HAProxy

What HAProxy actually is

HAProxy is the load balancer other load balancers get measured against. It is free, open source software — GPLv2, written in C — that sits in front of your servers and spreads TCP and HTTP traffic across them. Willy Tarreau wrote it in 2000 and still maintains it; the first public release dates to December 2001, which makes this one of the longest-running pieces of infrastructure software in active use. In 2013 the commercial entity HAProxy Technologies was founded (headquartered in Newton, Massachusetts, with a large engineering presence in France) to sell enterprise add-ons, support and appliances around the project, but the core software remains free and community-driven.

The adoption record is the product's real marketing. GitHub, Reddit, Tumblr, Slack, Stack Overflow, GoDaddy, Bitbucket and Twitter have all run HAProxy in production, and it ships inside AWS OpsWorks. These are not paid logos on a slide; several of those companies have published engineering write-ups about their deployments. When a piece of software quietly fronts a meaningful share of the internet's traffic for two decades, we treat that as the strongest reliability evidence available short of our own testing.

What it does today is broader than the "TCP/HTTP load balancer" label suggests: Layer 4 and Layer 7 balancing, SSL/TLS termination, HTTP/2 and HTTP/3, WebSocket and gRPC support, URL rewriting, rate limiting, caching, gzip compression, health checks, connection draining, hitless reloads, Lua and SPOE scripting, a REST API, and stick-tables for statistics and denial-of-service mitigation. Configuration is a single text file, and that is both the product's signature and its main barrier to entry.

Pricing: what you really pay

For the community edition the answer is simple: nothing. HAProxy is free software. Download the source, install the distribution package, or run the official Docker images — there is no license key, no seat count, no connection metering, and no feature held back behind a paywall in the open-source branch. If you have a spare server and an engineer who can edit a config file, your cost is the server and the engineer.

The paid world starts where support does. HAProxy Technologies sells HAProxy Enterprise (an enhanced build with extra modules and backported features), the HAProxy Fusion control plane for managing multi-cluster deployments, HAProxy Edge (a global application delivery network with threat intelligence), and the ALOHA hardware appliance. Pricing for these is quote-based and not published; treat it as enterprise procurement rather than a price list. Award-winning 24/7/365 support from the engineers behind the project is part of the commercial offering.

Our practical read: the open-source edition is genuinely complete for the standard load-balancing use case, and the commercial layer is aimed at companies that need support contracts, centralized management or hardware. Budget-conscious teams lose nothing by starting community; regulated or very large estates should talk to the vendor about the enterprise line.

Performance & infrastructure

HAProxy's performance reputation is unusually well documented. The project's own performance notes — reproduced in its public documentation — put 6-to-8-core servers at roughly 200,000 to 500,000 HTTP requests per second, with no trouble saturating a 25 Gbit/s link under Linux, and 64-core ARM servers at around 2 million requests per second and 100 Gbit/s. The architecture is event-driven and multithreaded, memory use is famously lean, and hitless reloads mean configuration changes do not drop connections. Our own /benchmarks page covers the VPS hosts you might run it on; the proxy itself is rarely the bottleneck in a modern stack.

There is no datacenter to describe, because HAProxy is software you deploy — on a VM, a bare-metal box, a container, or at the edge. That makes every infrastructure spec on this page not applicable rather than unknown: you bring the compute, the network, the IPv6 support and the DDoS scrubbing. What the software contributes is the traffic layer: it binds the sockets, terminates TLS, enforces rate limits, tracks backends with health checks, and fails over between them.

The maturity of that layer is the story. Twenty-five years of production use means the sharp edges are documented, the failure modes are known, and the release discipline is visible: multiple supported LTS branches at any time (2.6, 2.8, 3.0, 3.2 and 3.4 LTS at the time of our review), each with a published end-of-life date. That kind of lifecycle transparency is better than most commercial vendors manage, and it is a large part of why platform teams trust the binary.

Where it falls short

Configuration is file-based and unforgiving. There is no bundled GUI in the community edition — the closest things are the built-in stats page and third-party tools like HATop — so teams without someone comfortable in a text config and on the command line will struggle. This is the single most common reason small teams choose a managed load balancer instead.

Advanced traffic management is powerful but hand-rolled. Features that a commercial ADC sells as checkboxes — sophisticated global load balancing, integrated WAF rule sets, bot management — exist here as scripting (Lua, SPOE) or as separate layers you assemble yourself. HAProxy Technologies sells these capabilities in the enterprise product, so the free edition is deliberately the data plane, not the whole security platform.

Support in the community edition means mailing lists, Slack, Discourse and GitHub issues. There is no SLA, no guaranteed response time, and no vendor standing behind your deployment — which is the honest trade for free software. If a load balancer outage costs you real money per minute, buy the support contract or choose a managed service with a published credit schedule.

Finally, it is a Linux-first tool. It runs on FreeBSD, OpenBSD, macOS and others, but the ecosystem, packages and performance tuning assume Linux. Windows shops should look at /category/load-balancers for alternatives.

Operationally, a few sharp edges are worth knowing before you commit. TLS certificate rotation is a file-and-reload chore unless you build automation around it; there is no built-in ACME client. Observability is strong but textual — the stats endpoint, the log lines and the UNIX socket give you everything, and nothing is pre-assembled into dashboards. And while hitless reloads are excellent, a syntactically valid but semantically wrong config will reload just fine and misroute traffic, so staging config changes matters more here than with tools that validate intent against a schema.

Against the obvious alternative, Nginx, our view is that HAProxy wins on pure load-balancing depth — health checks, connection handling, stick-tables and the protocol awareness baked into its request logic — while Nginx wins as a combined web server and reverse proxy. Envoy is the other reference point: richer dynamic configuration and observability out of the box, in exchange for a heavier operational surface. HAProxy sits between them: more load-balancing substance than Nginx, less machinery than Envoy.

Who should pick this

Our pick for anyone running their own infrastructure who needs a proven traffic layer: high-traffic web applications, API gateways on a budget, TCP services (databases, game protocols, SMTP) needing health-checked failover, and Kubernetes ingress where a dedicated proxy beats a general-purpose one. If your team already writes config files and runs Ansible, HAProxy is the default answer and anything else needs a reason.

It is also the right call when reliability matters more than convenience: the software is boring in the way infrastructure should be boring, and the LTS policy lets you pin a version for years.

Skip it if nobody on the team wants to own a proxy layer, if you need a managed control plane out of the box, or if your requirements are mostly WAF and bot management — those are the enterprise product's strengths, not the community edition's. For a managed alternative with an SLA, compare cloud load balancers in our /category/load-balancers roundup.

Key takeaways

• Free, open source (GPLv2) since 2001, still maintained by original author Willy Tarreau.
• Layer 4/7 balancing with TLS termination, HTTP/2 and HTTP/3, gRPC, rate limiting, caching, Lua scripting and a REST API.
• Documented performance in the hundreds of thousands of requests per second on modest hardware; 2M rps demonstrated on 64-core ARM.
• Used in production at GitHub, Reddit, Slack, Tumblr and many others — a track record few rivals match.
• No GUI, no included support and no SLA in the community edition; enterprise features and 24/7 support are paid, quote-only.
• Best fit: teams that run their own infrastructure and want the most proven open-source traffic layer available.

Sources

• https://www.haproxy.org/
• https://en.wikipedia.org/wiki/HAProxy
• https://www.haproxy.com/
• https://www.linkedin.com/company/haproxy-technologies