- OpenLiteSpeed V1.6.4
- nginx V1.17.7
- Apache V2.4.41
ModSecurity Benchmark
OpenLiteSpeed vs. nginx and Apache
ModSecurity impacts server performance, but how much? And does it vary from server to server? We tested ModSecurity implementations on OpenLiteSpeed, nginx, and Apache, to see how they compare when loading static content using the OWASP ruleset.
Across the board, OpenLiteSpeed leaves nginx and Apache in the dust, but it is especially impressive with static files. OpenLiteSpeed’s intelligent ModSecurity implementation bypasses ruleset processing for static files as appropriate, leading to significant performance gains.
The Results
Small Static HTML File Benchmark
OpenLiteSpeed performed 90X better than nginx and 94X better than Apache when loading HTML with WAF enabled, using OWASP rules.
OpenLiteSpeed + LSCache
94515.8 Requests Per Second
Nginx + FastCGI Cache
1046.6 Requests Per Second
Apache + W3 Total Cache
1010 Requests Per Second
h2load -n 100000 -c 100 -t 1 -T 5 -m 10 -H 'Accept-Encoding: gzip,deflate' https://benchmark.com/1kstatic.html
| SERVER | FINISHED IN SEC | REQUESTS/SEC | MB/SEC | FAILURES | HEADER COMPRESSION |
|---|---|---|---|---|---|
| OpenLiteSpeed | 1.06 | 94515.8 | 12.2 | 0 | 97.18% |
| nginx | 9.55 | 1046.6 | 0.23 | 0 | 35.52% |
| Apache | 9.9 | 1010 | 0.36 | 0 | 0% |
Small Static Image File Benchmark
OpenLiteSpeed performed 70X better than nginx and 71X better than Apache when loading an image with WAF enabled, using OWASP rules.
OpenLiteSpeed + LSCache
75492.3 Requests Per Second
Nginx + FastCGI Cache
1076.2 Requests Per Second
Apache + W3 Total Cache
1065.2 Requests Per Second
h2load -n 100000 -c 100 -t 1 -T 5 -m 10 -H 'Accept-Encoding: gzip,deflate' https://benchmark.com/1knogzip.jpg| SERVER | FINISHED IN SEC | REQUESTS/SEC | MB/SEC | FAILURES | HEADER COMPRESSION |
|---|---|---|---|---|---|
| OpenLiteSpeed | 1.32 | 75492.3 | 76.5 | 0 | 97.37% |
| nginx | 9.29 | 1076.2 | 1.18 | 0 | 38.55% |
| Apache | 9.39 | 1065.2 | 1.28 | 0 | 0% |
Try It Yourself
Feeling skeptical? It’s easy to verify these results! We followed the methodology laid out on http2benchmark.org, which means you could run the exact same tests in your own environment and see for yourself.
For the full details of our ModSecurity testing, including our goals and testing strategy, and additional benchmarks, please see ModSecurity Performance Comparison: Apache, nginx, LiteSpeed on the LiteSpeed blog.
Test Environment
Server Tested
Client Machine
- Memory Size: 1GB
- CPU number: 1
- CPU Threads: 1
- CPU Model: Virtual CPU 6db7dc0e7704
- Disk: NVMe SSD
Server Machine
- Memory Size: 1GB
- CPU number: 1
- CPU Threads: 1
- CPU Model: Virtual CPU 6db7dc0e7704
- Disk: NVMe SSD
Network
- Traffic: 9.25 Gbits/sec
- Latency: 0.324 ms
Cloud VM
- Vultr High Frequency Compute 1GB VM