I've been "the computer guy" my whole life. The one you call when the Wi-Fi is haunted. But I never wrote code until this year, when AI assistants closed the gap and I built a movie-discovery site (flickomatic.com).
Current user count: me and my wife. So imagine my delight when the weekly hosting bill hit $82. And climbing. Here's what I found when I went digging. Four culprits, none of which I'd have guessed.
The biggest line item: "ISR Writes: 8.69M ($34.75)." ISR is the scheme where a page renders once and gets served from cache for a week. My site has about 2,000 pages. There's no arithmetic where that becomes 8.69 million.
Except there is, one sentence deep in the pricing docs: writes are billed in 8 KB chunks. That "8.69M writes" was really 70 GB of payload shoveled into the cache. New question: shoveled by whom?
My URLs look like /movie/603/the-matrix, but it turns out the title part was decorative. /movie/603/absolutely-anything rendered the same page, and each variant got cached as a brand-new entry at ~13 billed writes a pop. No human would ever notice. Crawlers, which hoard URLs in every variant they've ever seen, noticed constantly.
I now know the word "canonicalization": wrong URL gets a permanent redirect to the one true URL. One cached page per movie. Novel concept.
My link-preview cards fetched each movie poster with a "cached fetch," which sounds responsible. What it actually does is save the entire JPEG into the billed cache. About 19 writes per poster, thousands of movies, read back approximately never. A very expensive museum nobody visits. One changed line killed a third of the problem.
The traffic dashboard: homepage 58.7K requests/day, internal API 58.1K. Suspiciously identical. Top visitor identity: something called "node." At, you guessed it, 58.1K.
"node" is my own server. The homepage loaded its movie list by making a full HTTP request to its own API, once per visit, cached under a key that included every filter combination. My site was DDoSing itself. Politely. On a schedule. And I was paying for both directions.
If your function invocations outnumber your page views, go find yourself in your own logs before blaming outsiders. Heavy bot traffic kept hitting /blog/1, /blog/2, pages I never built. Bing's dashboard explained it: my domain was first "discovered" in January 2010. I bought it this year. Someone ran a blog here fifteen years ago and crawlers are still knocking on that dead door. They now get HTTP 410, "Gone," a status code I didn't know existed and now love.
"Bot traffic" turned out to be four different animals:
Back to hobby money. Site still wide open to the bots that matter.
Full disclosure: I didn't untangle this alone. I build with an AI coding assistant. I bring the dashboards and make the calls; it brings the patience to explain ISR billing to me twice. Twenty-five years of being everyone's tech guy, and it turns out what I was missing wasn't aptitude. It was a collaborator who never gets tired of my questions.
The site all this drama was protecting: https://flickomatic.com. Feedback welcome. I'm told that's how you get better at this.