GetPageSpeed

If you want ChatGPT Search, GPTBot, and OpenAI’s on-demand fetcher to actually reach your content, the answer is not just “set Allow: / in robots.txt.” Modern NGINX deployments lean on rate limiting, GeoIP rules, and fail2ban; each of those will silently choke an OpenAI bot if you don’t deliberately whitelist OpenAI IP ranges in every layer. This guide walks through how to whitelist OpenAI IP…

The 10-requests-per-hour problem You want NGINX limit_req per hour: throttle a customer-facing API to 10 requests per hour per IP. Or you need to cap a free-tier endpoint at 1000 requests per day. Or you simply want a limit_req_zone that maps cleanly to a “200 per week” abuse rule from your security team. You write the obvious thing: limit_req_zone $binary_remote_addr zone=hourly:10m…

We rebuilt nginx-mod with Cloudflare’s 2015 nginx dynamic TLS records patch (ngx_http_tls_dyn_size) and benchmarked nginx dynamic TLS records inside a controlled rig: 200 cold HTTP/2 connections per condition, randomized interleave, CPU-pinned client and server, tc netem delay 50ms loss 1%. Under proper isolation the patch is mostly noise, defaults can hurt, and Cloudflare themselves stopped…

If you’ve tried to build aws-lc NGINX in the last two years and gave up because of header collisions, missing OCSP stapling, or general handwaving about “BoringSSL forks aren’t ready” – the situation has changed. NGINX upstream landed aws-lc support in 1.29.2, OCSP stapling stopped being a real production requirement, and the only remaining obstacle to a packaged NGINX-MOD-AWS-LC is one we can…

Every rolling restart slams cold backends at full weight, spiking p99 latency. The fix is nginx slow_start, a feature NGINX Plus has shipped since 2015 but open-source NGINX never wired up. NGINX-MOD implements it end-to-end, with measured ramp-ups that track the theoretical linear curve within 0.5%. You rolled a backend server back into production after a restart. Within seconds your dashboards…

Every time a browser revalidates /assets/app.a3f2c9.css with an If-None-Match request, your server burns CPU cycles just to reply “nothing changed.” Multiply that by every CSS, JS, font, and image file on a page, then by every return visitor, and the waste compounds fast. The cruel twist: the URL already contains a content hash, so the file was never going to change in the first place. The…

Getting NGINX HTTP/3 on Ubuntu to actually work is harder than the nginx docs make it look. You enable http3 on; in your NGINX config, restart, and Chrome still negotiates HTTP/2. Or worse: HTTP/3 appears to work, but connections silently die after every nginx -s reload. Both problems trace back to how stock Debian/Ubuntu nginx is built, and both are solved by a single APT package. Stock nginx…

You have a JSON endpoint on NGINX, and a browser on another origin needs to read it. CORS headers are the modern answer, but CORS does not always fit: the client may sit on a static CDN you do not own, a corporate proxy may strip your Access-Control-Allow-Origin header, or a third-party widget may embed your data on pages you cannot touch. In those cases, NGINX JSONP is still the only thing that…

You have an API that returns XML. Maybe a legacy SOAP service, maybe an RSS feed from a third-party vendor, maybe an internal system that was built a decade ago and nobody wants to touch. Whatever the source, the result is the same: your users see a wall of angle brackets instead of a readable web page. This is exactly the problem the NGINX XSLT module was designed to solve. The obvious fix is to…

Images account for over half of a typical webpage’s total weight. A single product page might serve dozens of JPEG and PNG files, each one bloated by decades-old encoding. Modern formats like WebP and AVIF offer 25-50% smaller file sizes at equivalent visual quality. Yet most sites still serve the old formats because NGINX automatic image conversion has traditionally been difficult to set up. The…

You want to serve WebP images from NGINX automatically. A visitor’s browser supports WebP, so you want NGINX to convert and serve the smaller format on-the-fly. You search for an NGINX module that does this, find ngx_webp, drop webp; into your location block, and it works. Images shrink by 25-60%. Problem solved. Then you deploy it to production. Under real traffic, your NGINX workers freeze.…

You need to add custom logic to your NGINX reverse proxy — an authentication check that calls an external API, a rate limiter that shares state across workers, or a request transformer that rewrites headers. The problem is that NGINX was not designed to be easily extensible. Your options have been painful: write a C module (complex, unsafe, requires recompilation) or use Lua scripting through…

Every web application faces a barrage of automated attacks. SQL injection probes, cross-site scripting payloads, credential stuffing bots, and volumetric HTTP floods arrive around the clock. While NGINX handles raw traffic efficiently, it has no built-in awareness of application-layer threats. The NGINX WAF module (ngx_waf) solves this by embedding a lightweight web application firewall directly…

You need to compute a SHA-256 hash inside your NGINX config. Or compare two strings case-insensitively. Or check whether a client IP falls within a CIDR range. Standard NGINX cannot do any of this without a full scripting engine like Lua or njs. The NGINX var module changes that — adding over 70 built-in functions directly to the configuration language. With the NGINX var module…

In a microservices architecture or auto-scaling environment, backend servers come and go constantly. Containers spin up, health checks pull instances out of rotation, and new deployments replace old ones — sometimes dozens of times per hour. If your NGINX load balancer requires a configuration reload every time a backend changes, you introduce latency spikes, dropped connections, and operational…

You configure NGINX as a reverse proxy with upstream servers defined by domain names. The backend runs on Kubernetes, auto-scaling groups, or a cloud provider that rotates IPs. Everything works — until the DNS record changes. NGINX keeps sending traffic to the old IP address because it resolved that hostname once at startup and cached the result permanently. Requests fail. Users complain. You SSH…

You have three backend servers behind NGINX. One is a beefy 32-core machine, another is a modest 8-core VPS, and the third is a legacy box you keep around for redundancy. Round-robin sends them equal traffic regardless of how busy each server actually is. least_conn counts open connections but cannot tell whether a server is actively processing a complex request or just holding an idle keepalive…