bots hit your site simultaneously looking for vulnerabilities, your CPU will crash.
If you are on shared hosting, you cannot afford to waste your precious CPU processing requests for spam bots.
The Fix: Route your domain through Cloudflare (their free tier is more than enough). Cloudflare acts as a massive shield in front of your server. Go into your Cloudflare dashboard and activate Bot Fight Mode. Cloudflare will automatically intercept and block malicious bots before they ever reach your Bluehost or Hostinger server, instantly dropping your CPU usage by up to 40%.
The Bottom Line
You do not need to upgrade to a $50/month VPS server just because your host sent you a CPU warning. Shared hosting is perfectly capable of handling thousands of visitors a day, provided your software is optimized. Install Query Monitor to find the bad plugins, limit your Heartbeat, fix WP-Cron, and let Cloudflare handle the bots. Your site will stay online, and your wallet will thank you.
Frequently Asked Questions
public_html/wp-content/plugins/, and rename the folder of the suspected plugin (e.g., rename "wordfence" to "wordfence-disabled"). This instantly deactivates the plugin and restores your dashboard access.