ModSecurity Benchmark

ModSecurity Benchmark

OpenLiteSpeed vs. nginx and Apache

ModSecurity impacts server performance, but how much? And does it vary from server to server? We tested ModSecurity implementations on OpenLiteSpeed, nginx, and Apache, to see how they compare when loading static content using the OWASP ruleset.

 

Across the board, OpenLiteSpeed leaves nginx and Apache in the dust, but it is especially impressive with static files. OpenLiteSpeed’s intelligent ModSecurity implementation bypasses ruleset processing for static files as appropriate, leading to significant performance gains.

The Results

Small Static HTML File Benchmark

OpenLiteSpeed performed 90X better than nginx and 94X better than Apache when loading HTML with WAF enabled, using OWASP rules.

OpenLiteSpeed + LSCache 94515.8 Requests Per Second
Nginx + FastCGI Cache 1046.6 Requests Per Second
Apache + W3 Total Cache 1010 Requests Per Second
h2load -n 100000 -c 100 -t 1 -T 5 -m 10 -H 'Accept-Encoding: gzip,deflate' https://benchmark.com/1kstatic.html

ServerFinished In SecRequests/SecMB/SecFailuresHeader Compression
OpenLiteSpeed1.0694515.812.2097.18%
nginx9.551046.60.23035.52%
Apache9.910100.3600%

Small Static Image File Benchmark

OpenLiteSpeed performed 70X better than nginx and 71X better than Apache when loading an image with WAF enabled, using OWASP rules.

OpenLiteSpeed + LSCache 75492.3 Requests Per Second
Nginx + FastCGI Cache 1076.2 Requests Per Second
Apache + W3 Total Cache 1065.2 Requests Per Second
h2load -n 100000 -c 100 -t 1 -T 5 -m 10 -H 'Accept-Encoding: gzip,deflate' https://benchmark.com/1knogzip.jpg

ServerFinished In SecRequests/SecMB/SecFailuresHeader Compression
OpenLiteSpeed1.3275492.376.5097.37%
nginx9.291076.21.18038.55%
Apache9.391065.21.2800%

Try It Yourself

Feeling skeptical? It’s easy to verify these results! We followed the methodology laid out on http2benchmark.org, which means you could run the exact same tests in your own environment and see for yourself.

 

For the full details of our ModSecurity testing, including our goals and testing strategy, and additional benchmarks, please see ModSecurity Performance Comparison: Apache, nginx, LiteSpeed on the LiteSpeed blog.

Test Environment

Server Tested
  • OpenLiteSpeed V1.6.4
  • nginx V1.17.7
  • Apache V2.4.41
Client Machine
  • Memory Size: 1GB
  • CPU number: 1
  • CPU Threads: 1
  • CPU Model: Virtual CPU 6db7dc0e7704
  • Disk: NVMe SSD
Server Machine
  • Memory Size: 1GB
  • CPU number: 1
  • CPU Threads: 1
  • CPU Model: Virtual CPU 6db7dc0e7704
  • Disk: NVMe SSD
Network
  • Traffic: 9.25 Gbits/sec
  • Latency: 0.324 ms
Cloud VM
  • Vultr High Frequency Compute 1GB VM