Best web server software ?

thenet

Hi , what is best web server for security , speed and performance ? (personal use)

I only test nginx and apache .

charlie

Nginx, definitelly.

raindog308

thenet said: speed and performance

How are these different in real-world scenarios?

thenet said: what is best web server for security

Probably OpenBSD's httpd, which is written by security freaks from the ground up to be secure and has pledge.

But realistically, the web server itself is usually not the problem...it's the app on top of it.

doughnet

Caddy Server!!
by far the easiest to use!

simplest HTTP2 & Let's Encrypt integration.

https://lowendtalk.com/discussion/79199/script-1-click-caddy-installer-manager/p1

JustAMacUser

I've read many people complain about Apache's performance or memory usage; however, if tuned correctly it performs well.

That being said, I prefer Nginx because I find it performs well right out of the box and the conf files seem a little more straight-forward.

sin

Hiawatha is pretty sweet

doughmanes

+1 for nginx and its only secure as what insecure stuff you install on it.

HostSlayer

NGINX has my vote

Vita

I personally use Nginx with PHP-FPM. It performs great, but as some already mentioned it really depends on the app you run and hardware that runs everything. I've heard good things about Caddy, but never tried it.

Jarry

Personally I use apache, with varnish as http-proxy and pound/hitch/haproxy for ssl/tls. nginx is great, but it has its drawbacks (i.e. no .htaccess support). This might be issue with shared hostings. Of course, apache has its own issues...

manlivo

+1 Nginx

WebProject

• 1 for Caddy and optimised Apache

Mad

+1 Nginx too

Advicerxyz

+1 on nginx

jureve

Nginx is a great option!

NanoG6

I'm starting to love Caddyserver

nfn

I use nginx but lately I'm playing with h2o and I must say.... I like it!

Megahosting

Nginx is the best

rm_

Lighttpd works well. Didn't like nginx due to weird and inconvenient configs.

joepie91

Caddy, definitely.

HBAndrei

+1 for Nginx, it's just great and easy to use and configure.

Eedit: But Caddy definitely looks nice. I hadn't heard of it before, but will surely play around with it soon.

Vbro

I use XAMPP

eva2000

Definitely Nginx is at the top of my list but if you use original poster's criteria then it's relative to how Nginx is configured. As security wise because Nginx does support native .htaccess, if a web app has sensitive info a web developer protects via a .htaccess deny from all file, then it's open to the world if web app is uploaded to an Nginx server as is without further nginx rewrite rules to deny access to that private folder.

I've evaluated h2o and Caddy for potential integration into my Centmin Mod LEMP stack and Caddy is a clear candidate and both are nice but performance (particularly for HTTP/2 HTTPS) is way behind Nginx especially as you add more HTTP headers for various requests like HPKP, HSTS, cache-control, security headers. The more HTTP headers you add, the further HTTP/2 HTTPS performance drops in h2o and Caddy in comparison to Nginx. Try it for yourself and see in h2o and Caddy

For Centmin Mod Nginx vs Caddy older benchmarks - h2load HTTP/2 based stress test with higher loads at 1,000 concurrent users and 50,0000 requests

System

• Server 1GB OpenVZ using Xeon E3-1230v2

Commands used:

For Centmin Mod Nginx 1.11.3 HTTP/2 port 443

echo "CentminMod.com Nginx 1.11.3 HTTP/2 h2load stress test"; sleep 30; for i in {1..3}; do /usr/local/bin/h2load -c1000 -m100 -n50000 -v https://domain1.com:443 > h2load.$i.log; cat h2load.$i.log | awk '/finished in/ {print $4 " req/s "} /requests: / {print ($8/$2*100)"% completed"}' | tr -d '\n'; echo; sleep 30; done;

For Caddy 0.9 HTTP/2 port 448

echo "Caddy 0.9 HTTP/2 h2load stress test"; sleep 30; for i in {1..3}; do /usr/local/bin/h2load -c1000 -m100 -n50000 -v https://domain1.com:448 > h2load.$i.log; cat h2load.$i.log | awk '/finished in/ {print $4 " req/s "} /requests: / {print ($8/$2*100)"% completed"}' | tr -d '\n'; echo; sleep 30; done;

Resulting output:

• For Centmin Mod Nginx 1.11.3 HTTP/2 port 443 = 11,322.50 req/s average
• For Caddy 0.9 HTTP/2 port 448 = 3,751.71 req/s average

output

echo "CentminMod.com Nginx 1.11.3 HTTP/2 h2load stress test"; sleep 30; for i in {1..3}; do /usr/local/bin/h2load -c1000 -m100 -n50000 -v https://domain1.com:443 > h2load.$i.log; cat h2load.$i.log | awk '/finished in/ {print $4 " req/s "} /requests: / {print ($8/$2*100)"% completed"}' | tr -d '\n'; echo; sleep 30; done;
CentminMod.com Nginx 1.11.3 HTTP/2 h2load stress test
8896.39 req/s 100% completed
17788.95 req/s 100% completed
7282.18 req/s 100% completed

and

echo "Caddy 0.9 HTTP/2 h2load stress test"; sleep 30; for i in {1..3}; do /usr/local/bin/h2load -c1000 -m100 -n50000 -v https://domain1.com:448 > h2load.$i.log; cat h2load.$i.log | awk '/finished in/ {print $4 " req/s "} /requests: / {print ($8/$2*100)"% completed"}' | tr -d '\n'; echo; sleep 30; done;
Caddy 0.9 HTTP/2 h2load stress test
3908.97 req/s 100% completed
3504.25 req/s 100% completed
3841.91 req/s 100% completed

Caddy used more memory than Nginx and spent more time in cpu.

• CentminMod.com Nginx 1.11.3 HTTP/2 h2load stress test cpu load peaked at 0.60 and 548MB total memory used
• Caddy 0.9 HTTP/2 h2load stress test cpu load peaked at 1.57 and 1289MB total memory used

Tried to keep matching amount of HTTP headers for more accurate results

Caddy

curl -Ik https://domain1.com:448
HTTP/2 200
accept-ranges: bytes
cache-control: max-age=86400
content-type: text/html; charset=utf-8
etag: W/"57a637f3-552"
last-modified: Sat, 06 Aug 2016 19:18:11 GMT
server: Caddy
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Caddy via CentminMod
x-xss-protection: 1; mode=block
content-length: 1362
date: Sat, 06 Aug 2016 19:30:28 GMT

Nginx

curl -Ik https://domain1.com:443
HTTP/2 200
date: Sat, 06 Aug 2016 19:30:23 GMT
content-type: text/html; charset=utf-8
content-length: 1362
last-modified: Sat, 06 Aug 2016 19:18:11 GMT
etag: "57a637f3-552"
server: nginx centminmod
x-powered-by: centminmod
expires: Sun, 07 Aug 2016 19:30:23 GMT
cache-control: max-age=86400
cache-control: public, must-revalidate, proxy-revalidate
accept-ranges: bytes

Remember above is HTTP/2 HTTPS stress test via h2load

Lm85H4gFkh3wk3

thttpd ftw

http://acme.com/software/thttpd/

bersy

sin said: Hiawatha is pretty sweet

How mature is that product? Do you use Hiawatha in production? Is it being developed and maintained by one person?

Malin

I've been getting pretty good results with OpenLiteSpeed and PHP7 compared to Apache2 + PHP7 + PHP-FPM or same setup but with Varnish cache or Nginx as reverse proxy + Apache2 + PHP7 + PHP-FPM

Amitz

@bersy said:
How mature is that product?

Very, very mature.

Do you use Hiawatha in production?

I did. Great stuff.

Is it being developed and maintained by one person?

Yes. Problem.