ModSecurity Benchmark

ModSecurity Benchmark

OpenLiteSpeed vs. nginx and Apache

ModSecurity impacts server performance, but how much? And does it vary from server to server? We tested ModSecurity implementations on OpenLiteSpeed, nginx, and Apache, to see how they compare when loading static content using the OWASP ruleset.

Across the board, OpenLiteSpeed leaves nginx and Apache in the dust, but it is especially impressive with static files. OpenLiteSpeed’s intelligent ModSecurity implementation bypasses ruleset processing for static files as appropriate, leading to significant performance gains.

The Results

Small Static HTML File Benchmark

OpenLiteSpeed performed 90X better than nginx and 94X better than Apache when loading HTML with WAF enabled, using OWASP rules.

h2load -n 100000 -c 100 -t 1 -T 5 -m 10 -H 'Accept-Encoding: gzip,deflate' https://benchmark.com/1kstatic.html

Small Static Image File Benchmark

OpenLiteSpeed performed 70X better than nginx and 71X better than Apache when loading an image with WAF enabled, using OWASP rules.

h2load -n 100000 -c 100 -t 1 -T 5 -m 10 -H 'Accept-Encoding: gzip,deflate' https://benchmark.com/1knogzip.jpg

Try It Yourself

Feeling skeptical? It’s easy to verify these results! We followed the methodology laid out on http2benchmark.org, which means you could run the exact same tests in your own environment and see for yourself.

For the full details of our ModSecurity testing, including our goals and testing strategy, and additional benchmarks, please see ModSecurity Performance Comparison: Apache, nginx, LiteSpeed on the LiteSpeed blog.