Acceptable Use Policy

Version 3.4. Published 11 November 2026. See the Policy Version History for applicability.

You must use IT Nut services lawfully and without materially endangering other users, infrastructure or third parties. This policy also sets commercial risk restrictions that may be stricter than the law in a particular location; they are not assertions that every restricted activity is criminal everywhere.

1. Prohibited activity

Do not use the services for:

• Child sexual abuse material, grooming, sexual exploitation, trafficking or other child abuse.
• Phishing, credential theft, impersonation intended to deceive, fraudulent storefronts, investment scams, forged verification documents or knowingly facilitating those activities.
• Malware distribution, ransomware, botnet control, denial-of-service attacks, unauthorised scanning or intrusion, stolen access credentials, or malicious exploitation tools.
• Spam, purchased/harvested mailing lists, open mail relays, deceptive sender identity, or bulk sending without an applicable lawful basis and the required opt-in evidence.
• Copyright or trademark infringement, counterfeit products, or installing, running, storing, distributing or making available software, scripts, themes or plugins marketed or supplied as nulled, cracked or pirated, or with licence or security controls removed or bypassed. Legitimate use or modification of open-source software within its applicable licence is not prohibited merely because the software is modified. Unlawful disclosure of personal/confidential information, non-consensual intimate images, unlawful harassment and credible threats are also prohibited.
• Terrorist support, incitement to violence, prohibited weapons/drug commerce or other unlawful trade.
• Gambling/betting operations, financial crypto exchange/custody/mining services, or unlicensed regulated financial services. These are IT Nut risk exclusions unless a specifically identified lawful exception is expressly agreed; Bangladesh operational restrictions continue to apply to foreign-server plans.
• Pornographic hosting across our products, subject to the prospective application of this version.
• Circumventing suspension, manipulating promotions/refunds, ad/click fraud, or knowingly enabling a prohibited operation for another person.

Criticism, journalism, satire, a disputed civil allegation or a negative review is not automatically fraud or unlawful content. We assess specific evidence and applicable legal obligations. An unverified complaint does not itself prove a breach.

2. Resource and network limits

The accepted Service Scope and Backup Policy states CPU allocation, RAM, storage, bandwidth, I/O, processes, inode and email limits relevant to your plan. “Unmetered” means no per-unit usage billing within the described service design; it does not mean unlimited processing or permission to impair others. We do not use a generic hidden limit to defeat a larger allocation advertised and purchased.

Shared hosting is designed for websites and associated mail/data, not general backup repositories, public file-distribution networks, game servers, open proxies, mining or sustained compute jobs outside its specified scope. VPS and dedicated products allow broader use within their purchased allocation and this AUP.

We may throttle a harmful process, block an affected port/IP, quarantine a file or limit sending as a protective step. Unless immediate containment is necessary, we explain the measured limit and offer remediation or a separately agreed upgrade. No automatic paid upgrade occurs without authorisation.

2.1 Automatic plan limits

Shared, reseller and other hosting on shared servers runs with per-account isolation. Each cPanel account has its own limits for CPU, physical memory, entry processes (concurrent requests), total processes, disk I/O and IOPS, as set by its plan, and database activity is managed by a separate database governor. For reseller plans, the reseller’s aggregate limits also apply.

When an account reaches one of these limits, the server automatically slows or refuses the excess work for that account. Visitors may then see slow pages or temporary errors such as “503 Service Unavailable” or “508 Resource Limit Reached”. This is the normal operation of a plan limit, not a service fault, and it does not by itself mean you have breached this policy.

2.2 Sustained overuse

A shared plan is sized for a website whose normal use stays within the plan, with occasional peaks. An account is in sustained overuse when, in any rolling 7-day period, our monitoring records at least one of the following:

• the account reaches its CPU, memory, entry-process or process limit on 3 or more separate days;
• the account’s average CPU use is 50% or more of its plan’s CPU limit; or
• the database governor restricts the account’s database activity on 3 or more separate days.

Sustained overuse usually means the website needs optimisation, for example caching, blocking abusive bots or replacing a heavy plugin, or a larger plan. Traffic caused by malware or an attack on your site is handled as a security matter under the Abuse Handling and Customer Conduct Policy, although the steps below may still apply to protect the server.

2.3 How we handle sustained overuse

1. Notice. We open a support ticket that shows the measured usage and the limit reached, explains the likely cause where we can identify it, and sets out your options: reduce the usage, upgrade to a suitable plan, or move to a VPS. You have 7 calendar days to act.
2. Final notice. If the sustained overuse continues after that period, we send a final notice giving 72 hours.
3. Restriction or suspension. If the sustained overuse still continues, we may apply stricter limits to the account or suspend the service until you upgrade to a suitable plan, move to a VPS, or show that usage has returned within the plan. Suspension under this section does not extend the paid term. Refunds, if any, follow the Refund and Cancellation Policy.
4. Repeat overuse. If sustained overuse returns within 90 days after it was resolved, we may begin at the final notice.

We normally act only on the affected cPanel account. Where a reseller’s aggregate limits are exhausted, we may apply these steps to the reseller service.

2.4 Immediate action

We may stop processes, throttle the account or suspend the service immediately and without prior notice where its usage threatens server stability or other customers’ service. Examples include memory exhaustion, sustained disk I/O saturation, database overload, runaway or looping processes, and attack or bot traffic that our normal controls cannot contain. We will then tell you what we did and why, normally on the same business day, and the steps in section 2.3 apply to restoring the service.

2.5 Upgrades

An upgrade takes effect only after you accept it and pay the applicable price difference. We may recommend a plan, but you choose whether to upgrade, optimise the website or move the service. If none of these resolves the sustained overuse, section 2.3 applies.

2.6 Backups, logs and unrelated files

Storage on shared servers, including shared, reseller and managed WordPress hosting, is for operating the websites and email hosted in the account. It is not long-term storage for backups, logs or unrelated files, even when the account is within its storage quota. Maintaining your websites, their logs and the account’s storage is your responsibility.

• Backup archives. Download any backup or export you create to your own storage straight after creating it. Examples include a cPanel full or partial backup, a .wpress, .tar, .tar.gz, .zip, .gz, .jpa, .bkup or .sql file, and the contents of backup folders such as ai1wm-backups, softaculous_backups, wp-content/updraft or backups. Do not keep such an archive in the account for more than 30 days after it was created or last modified.
• Log files. Keep logs under control. Do not keep a log file, such as error_log, laravel.log, debug.log or an application log, that is larger than 100 MB, or a set of rotated logs that together exceed 100 MB, for more than 30 days.
• Temporary files and trash. Upload temporary files, stale session files and items in trash folders such as tmp and .trash that are older than 30 days may be removed.
• Unrelated files. Do not store files that are not directly related to a website or email hosted in the account. Examples include personal file storage, photo, video, music or document collections that no website uses, software installers, disk images, copies or archives of websites not hosted in the account, and files kept for other people.

We may delete, truncate or rotate files covered by this section. Where practical, we first notify you by support ticket, list the files concerned and give you 72 hours to download or remove them. Where server storage is critically low or the files are affecting the service, we may act without prior notice and tell you afterwards what was removed. A written exception agreed in a support ticket, for example during an active restore or migration, applies for the period stated in it.

These files are excluded from our backups, as described in the Service Scope and Backup Policy. A file deleted under this section cannot be recovered, and we are not responsible for its loss. Keep your own copies outside the account.

2.7 Database storage

Each shared, eCommerce and Speed Star hosting plan includes a database storage allowance, shown for your plan on its plan page and in your order. Each cPanel account of a reseller plan, including the reseller’s own account, has an allowance of 1 GB. The allowance covers all databases of the account together. It is measured as the space the databases occupy on the server, including indexes and unused space inside table files. The number of databases is not limited by this section. VPS, cloud and dedicated services are not subject to it.

When the account’s databases use 80% of the allowance we may send you a notice. When they reach 100% we open a support ticket that shows the measured usage and the allowance. You then have 7 calendar days to reduce usage, upgrade to a plan with a larger allowance, or move to a VPS. If usage is still at or above the allowance after that period, we may restrict write access to the account’s databases until usage is below the allowance. Reading data, deleting data and dropping tables stay available while writes are restricted. On request we can rebuild tables to release unused space.

If usage stays at or above the allowance for a further 30 days while writes are restricted, it is sustained overuse and steps 2 to 4 of section 2.3 apply.

A database that grows by more than 5 GB in one hour, or reaches 50 GB, may be restricted immediately under section 2.4. We do not delete your data to reduce database usage. An upgrade takes effect only as described in section 2.5. Changes to an allowance follow section 10 of the Terms of Service. This section applies from 17 November 2026, and to reseller plans from 18 November 2026.

3. Security and permitted testing

Maintain supported software, protect credentials, promptly address a notified compromise, and keep independent recoverable backups. Configure services you administer securely, including proxy authentication and mail relays. Provider-side obligations remain as agreed in your plan.

Security testing requires permission from the asset owner and our prior coordination where it may affect shared infrastructure. A vulnerability report should avoid unnecessary access to personal data, disruption or publication of secrets. Send security reports through the client-area support route and identify them as a security report. This section is not an assurance of third-party legal immunity or a paid bounty.

4. Resellers and authorised users

Resellers must impose substantially equivalent use restrictions on their customers, keep reliable contact information and a lawful basis for any required identity checks, handle first-line end-user support and cooperate with urgent abuse response. Resellers remain accountable for their own contractual obligations and end-user misuse within their service, subject to applicable law.

We normally isolate an offending end-user service where practical. We may restrict the wider reseller package where the issue is systemic, intentional, repeatedly unresolved or cannot otherwise be contained. Our right to act does not make us the reseller’s customers’ contractual hosting supplier.

5. Product-specific restrictions and enforcement

RDP, IP/proxy, n8n and AI-agent services do not authorise violation of a destination site’s rules, credential harvesting, queue manipulation, mass fake-account creation or unauthorised automated actions. You are responsible for permissions, external API costs, agent credentials and approvals of actions performed by software you control. IT Nut does not guarantee access to visa, ticketing, advertising or other external platforms.

The Abuse Policy governs verification, notices, containment, termination and any cost recovery. Verified deliberate fraud can result in final termination without discretionary restoration. Allegation errors, lawful counter-notices and statutory complaint routes remain reviewable. No fee applies merely because somebody reported you.