LiteSpeed 5 vs Apache 2.4 vs NGINX

[innovot]

Hello all,

We keep bouncing in and out of LSWS mainly due to the level of modsecurity support, but now its seems LSWS has come on leaps and bounds. We only offer hosting for WordPress now and would welcome peoples experience of LSWS with that. We have been evaluating Apache 2.4, which works well but high memory, plus NGINX with HHVM but that is not so good when somebody requires an ionencoded module. Should add that all our instances are based on OpenVZ guests and connected to MariaDB via MaxScale plus ModSec and commercial rules from Atomicorp.

Would welcome peoples thoughts please ?

Regards,

 

[Pong]

Thanks Innovot initiating this discussion and experience sharing thread. Eager to see everyone's experience.

Meanwhile I just would like to add 2 cents from my experience.
1. LiteSpeed has quite a few new builds and releases recently and make a lot changes to make mod_security rules work even better. Please upgrade to the latest version and test it.
2. LiteSpeed received some bug reports on mod_security rules sometimes and we always take a quick response case by case for further investigation of detailed rules and make them compatible with pretty fast turn around time.
3. LiteSpeed is the only web server which support HTTP/2 and ready to deploy to production while Nginx may be next year according to their own blog. Apache either. http://www.litespeedtech.com/http2-ready
4. We run quite a few benchmarks on HHVM, PHP7 , PHP56 vs Apache 2.4 vs Nginx 1.8.0, LiteSpeed preforms very well on each category comparing to other web servers. We will publish those reports as soon as they are available.
5. The last but not least, We planned and are about to initiate Wordpress Full Page Cache project very soon like our LiteMage for Magento. Another big WoW is coming ...

Like to see your experiences, thoughts or comments as well.

 

[innovot]

More Googling and reading reviews but still yet to see a tangible reason to move towards LiteSpeed which is a really shame. I do appreciate your response Pong, but 1-2, are mute if its not fully compatible. I recall a wiki page which shows what shall not work ? 3, is great if serving from HTTPS I presume ? 5, well without a clear roadmap it does not mean a great deal. Overall am trying to justify to ones self why to spend money on licensing when OSS does appear to perform better. Thoughts please ?

 

[mistwang]

when OSS does appear to perform better

Would be very interested in that information, that will be certainly on top of our to-do list to improve our product if it is really true.

 

[innovot]

Hello mistwang:

Certainly going to run some tests and would be very keen to see your own benchmarks once the reports are available.

With respect to mod_security (https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:mod_security-compatibility) are you planning on addressing LUA support ?

Perhaps with respect to the above it may be worthwhile integrating libmodsecurity for full support https://github.com/SpiderLabs/ModSecurity/tree/libmodsecurity as an option ?

Regards,

 

[mistwang]

Thanks for the suggestion.
We have experiences with embedding LUA engine with openlitespeed, there should not be any technical difficulty with adding LUA support. Just a matter of priority and time allocation. Yes, it will be added, but I am not sure when, it is not the top priority. We add adding @inspectFile now.

libmodsecurity looks interesting, it could be the solution for openlitespeed, unless it can beat our optimized modsecurity engine, our commercial product is more likely stay with our own.