GetPageSpeed @getpagespeed - Tumblr Blog

Whitelist OpenAI IP Ranges in NGINX and fail2ban

If you want ChatGPT Search, GPTBot, and OpenAI’s on-demand fetcher to actually reach your content, the answer is not just “set Allow: / in robots.txt.” Modern NGINX deployments lean on rate limiting, GeoIP rules, and fail2ban; each of those will silently choke an OpenAI bot if you don’t deliberately whitelist OpenAI IP ranges in every layer. This guide walks through how to whitelist OpenAI IP…

#bot management #chatgpt #fail2ban #nginx #openai #security

NGINX limit_req Per Hour, Day, Week, Month with NGINX-MOD

The 10-requests-per-hour problem You want NGINX limit_req per hour: throttle a customer-facing API to 10 requests per hour per IP. Or you need to cap a free-tier endpoint at 1000 requests per day. Or you simply want a limit_req_zone that maps cleanly to a “200 per week” abuse rule from your security team. You write the obvious thing: limit_req_zone $binary_remote_addr zone=hourly:10m…

#api-throttling #ddos protection #limit_req #nginx #nginx-mod #rate limiting #sre

NGINX Dynamic TLS Records: An Honest Benchmark in 2026

We rebuilt nginx-mod with Cloudflare’s 2015 nginx dynamic TLS records patch (ngx_http_tls_dyn_size) and benchmarked nginx dynamic TLS records inside a controlled rig: 200 cold HTTP/2 connections per condition, randomized interleave, CPU-pinned client and server, tc netem delay 50ms loss 1%. Under proper isolation the patch is mostly noise, defaults can hurt, and Cloudflare themselves stopped…

#http2 #nginx #nginx modules #nginx-mod #performance #SSL #tls

aws-lc NGINX in 2026: Why we still ship quictls

If you’ve tried to build aws-lc NGINX in the last two years and gave up because of header collisions, missing OCSP stapling, or general handwaving about “BoringSSL forks aren’t ready” – the situation has changed. NGINX upstream landed aws-lc support in 1.29.2, OCSP stapling stopped being a real production requirement, and the only remaining obstacle to a packaged NGINX-MOD-AWS-LC is one we can…

#aws-lc #boringssl #http3 #nginx #ocsp #quictls #tls

NGINX slow_start: Gradual Upstream Ramp-Up Without Plus

Every rolling restart slams cold backends at full weight, spiking p99 latency. The fix is nginx slow_start, a feature NGINX Plus has shipped since 2015 but open-source NGINX never wired up. NGINX-MOD implements it end-to-end, with measured ramp-ups that track the theoretical linear curve within 0.5%. You rolled a backend server back into production after a restart. Within seconds your dashboards…

#load balancing #nginx #nginx modules #nginx-mod #performance #slow_start #upstream

NGINX Immutable Module: Far-Future Cache-Control Headers

Every time a browser revalidates /assets/app.a3f2c9.css with an If-None-Match request, your server burns CPU cycles just to reply “nothing changed.” Multiply that by every CSS, JS, font, and image file on a page, then by every return visitor, and the waste compounds fast. The cruel twist: the URL already contains a content hash, so the file was never going to change in the first place. The…

#Cache-Control #Caching #headers #magento 2 #nginx #NGINX module #nginx modules #optimization #performance #static

How to Enable NGINX HTTP/3 on Ubuntu and Debian

Getting NGINX HTTP/3 on Ubuntu to actually work is harder than the nginx docs make it look. You enable http3 on; in your NGINX config, restart, and Chrome still negotiates HTTP/2. Or worse: HTTP/3 appears to work, but connections silently die after every nginx -s reload. Both problems trace back to how stock Debian/Ubuntu nginx is built, and both are solved by a single APT package. Stock nginx…

#debian #http3 #nginx #quic #tls #Ubuntu

NGINX JSONP: Safe Cross-Origin APIs with the XSS Module

You have a JSON endpoint on NGINX, and a browser on another origin needs to read it. CORS headers are the modern answer, but CORS does not always fit: the client may sit on a static CDN you do not own, a corporate proxy may strip your Access-Control-Allow-Origin header, or a third-party widget may embed your data on pages you cannot touch. In those cases, NGINX JSONP is still the only thing that…

#api #cross-origin #jsonp #nginx #NGINX module #security #xss

NGINX XSLT Module: Transform XML Responses into HTML

You have an API that returns XML. Maybe a legacy SOAP service, maybe an RSS feed from a third-party vendor, maybe an internal system that was built a decade ago and nobody wants to touch. Whatever the source, the result is the same: your users see a wall of angle brackets instead of a readable web page. This is exactly the problem the NGINX XSLT module was designed to solve. The obvious fix is to…

#nginx #NGINX module #nginx modules #nginx-mod #XML #XSLT

NGINX Automatic Image Conversion: WebP and AVIF

Images account for over half of a typical webpage’s total weight. A single product page might serve dozens of JPEG and PNG files, each one bloated by decades-old encoding. Modern formats like WebP and AVIF offer 25-50% smaller file sizes at equivalent visual quality. Yet most sites still serve the old formats because NGINX automatic image conversion has traditionally been difficult to set up. The…

#jpeg #nginx #NGINX module #nginx modules #nginx-mod #optimization #performance #webp

How Not to Write an NGINX Module: A WebP Case Study

You want to serve WebP images from NGINX automatically. A visitor’s browser supports WebP, so you want NGINX to convert and serve the smaller format on-the-fly. You search for an NGINX module that does this, find ngx_webp, drop webp; into your location block, and it works. Images shrink by 25-60%. Problem solved. Then you deploy it to production. Under real traffic, your NGINX workers freeze.…

#image optimization #nginx #NGINX module #nginx module development #nginx modules #performance #webp

NGINX WebAssembly: Extend NGINX with Proxy-Wasm Filters

You need to add custom logic to your NGINX reverse proxy — an authentication check that calls an external API, a rate limiter that shares state across workers, or a request transformer that rewrites headers. The problem is that NGINX was not designed to be easily extensible. Your options have been painful: write a C module (complex, unsafe, requires recompilation) or use Lua scripting through…

#API gateway #nginx #NGINX module #nginx modules #nginx-mod #performance #proxy-wasm #scripting #wasm #webassembly

NGINX WAF Module: Lightweight Web Application Firewall

Every web application faces a barrage of automated attacks. SQL injection probes, cross-site scripting payloads, credential stuffing bots, and volumetric HTTP floods arrive around the clock. While NGINX handles raw traffic efficiently, it has no built-in awareness of application-layer threats. The NGINX WAF module (ngx_waf) solves this by embedding a lightweight web application firewall directly…

#access-control #bot protection #firewall #nginx #NGINX module #nginx modules #rate limiting #security #waf

NGINX Var Module: Dynamic Variable Functions for Config

You need to compute a SHA-256 hash inside your NGINX config. Or compare two strings case-insensitively. Or check whether a client IP falls within a CIDR range. Standard NGINX cannot do any of this without a full scripting engine like Lua or njs. The NGINX var module changes that — adding over 70 built-in functions directly to the configuration language. With the NGINX var module…

#nginx #NGINX module #nginx modules #regex #scripting #security

NGINX Dynamic Upstream: Consul & etcd Upsync Guide

In a microservices architecture or auto-scaling environment, backend servers come and go constantly. Containers spin up, health checks pull instances out of rotation, and new deployments replace old ones — sometimes dozens of times per hour. If your NGINX load balancer requires a configuration reload every time a backend changes, you introduce latency spikes, dropped connections, and operational…

#almalinux #load balancing #nginx #NGINX module #nginx modules #performance #redhat #rocky linux #upstream

NGINX Upstream Jdomain: Dynamic DNS for Any NGINX Version

You configure NGINX as a reverse proxy with upstream servers defined by domain names. The backend runs on Kubernetes, auto-scaling groups, or a cloud provider that rotates IPs. Everything works — until the DNS record changes. NGINX keeps sending traffic to the old IP address because it resolved that hostname once at startup and cached the result permanently. Requests fail. Users complain. You SSH…

#dns #dynamic DNS #load balancing #nginx #NGINX module #nginx modules #nginx-mod #upstream

NGINX Fair Load Balancing Without NGINX Plus

You have three backend servers behind NGINX. One is a beefy 32-core machine, another is a modest 8-core VPS, and the third is a legacy box you keep around for redundancy. Round-robin sends them equal traffic regardless of how busy each server actually is. least_conn counts open connections but cannot tell whether a server is actively processing a complex request or just holding an idle keepalive…

#almalinux #load balancing #nginx #performance #rocky linux

Trending Blogs

Recently Viewed Blogs

GetPageSpeed