TL;DR / Summary: Bandwidth surprises on a VPS usually come from three things: an unmonitored backup, a public endpoint being scraped, or egress billing that counts the wrong direction. Measure per-interface, per-hour, before you buy a bigger plan.
Know what the meter counts
Most providers bill egress — data leaving the server — and give ingress free. A few count total traffic in both directions. The difference changes your capacity by half.
Check the contract wording, not the marketing page. “Unmetered” often means unmetered at a certain port speed, which is a very different promise.
Also check whether internal traffic between services on the same host counts. It usually does not, but the billing dashboard may include it.
Measure at the interface
A simple total on the dashboard hides which service is responsible. Per-interface counters tell you whether the traffic is web, backup, or something unexpected.
Sample every minute for a few days and keep the data. A spike at 03:00 is almost always a cron job, and a spike during business hours is almost always real users.
Sources worth checking first
- Backups — nightly uploads can exceed all user traffic
- Log shipping — verbose logs sent off-host grow quietly
- Crawlers — a misconfigured robots file invites a full crawl daily
- Updates — package caches downloading on a schedule
- Media — images and video served without caching
Five checks cover most unexpected bills, and all five are fixable without upgrading.
Reducing egress without breaking things
Cache aggressively at the edge. A response served from cache costs nothing in origin egress, and most small sites can push cache hit rates above eighty per cent.
Compress text and images. A twenty per cent reduction in bytes is a twenty per cent reduction in the bill, and it improves load times at the same time.
The cheapest bandwidth is the request that never reaches the origin.
Move backups to a separate storage service that does not bill against the VPS allowance. This alone resolves a surprising number of overage complaints.
Alerting before the limit
Set an alert at fifty and eighty per cent of the monthly allowance. The fifty per cent alert is the useful one, because it arrives while there is still time to find the cause.
Alert on rate as well as total. A sudden spike of ten gigabytes in an hour is actionable; a total that creeps up over a month is not.
Send alerts somewhere a person reads them. A dashboard nobody opens is not monitoring.
When the traffic is real
If the measurement shows genuine user growth, that is a good problem. Compare the cost of a larger allowance against the cost of edge caching and image optimisation.
Often the cheaper answer is to serve media from an object store or CDN with its own allowance, keeping the VPS for application traffic.
Model the monthly cost at current growth before upgrading. A plan that fits this month may be wrong in three, and annual commitments are hard to undo.
Documenting the budget
Record the allowance, the billing direction, the current monthly usage, and the top three consumers. One page, updated monthly.
That page turns a recurring surprise into a known cost, and it makes renewal conversations much shorter.
For plan specifications and traffic allowances across providers, virtual server VPS plans lists the numbers side by side. Compare the egress figure and the port speed, then measure your own usage before choosing — the allowance is only relevant next to a real baseline.
Reading the graph correctly
Most dashboards show an average over five minutes, which hides short bursts. A backup that saturates the link for ninety seconds can look like a flat line.
Switch to the finest resolution the provider offers when investigating. Averages are for trends; peaks are for billing.
Watch both directions even if only one is billed. Ingress spikes often explain egress spikes a few minutes later, particularly with proxies and mirrors.
The bill is written in peaks. The capacity plan is written in averages.
Export a week of data before changing anything. The baseline is what makes the next measurement meaningful.
Correlate with the access log. A bandwidth spike with no matching requests is usually internal, and internal traffic is the easiest to move off the bill.
Choosing a plan by traffic shape
Two sites with the same monthly total can need different plans. One has steady traffic; the other has a daily burst that saturates the port for ten minutes.
Bursty traffic needs port speed and cache headroom. Steady traffic needs allowance and little else.
Measure the shape before comparing prices. A plan with a larger allowance and a slower port will fail a bursty site just as surely as a small allowance.
Monthly totals hide the shape that actually breaks things.
Look at the ninety-fifth percentile rather than the average. It is the number that predicts user complaints.
Record the shape in the capacity note. It is the detail that makes a renewal conversation productive rather than speculative.
