GetPageSpeed

The ondrej nginx PPA deprecated its module packages at NGINX 1.28. If your Debian or Ubuntu servers depend on Brotli, Lua, ModSecurity or any other load_module, migrate to the GetPageSpeed APT repository to keep 130+ maintained NGINX modules that survive every apt upgrade. Ondřej Surý’s PPA has been the default source of fresh NGINX on Ubuntu and Debian for years. That era is ending for anyone…

Managing SSL certificates with Certbot works, but it bolts a second moving part onto your web server. You install a separate client, schedule a renewal cron job or systemd timer, add a DNS plugin and its Python dependencies, and wire up a deploy hook so NGINX actually picks up the renewed certificate. Every one of those parts can drift, fail silently, and let a certificate expire at the worst…

Open your NGINX error log on any public server and you will see the same thing: a steady drip of 404s probing for /wp-login.php, /.env, /phpmyadmin, and a thousand other paths that do not exist on your site. A vulnerability scanner walking your tree is a wall of 404s. A bot rattling locked admin endpoints is a wall of 403s. A credential-stuffing run is a wall of failed logins. Legitimate visitors…

Your WordPress homepage takes 600 to 900 ms to build. Your API endpoint runs the same database query a thousand times a second. The pages barely change from one second to the next, yet every visitor pays the full backend cost. The usual answer is to put Varnish in front of NGINX: a second daemon, a second port, its own configuration language, its own process to babysit. You do not need it. NGINX…

If you want ChatGPT Search, GPTBot, and OpenAI’s on-demand fetcher to actually reach your content, the answer is not just “set Allow: / in robots.txt.” Modern NGINX deployments lean on rate limiting, GeoIP rules, and fail2ban; each of those will silently choke an OpenAI bot if you don’t deliberately whitelist OpenAI IP ranges in every layer. This guide walks through how to whitelist OpenAI IP…

The 10-requests-per-hour problem You want NGINX limit_req per hour: throttle a customer-facing API to 10 requests per hour per IP. Or you need to cap a free-tier endpoint at 1000 requests per day. Or you simply want a limit_req_zone that maps cleanly to a “200 per week” abuse rule from your security team. You write the obvious thing: limit_req_zone $binary_remote_addr zone=hourly:10m…

We rebuilt nginx-mod with Cloudflare’s 2015 nginx dynamic TLS records patch (ngx_http_tls_dyn_size) and benchmarked nginx dynamic TLS records inside a controlled rig: 200 cold HTTP/2 connections per condition, randomized interleave, CPU-pinned client and server, tc netem delay 50ms loss 1%. Under proper isolation the patch is mostly noise, defaults can hurt, and Cloudflare themselves stopped…

If you’ve tried to build aws-lc NGINX in the last two years and gave up because of header collisions, missing OCSP stapling, or general handwaving about “BoringSSL forks aren’t ready” – the situation has changed. NGINX upstream landed aws-lc support in 1.29.2, OCSP stapling stopped being a real production requirement, and the only remaining obstacle to a packaged NGINX-MOD-AWS-LC is one we can…

Every rolling restart slams cold backends at full weight, spiking p99 latency. The fix is nginx slow_start, a feature NGINX Plus has shipped since 2015 but open-source NGINX never wired up. NGINX-MOD implements it end-to-end, with measured ramp-ups that track the theoretical linear curve within 0.5%. You rolled a backend server back into production after a restart. Within seconds your dashboards…

Every time a browser revalidates /assets/app.a3f2c9.css with an If-None-Match request, your server burns CPU cycles just to reply “nothing changed.” Multiply that by every CSS, JS, font, and image file on a page, then by every return visitor, and the waste compounds fast. The cruel twist: the URL already contains a content hash, so the file was never going to change in the first place. The…

Getting NGINX HTTP/3 on Ubuntu to actually work is harder than the nginx docs make it look. You enable http3 on; in your NGINX config, restart, and Chrome still negotiates HTTP/2. Or worse: HTTP/3 appears to work, but connections silently die after every nginx -s reload. Both problems trace back to how stock Debian/Ubuntu nginx is built, and both are solved by a single APT package. Stock nginx…

You have a JSON endpoint on NGINX, and a browser on another origin needs to read it. CORS headers are the modern answer, but CORS does not always fit: the client may sit on a static CDN you do not own, a corporate proxy may strip your Access-Control-Allow-Origin header, or a third-party widget may embed your data on pages you cannot touch. In those cases, NGINX JSONP is still the only thing that…

You have an API that returns XML. Maybe a legacy SOAP service, maybe an RSS feed from a third-party vendor, maybe an internal system that was built a decade ago and nobody wants to touch. Whatever the source, the result is the same: your users see a wall of angle brackets instead of a readable web page. This is exactly the problem the NGINX XSLT module was designed to solve. The obvious fix is to…

Images account for over half of a typical webpage’s total weight. A single product page might serve dozens of JPEG and PNG files, each one bloated by decades-old encoding. Modern formats like WebP and AVIF offer 25-50% smaller file sizes at equivalent visual quality. Yet most sites still serve the old formats because NGINX automatic image conversion has traditionally been difficult to set up. The…

You want to serve WebP images from NGINX automatically. A visitor’s browser supports WebP, so you want NGINX to convert and serve the smaller format on-the-fly. You search for an NGINX module that does this, find ngx_webp, drop webp; into your location block, and it works. Images shrink by 25-60%. Problem solved. Then you deploy it to production. Under real traffic, your NGINX workers freeze.…

You need to add custom logic to your NGINX reverse proxy — an authentication check that calls an external API, a rate limiter that shares state across workers, or a request transformer that rewrites headers. The problem is that NGINX was not designed to be easily extensible. Your options have been painful: write a C module (complex, unsafe, requires recompilation) or use Lua scripting through…

Every web application faces a barrage of automated attacks. SQL injection probes, cross-site scripting payloads, credential stuffing bots, and volumetric HTTP floods arrive around the clock. While NGINX handles raw traffic efficiently, it has no built-in awareness of application-layer threats. The NGINX WAF module (ngx_waf) solves this by embedding a lightweight web application firewall directly…