Web Server Load Balancing with NGINX Plus

A recent article in CSO magazine states that nearly half of the top million websites “pose security risks”. The CSO article is referencing the State of the Web 2016 Report from Menlo Security.

To avoid these problems, we recommend three potential solutions: upgrade your NGINX software, use NGINX Amplify for configuration analysis, or move to NGINX Plus.

There are two major sources of risk cited in the article:

  • Third‑party content. Many reputable sites, for example, run ads from third‑party advertising networks. Users of the reputable site are exposed to any security breaches in the third‑party advertising network, and such breaches happen frequently.
  • Old software. More than 10% of the top million sites are running old software with known security vulnerabilities. The outdated software includes version 1.8 of the NGINX open source software.

If your site publishes third‑party content, you need to work with your publishing partners to solve any problems with the content they provide to you. If your site faces the problem of “old software”, or if you want to avoid this problem in the future, see the three recommended solutions below.

Update Your NGINX Software

In specific configurations, which are rarely used and not recommended by NGINX, Inc., open source version 1.8 has a specific security vulnerability. We urge NGINX users to update to the latest version at their earliest convenience. If you rely on the version of NGINX distributed by your OS vendor, you may be using a very outdated version of NGINX. For example, Debian 8+ (Jessie) comes with NGINX 1.6.2, which is over 2 years old.

We recommend that, instead, you install NGINX from our repositories with prebuilt binaries. These binaries are built for Red Hat, Ubuntu, and a variety of BSD‑based OSs.

You can choose from two branches of the software: stable and mainline. The mainline branch is where we actively develop new features, while the stable branch is only updated to fix bugs and address security vulnerabilities. Please see this blog post for details on our branching scheme.

Use NGINX Amplify

NGINX Amplify, now in public beta, includes configuration analysis. NGINX Amplify analyzes the NGINX version you have installed, notifies you of security vulnerabilities, and recommends an upgrade path.

"NGINX Amplify configuration report helps you manage software updates and security
NGINX Amplify notifies you of security vulnerabilities

The above screenshot shows an NGINX server running version 1.10.0, which is vulnerable to CVE‑2016‑4450. In this vulnerability, an attacker can cause a crash of an NGINX worker process. NGINX Amplify suggests an upgrade to either version 1.10.1+ or 1.11.1+, which have no known security vulnerabilities.

NGINX Amplify goes well beyond identifying NGINX software versions. With it, you can find a wide range of security issues in third‑party libraries and NGINX configuration. You can then repair each issue and re‑run NGINX Amplify to confirm that you’ve addressed it.

NGINX Amplify is in public beta and it is free to sign up. Try NGINX Amplify, including its configuration analysis feature, today to ensure your NGINX deployment is up to date and free of security vulnerabilities.

Upgrade to NGINX Plus

Users of NGINX Plus, the commercial version of the (open source) NGINX software, receive advanced security notifications and regular software updates. NGINX Plus has three features that make your website less vulnerable to security issues:

  1. Support, with access to NGINX, Inc. engineers. When you suspect a problem, you have expert help in diagnosing issues and preventing downtime.
  2. Management and monitoring capabilities. NGINX Plus includes a dashboard with real‑time monitoring and management capabilities, allowing you to respond effectively to attacks in real time.
  3. Access to an advanced WAF. NGINX Plus users can add on (at an additional cost) NGINX ModSecurity WAF, a supported dynamic module based on the industry‑leading open source ModSecurity web application firewall (WAF). The combination of protection and support gives you the ability to respond more effectively to attacks.

    [Editor – NGINX ModSecurity WAF officially went End-of-Sale as of April 1, 2022 and is transitioning to End-of-Life effective March 31, 2024. For more details, see F5 NGINX ModSecurity WAF Is Transitioning to End-of-Life on our blog.]

NGINX Plus has a dashboard for live monitoring and management of security and uptime
NGINX Plus includes live monitoring and management

In addition, NGINX Amplify has access to additional metrics when used with NGINX Plus, giving you more ways to protect yourself.

You can download a free trial of NGINX Plus or contact Sales today.

Hero image
Are Your Applications Secure?

Learn how to protect your apps with NGINX and NGINX Plus

About The Author

Faisal Memon

Software Engineer

About F5 NGINX

F5, Inc. is the company behind NGINX, the popular open source project. We offer a suite of technologies for developing and delivering modern applications. Together with F5, our combined solution bridges the gap between NetOps and DevOps, with multi-cloud application services that span from code to customer.

Learn more at or join the conversation by following @nginx on Twitter.