The reliable way to make NGINX faster is to measure the current bottleneck, change one configuration layer, and compare the result under representative traffic. Start by logging request time, status, bytes sent, connection reuse, and upstream timing. Then tune workers and file limits, static-file delivery, keep-alive and TLS reuse, compression, HTTP/2, and proxy or FastCGI caching in that order as your workload demands. There is no universal worker count, connection limit, gzip level, or cache policy: hardware, kernel, NGINX/OpenSSL versions, and application behavior determine the safe values.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What NGINX performance optimization actually means
Performance is not one number. A configuration can increase throughput while making tail latency worse, reduce bandwidth while consuming too much CPU, or improve origin efficiency while serving the wrong personalized response. Evaluate the dimensions that matter to your users and backend:
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Throughput: requests or bytes served per second at an acceptable error rate.
- Latency: median response time and tail percentiles, especially during concurrency spikes.
- Resource cost: CPU, memory, open file descriptors, and network bandwidth.
- Connection work: TLS handshake rate, connection reuse, and requests per connection.
- Origin pressure: upstream request rate, queueing, and cache hit ratio.
- Correctness: whether authentication, cookies, language, and other personalization remain isolated.
- Operational risk: configuration complexity, version compatibility, and ease of rollback.
Optimize the slowest measured layer first. Increasing worker_connections cannot fix a saturated database, and enabling compression cannot fix an overloaded upstream application.
Build a baseline before changing configuration
Record a before-and-after baseline so every change has an observable result. NGINX exposes variables that are useful for this comparison, including request_time, status, bytes_sent, connection, and connection_requests. For proxied applications, add upstream timing where available.
#1 Best Overall
Log the request and connection signals
A compact performance log can include the client address, request line, status, bytes, total request time, upstream response time, connection identifier, and requests served on that connection. Keep the format consistent between test runs so you can compare distributions rather than isolated requests.
log_format perf '$remote_addr $request $status $bytes_sent $request_time $upstream_response_time $connection $connection_requests';
access_log /var/log/nginx/access.log perf;Use the resulting data to answer concrete questions: Did the median and tail request_time change? Did status errors increase? Are clients reusing connections? Did bytes sent fall enough to justify additional CPU? Is upstream time, rather than NGINX processing, the dominant part of the request?
Capture host and application context
Record CPU and memory utilization, open-file usage, network throughput, upstream queueing, and application response time during the same traffic pattern. A single idle test can hide limits that appear only with concurrent clients, large responses, slow clients, or a full cache. Keep the test mix representative of static files, dynamic pages, APIs, authenticated requests, and cache misses that your site actually serves.
Change one layer at a time
- Save the working configuration and define a rollback copy.
- Validate syntax before reloading with
nginx -t. - Reload gracefully, then run the same representative traffic test.
- Compare latency percentiles, errors, bytes, CPU, connection reuse, upstream time, and cache behavior.
- Keep the change only if the desired metric improves without unacceptable regressions.
Size workers, connections, and file limits together
NGINX has a master process and worker processes; the workers perform request processing. worker_processes auto; is a sensible starting point on a multi-core host because NGINX can choose a count based on available CPUs. Pinning a fixed count can be appropriate when CPU isolation or container limits are deliberate, but do not assume that more workers always increase throughput.
Set worker processes from the host you actually run
Check the CPU quota visible inside a container or virtual machine, not only the physical server. Too many workers add scheduling and memory overhead; too few can leave cores idle. After changing the value, watch CPU utilization, run-queue pressure, and tail latency under load.
Match worker connections to concurrency
worker_connections limits simultaneous connections handled by each worker. The official example uses worker_connections 2000;, but that is an example rather than a universal target. Your required value depends on keep-alive behavior, long-lived connections, request mix, and whether each client connection also creates an upstream connection.
Multiply the per-worker setting by the number of workers only as an upper-bound estimate. The practical ceiling is lower when file descriptors are exhausted, and a proxied request may consume descriptors for both the client and upstream sides. Monitor actual concurrent connections and the worker connection limit before raising it.
Raise the open-file ceiling deliberately
The operating system’s soft and hard open-file limits can prevent NGINX from using the configured connection capacity. worker_rlimit_nofile can raise the limit available to workers, but it does not override a lower host or service-manager limit. Increase the host limit and the NGINX worker limit together, then verify the effective value after a reload. If errors mention too many open files, increasing worker_connections alone will not solve them.
worker_processes auto;
events {
worker_connections 2000;
}
http {
sendfile on;
tcp_nopush on;
}The sendfile, tcp_nopush, and connection values above are a starting example modeled on NGINX’s documented configuration. Test them with your kernel, storage path, response sizes, and proxy workload; a copied snippet is not a benchmark.
Improve static-file delivery and connection reuse
Evaluate sendfile and tcp_nopush with your storage path
sendfile on; can let the kernel transfer file data without unnecessary user-space copying. tcp_nopush on; can help assemble larger packets when sending file headers and data. Their effect depends on the operating system, filesystem, storage device, TLS termination path, and response size. Compare transfer rate, CPU use, and tail latency with both enabled and disabled rather than assuming one combination is best.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallKeep connections alive when reuse is beneficial
HTTP keep-alive lets a client send multiple requests over an existing connection, avoiding repeated TCP and TLS setup. It is especially valuable for pages that request many assets or APIs that receive bursts from the same client. Measure connection_requests to confirm reuse, and balance idle connection retention against memory and file-descriptor consumption when clients are numerous or very slow.
Reuse TLS sessions as well as TCP connections
For HTTPS, keep-alive reduces new handshakes, while SSL session reuse reduces the cost when a new handshake is unavoidable. NGINX recommends a shared SSL session cache so workers can reuse session parameters. Its documentation states that a 1 MB shared cache stores approximately 4,000 sessions. Treat that figure as an approximate capacity, not a promise for every build or session size, and monitor handshake rates after enabling the cache.
Reduce HTTPS overhead safely
Use supported TLS versions for your stack
Enable the current TLS versions supported by the installed NGINX and OpenSSL combination. NGINX’s examples use TLS 1.2 and TLS 1.3. Do not paste a protocol list from another server: directive availability, cipher behavior, and defaults change with NGINX and OpenSSL versions. Confirm negotiated protocols with representative clients and keep an explicit compatibility plan for older clients if your audience requires one.
Share session state across workers
A shared cache is preferable to relying only on a worker-local built-in cache because a resumed session can be handled by a different worker. Size the cache for observed session volume and expiration, then verify that full handshakes fall and resumed handshakes rise without authentication or compatibility errors.
Free tools Windows power users keep installed
One-click scans. No signup required.
Remember that TLS uses CPU
SSL operations consume extra CPU resources. If CPU becomes the bottleneck after enabling HTTPS, inspect handshake rate, protocol mix, certificate configuration, and keep-alive reuse before adding workers. A faster network path does not compensate for a CPU-bound handshake storm.
Use gzip selectively, not automatically
Compression trades bandwidth for CPU. It usually helps text responses over constrained links, but compressing data that is already compressed wastes CPU and may add latency. Select by MIME type and response size, then benchmark CPU and latency together.
Key gzip controls
gzip_typeslimits compression to chosen content types.gzip_min_lengthavoids spending CPU on tiny responses where headers and processing dominate.gzip_proxiedcontrols compression behavior for responses received from an upstream proxy.gzip_varyadds theVary: Accept-Encodingsignal needed by caches that store compressed and uncompressed variants.gzip_comp_levelaccepts levels 1 through 9. Higher levels generally require more CPU; the best point depends on your response mix.
gzip on;
gzip_vary on;
gzip_min_length 1000;
gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
# Select gzip_proxied and gzip_comp_level after measuring your proxy traffic and CPU budget.The MIME list and size in this example are illustrative; audit your own responses before adopting them. Exclude formats such as JPEG, PNG, most video, and compressed archives unless testing proves otherwise. When compressing HTTPS responses, account for the BREACH risk documented for NGINX’s gzip module: secrets reflected into compressed responses can leak information through size differences. Avoid compressing responses that combine attacker-controlled input with sensitive tokens, or redesign the response so the secret is not exposed to that side channel.
Enable HTTP/2 only after checking compatibility
HTTP/2 can multiplex several requests over one connection and compress headers, but it is not a guarantee that every latency metric will improve. NGINX needs the HTTP/2 module, and TLS connections need ALPN support in OpenSSL. Confirm both in the installed build and TLS stack before changing the listener.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
Use the directive syntax your NGINX version supports
NGINX releases have used different HTTP/2 configuration forms. Some attach HTTP/2 to the TLS listen directive; others use a separate HTTP/2 directive. Check the installed version’s documentation and run configuration validation before reloading. Do not combine syntax from different releases.
Test real multiplexing behavior
Measure connection counts, concurrent streams, header sizes, response ordering, and upstream behavior with representative browsers, API clients, and proxies. Check for stream-limit errors, oversized headers, and backends that serialize requests. Compare median and tail latency, bytes, CPU, and handshake rate against HTTP/1.1 under the same workload. Keep HTTP/2 only when it improves the outcomes that matter to your traffic.
Use proxy caching to protect the origin
A reverse-proxy cache can serve repeatable responses without contacting the application on every request. It improves origin efficiency and often response time, but only when the cache key, freshness rules, bypass conditions, and invalidation behavior match application correctness.
Build a deliberate proxy cache
Define a proxy_cache_path and named cache zone, enable it with proxy_cache, and choose a proxy_cache_key that distinguishes every representation that can legitimately differ. The scheme, host, normalized URI, query string, selected headers, and relevant cookies may all matter. Keep the key no broader than the application permits: omitting a language, device, authorization state, or content-negotiation input can serve one user’s response to another.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
proxy_cache_path /var/cache/nginx/proxy levels=1:2 keys_zone=app_cache:10m max_size=1g inactive=60m use_temp_path=off;
location / {
proxy_pass http://app_backend;
proxy_cache app_cache;
proxy_cache_key $scheme$host$request_uri;
proxy_cache_valid 200 10m;
proxy_cache_lock on;
}The path, zone size, maximum size, inactivity period, and validity time above are illustrative values, not universal recommendations. Size storage and freshness from observed object count, response size, update frequency, and acceptable staleness. A lock can prevent many simultaneous misses from stampeding the origin, but it may make waiting clients share the latency of the first fill.
Control freshness, revalidation, and failure behavior
Use proxy_cache_valid for status-specific lifetimes, revalidation where the origin supports validators, and stale serving only when your availability policy allows it. Stale responses can keep a site available during an upstream failure, but they must not hide security or content updates that require immediate invalidation. Define how deployments purge or version objects; a cache without an invalidation plan becomes a correctness problem.
Bypass personalized and authenticated responses
Do not cache responses that contain user-specific data, authorization results, private cookies, or one-time tokens unless the key and policy explicitly isolate them. Use bypass and no-cache rules based on request methods, authorization headers, session cookies, and upstream cache-control signals. Test logged-in and logged-out clients separately, including cache misses after login, logout, password changes, and permission changes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apply the same discipline to FastCGI caching
For PHP or other FastCGI applications, the parallel controls are fastcgi_cache_path, fastcgi_cache, fastcgi_cache_key, fastcgi_cache_valid, fastcgi_cache_lock, and fastcgi_cache_use_stale. The design questions are the same: which requests are public, what varies the representation, how long can it remain fresh, how is it invalidated, and what may be served during an application failure?
fastcgi_cache_path /var/cache/nginx/fastcgi levels=1:2 keys_zone=php_cache:10m max_size=1g inactive=30m use_temp_path=off;
location ~ .php$ {
include fastcgi_params;
fastcgi_pass php_backend;
fastcgi_cache php_cache;
fastcgi_cache_key $scheme$host$request_uri;
fastcgi_cache_valid 200 5m;
fastcgi_cache_lock on;
}Before enabling this pattern, exclude administrative paths, requests with authentication or session cookies, non-idempotent methods, and any response whose body depends on the current user. Verify cache status and response headers in tests; a fast response is not an optimization if it is the wrong response.
Rank #4
Tune upstream connections and load balancing from evidence
NGINX can reverse-proxy and load-balance across application servers. Add backends only when measurements show upstream saturation, queueing, or a single-server limit. More backend connections can increase contention when the application, database, or connection pool is already full.
Reuse upstream connections where supported
Keep upstream connection reuse aligned with application behavior and request concurrency. Reuse can avoid repeated TCP setup, but idle upstream connections consume descriptors and backend capacity. Observe active connections, queue time, upstream response time, and backend errors while adjusting reuse settings.
Match buffering to response behavior
Buffering can shield the upstream from slow clients and smooth response delivery, while streaming or very large responses may require a different policy. Choose buffer sizes and timeouts from measured response sizes and latency. Avoid copying a buffering snippet that was tuned for a different kernel, storage system, or application framework.
Recommended Free Tools
A safe optimization sequence
- Baseline: collect request time, status, bytes, connection reuse, upstream timing, CPU, memory, open files, and backend queueing.
- Capacity: set
worker_processesappropriately, sizeworker_connections, and raise host and worker file limits together. - Transport: test
sendfile,tcp_nopush, keep-alive, and shared TLS session caching. - Payload: enable gzip only for suitable MIME types and sizes, then choose a compression level from CPU and latency measurements.
- Protocol: verify HTTP/2 module and ALPN support, enable the version-correct syntax, and test multiplexing with real clients.
- Origin: add proxy or FastCGI caching only after defining keys, freshness, bypass, invalidation, and stale-response rules.
- Validation: check error rates, cache correctness, TLS negotiation, compression ratios, tail latency, and resource use after every change.
- Operations: retain the previous configuration, validate before reload, and repeat the tests after NGINX, OpenSSL, kernel, or application upgrades.
Troubleshoot common symptoms
Connections plateau below the configured limit
Check the effective worker count, per-worker connection limit, host and worker open-file limits, and whether upstream sockets consume additional descriptors. Inspect error logs for file exhaustion before increasing any directive.
CPU rises after enabling gzip or HTTPS
Separate handshake CPU from compression CPU using handshake counts, response types, and request timing. Increase keep-alive and session reuse where appropriate, restrict gzip to text and sufficiently large responses, and test a lower compression level. If CPU remains saturated, the bottleneck may be cryptographic work or the application rather than worker scheduling.
Cache hit ratio is low
Inspect cache status, key components, query-string variation, cookies, authorization headers, expiration, and invalidation events. A low hit ratio can be correct for personalized or rapidly changing traffic; do not weaken bypass rules merely to raise the percentage.
Users see another user’s content
Disable the affected cache immediately, identify the missing key or bypass condition, purge contaminated objects, and retest authenticated, anonymous, and cookie-bearing requests. Correctness takes priority over hit ratio or origin savings.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →HTTP/2 shows no improvement
Verify ALPN negotiation, stream limits, header sizes, client mix, and upstream serialization. Compare the same request distribution over HTTP/1.1 and HTTP/2; multiplexing cannot compensate for an origin queue or a slow database.
Compare configurations with the same scorecard
When deciding whether a change is worthwhile, compare the old and new configurations under the same traffic and hardware conditions:
| Measure | What an improvement looks like | What to watch for |
|---|---|---|
| Throughput | More successful requests or bytes per second | Error-rate increases or backend saturation |
| Median and tail latency | Lower response-time percentiles | Tail spikes hidden by a better median |
| CPU and memory | Lower cost for the same traffic | Higher CPU from TLS or gzip, or excess worker memory |
| TLS handshake rate | More resumed sessions and fewer full handshakes | Compatibility failures or cache exhaustion |
| Cache hit ratio | Fewer valid repeat requests reaching the origin | Incorrectly cached personalized responses |
| Backend request rate | Lower origin load for cacheable content | Stale data, failed invalidation, or miss stampedes |
| Connection reuse | Higher requests per connection where clients support it | Idle descriptors and memory held by slow clients |
| Operational complexity | Changes remain understandable and reversible | Version-specific directives and fragile exceptions |
Keep the configuration maintainable
Document why each non-default directive exists, which workload justified it, and what metric should trigger a review. Keep environment-specific values separate from shared snippets, test syntax in staging, and make rollback a single known-good configuration. Re-run the baseline after upgrades because NGINX, OpenSSL, kernel, and application changes can alter directive availability, defaults, protocol negotiation, and performance characteristics.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
