Everything Failover LB does

44 pages, grouped the same way the product groups them. Each one says what the feature is for, how to set it up, where it falls short, and what to use instead when it does.

Getting started How it compares

Traffic

Traffic · 14 pages

Sites

One hostname and every rule that goes with it.

Backend pools

The list of servers behind a site, and how traffic is shared.

Active health checks

Probe every backend on a schedule and pull the dead ones out.

Load balancing methods

Round robin, least connections, hashing and consistent hashing.

Sticky sessions

Send the same visitor back to the same backend.

Slow start

Ease traffic onto a server that just came back.

Adaptive weighting

Give the faster backends more of the work.

Path routing

Send /api one way and everything else another.

TCP and UDP proxying

Balance a database, a mail server or a game server.

Caching

Keep a copy of what does not change and stop asking for it.

Rate and connection limits

Cap how fast and how much one visitor can ask for.

Error pages

Replace the bare nginx error with something of your own.

Maps and key value lookups

One lookup table, used by as many sites as you like.

Static files and redirects

Serve files off disk or forward an old address.

Certificates and TLS

Certificates and TLS · 6 pages

Let's Encrypt certificates

Free certificates that renew themselves, in a cluster.

Certificate lifecycle

Issue, renew, replicate and retire, without a calendar.

Paid certificate authorities

Buy from DigiCert or Sectigo and still automate it.

Post quantum key exchange

X25519MLKEM768 first, classic curves behind it.

TLS settings

Protocols, ciphers, stapling and HTTP/2 or HTTP/3.

Backend TLS

Speak https to your own servers, and verify it properly.

Security

Security · 11 pages

Web application firewall

ModSecurity with the OWASP Core Rule Set, per site.

WAF learning sessions

Watch real testing, then keep only the exceptions you need.

WAF profiles

One tuned rule set shared by every site that needs it.

Country blocking

Cut scanner noise and meet a rule about where you serve.

Login watch

Catch password spraying, not just brute force.

Access lists

Who may reach a site, by address, with a password on top.

Backend trust tokens

Prove to your own servers that a request came from the fleet.

Users, roles and TOTP

Three roles, a second factor, and recovery codes.

Single sign on

OIDC with PKCE, groups mapped to roles.

Audit log

Who changed what, when, and from where.

How the software is hardened

An unprivileged container and a small root agent.

Fleet

Fleet · 10 pages

Clustering

Every node holds the whole config. No central controller.

Two phase apply

Nothing goes live until every node says the config is valid.

Active and standby

One node takes changes, both serve traffic.

DNS failover and GSLB

Hand out the address of a node that is actually up.

The tunnel

Reach a backend that has no public address at all.

The nginx build

nginx from source with 80 modules, rebuilt from the GUI.

Upgrades

One node at a time, tested before anything is replaced.

Backup and restore

One encrypted file that rebuilds the fleet somewhere else.

Change history and rollback

Every apply kept, and put back with one click.

Import an existing config

Read the nginx you already run and see what it becomes.

Visibility

Visibility · 3 pages

Utilization charts

Requests, connections, processor and memory over time.

The dashboard

What every node is doing, on one screen.

The JSON API

Everything the GUI does, available to a script.

Not on the list

What this cannot do

Being straight about the gaps is worth more than a longer feature list. These are the things people ask for that are genuinely not here.

Packaged video streaming

HLS, DASH and f4f are modules compiled into the paid nginx binary and there is no way to add them from out here. If you need packaged video, that is a real reason to buy NGINX Plus.

NTLM connection pinning

Keeping a connection pinned for the whole NTLM handshake is a Windows authentication thing that cannot be faked from outside the process. If you proxy to something that needs it, this will bite you.

MQTT preread and filtering

Stream level MQTT parsing is paid only, with no way around it.

Request queueing

Holding requests when every backend is busy, rather than failing them. Nothing here does this. Add capacity, or use a connection limit so the failure at least becomes predictable.

Truly reload free reconfiguration

Everything here ends in a graceful reload. That is not the problem it sounds like, but if your backends change many times a minute the reload rate becomes the limit.

Somebody to call at 3am

The row we lose worst on the comparison page. There is no support contract and no number to ring. If that matters where you work, it matters more than every feature above put together.

See the full comparison

Two fresh servers is all it takes

Ubuntu 22.04 or newer, root access, and about twenty minutes. The installer does the rest and it is safe to run twice.

Getting started Search the how to

Product

Start here

More