Server Tuning
Table of Contents
RAM Disk Path | Default SHM Directory | Bind IPv6 Only | Reverse DNS Lookup | Verify Google Bot | Secure Cookie Control
Max Connections | Max SSL Connections | Connection Timeout (secs) | Max Keep-Alive Requests | Keep-Alive Timeout (secs) | Send Buffer Size (bytes) | Receive Buffer Size (bytes)
Max Request URL Length (bytes) | Max Request Header Size (bytes) | Max Request Body Size (bytes) | Max Response Header Size (bytes) | Max Response Body Size (bytes)
Enable Compression | Compressible Types | GZIP Compression Level | Brotli Compression Level
Default Cipher Suite | SSL Strong DH Key | Enable Multiple SSL Certificates | Enable Session Cache | Session Cache Size (bytes) | Session Cache Timeout (secs) | Enable Session Tickets | SSL Session Ticket Lifetime (secs) | SSL Session Ticket Key File | OCSP Proxy | Strict SNI Certificate
SSL Dynamic Certificates Cipher Suite | SSL Dynamic Certificates Base Dir | SSL Dynamic Certificates Levels | SSL Dynamic Certificates Expire Time (secs) | SSL Dynamic Certificates Refresh Time (secs)
Enable HTTP3/QUIC | QUIC SHM Directory | HTTP3/QUIC Versions | Congestion Control | Connection Flow Control Window | Max Connection Flow Control Window | Stream Flow Control Window | Max Stream Flow Control Window | HTTP/3 Initial Incoming Streams | Max Concurrent Streams Per Connection | Handshake Timeout | Idle Timeout | QUIC DoS Mitigation Duration (secs) | Bad Packet Rate | New Handshake Rate | Timed Out Handshake Rate | Enable DPLPMTUD | PLPMTU Base Value | PLPMTU Max Value
RAM Disk Path⇑
Description
Setting the RAM Disk Path allows you to designate the location of a RAM disk. A RAM disk is a world-writable directory stored in memory. A server with excess RAM can reduce disk I/O by serving content from this RAM disk. Accessing content from RAM is much faster than reading data from the disk. LSWS will use this RAM disk to optimize performance when there is enough memory available.
(The RAM disk must be designated in your OS setup before it can be used by the web server. Many Linux distributions assign /dev/shm as a RAM disk by default, but these settings depend on your OS.)
Syntax
path
Default SHM Directory⇑
Description
Changes shared memory's default directory to the specified path. If the directory does not exist, it will be created. All SHM data will be stored in this directory unless otherwise specified.
Syntax
path
Bind IPv6 Only⇑
Description
Only bind IPv6 for IPv6 wildcard IP addresses. When set to "Yes", IPv4 IP addresses will not be bound and will need their own listeners.
Default value: Yes
Syntax
Select from radio box
Reverse DNS Lookup⇑
Description
Perform an IP -> Domain Name lookup for each client. This can be used in access logging.
Default value: No
Syntax
Select from radio box
Verify Google Bot⇑
Description
Perform a PTR lookup to ensure that the reverse DNS of an IP matches Google's crawler information and bypass reCAPTCHA verification if so. Bad Google bot IPs are logged.
Default value: No
Syntax
Select from radio box
Secure Cookie Control⇑
Description
Control whether to send cookies with the flag "secure", attribute "SameSite=Strict", and attribute "SameSite=Lax".
If both "SameSite=Strict" and "SameSite=Lax" are selected, "SameSite=Strict" will be used.
Default value: "secure"
Syntax
Select from checkbox
Max Connections⇑
Description
Specifies the maximum number of concurrent connections that the server can accept. This includes both plain TCP connections and SSL connections. Once the maximum concurrent connections limit is reached, the server will close Keep-Alive connections when they complete active requests.
Syntax
Integer number
Tips
When the server is started by "root" user, the server will try to adjust the per-process file descriptor limits automatically, however, if this fails, you may need to increase this limit manually.
Max SSL Connections⇑
Description
Specifies the maximum number of concurrent SSL connections the server will accept. Since total concurrent SSL and non-SSL connections cannot exceed the limit specified by Max Connections, the actual number of concurrent SSL connections allowed must be lower than this limit.
Syntax
Integer number
Connection Timeout (secs)⇑
Description
Specifies the maximum connection idle time allowed during processing one request. The connection will be closed if it has been idle, i.e. no I/O activity, for this period of time.
Syntax
Integer number
Tips
Set this as low as you can to help recover dead connections during a potential DoS attack.
See Also
Max Keep-Alive Requests⇑
Description
Specifies the maximum number of requests that can be served through a keep-alive (persistent) session. The connection will be closed once this limit is reached. You can set this limit for each virtual host as well.
Syntax
Integer number
Tips
Set this to a reasonably high value. A value of "1" or "0" will disable keep-alive.
See Also
Virtual Host Max Keep-Alive Requests
Keep-Alive Timeout (secs)⇑
Description
Specifies the maximum idle time between requests from a keep-alive connection. If no new request is received during this period of time, the connection will be closed. This setting only applies to HTTP/1.1 connections. HTTP/2 connections have long keep-alive timeouts by design and are not affected by this setting.
Syntax
Integer number
Tips
We recommend that you set this value just long enough to wait for subsequent requests from a client when there are more assets referenced by a single page that need to be loaded. Do not set this too long hoping that the next page will be served over the keep-alive connection. Keeping many idle keep-alive connections is a waste of server resources and could be taken advantage of by (D)DoS attacks. 2-5 seconds is a reasonable range for most applications. LiteSpeed is highly efficient in a non-keep-alive environment.
Send Buffer Size (bytes)⇑
Description
The sending buffer size of each TCP socket. 512K is the maximum allowed buffer size.
Syntax
Integer number
Tips
It is recommended to leave this value as "Not Set" or set to 0 to use the operating system's default buffer size.
If your web site serves large static files, increase the send buffer size to improve performance.
Setting this to a lower value will reduce throughput and memory usage per socket allowing the server to have more concurrent sockets when memory is a bottleneck.
Receive Buffer Size (bytes)⇑
Description
The receiving buffer size of each TCP socket. 512K is the maximum allowed buffer size.
Syntax
Integer number
Tips
It is recommended to leave this value as "Not Set" or set to 0 to use the operating system's default buffer size.
A large receive buffer will increase performance when processing incoming requests with large payloads, i.e. file uploads.
Setting this to a lower value will reduce throughput and memory usage per socket allowing the server to have more concurrent sockets when memory is a bottleneck.
Max Request URL Length (bytes)⇑
Description
Specifies the maximum size of a request URL. URL is the full text address used to access a server resource including the query string. Hard limit is 65530 bytes. Values larger than this, such as 64K (6 bytes larger), will be treated as if 65530 was used.
Default value: 8192 or 8K.
Syntax
Integer number
Tips
Set it reasonably low to reduce memory usage and help identify bogus requests and DoS attacks.
2-3K is big enough for most web sites unless the HTTP GET method is used with large query strings instead of POST.
Max Request Header Size (bytes)⇑
Description
Specifies the maximum size of an HTTP request header including request URL. Hard limit is 65530 bytes. Values larger than this, such as 64K (6 bytes larger), will be treated as if 65530 was used.
Default value: 32768 or 32K
Syntax
Integer number
Tips
Set it reasonably low to reduce memory usage and help identify bogus requests and DoS attacks.
4-8K is big enough for most web sites under normal circumstances.
Max Request Body Size (bytes)⇑
Description
Specifies the maximum size of an HTTP request body. For a 32Bit OS, 2GB is the hard limit. For a 64Bit OS, it is virtually unlimited.
Syntax
Integer number
Tips
To help prevent DoS attacks, try to constrain this limit to only what is really needed. Your swapping space must have enough free space to accommodate this limit.
Max Response Header Size (bytes)⇑
Description
Specifies the maximum header size of a dynamically generated response. Static assets from a backend server are considered a dynamic response. Hard limit is 65530 bytes. Values larger than this, such as 64K (6 bytes larger), will be treated as if 65530 was used.
Default value: 32768 or 32K
Syntax
Integer number
Tips
Set it reasonably low to help recognize bad responses dynamically generated by external applications.
Max Response Body Size (bytes)⇑
Description
Specifies the maximum body size of a dynamically generated response. Static assets from a backend server are considered a dynamic response.
Syntax
Integer number
Tips
Set the limit reasonably low to help identify bad responses. It is not uncommon to malformed scripts to contain an infinite loop which leads to infinity-sized responses.
Enable Compression⇑
Description
Enables GZIP/Brotli compression.
Default value: Yes
Syntax
Select from radio box
Tips
Enable to save network bandwidth. On average, responses can be compressed down to half of their original size.
Compressible Types⇑
Description
Specifies what MIME types are allowed to be compressed. Leave this setting unset or enter default to use the server built-in default list which should already cover most mime-types.
Default value: text/*,application/x-javascript,application/javascript,application/xml,image/svg+xml,application/rss+xml, application/json,application/vnd.ms-fontobject,application/x-font,application/x-font-opentype, application/x-font-truetype,application/x-font-ttf,font/eot,font/opentype,font/otf,font/ttf,image/x-icon, image/vnd.microsoft.icon,application/xhtml+xml
Syntax
MIME type list separated by commas. Wild card "*" and negate sign "!" are allowed, such as text/*, !text/js.
Example
Tips
Only allow types that will benefit from GZIP/Brotli compression. Binary files such as gif/png/jpeg images and flash files do not benefit from compression.
GZIP Compression Level⇑
Description
Specifies the level of GZIP compression applied. Ranges from 1 (lowest) to 9 (highest).
This setting will only take effect when Enable Compression is enabled.
Default value: 6
Syntax
Number between 1 and 9.
Tips
Higher compression level will use more memory and CPU cycles. You can set it to a higher level if your machine has additional power. There is not much difference between 6 and 9, except that 9 uses many more CPU cycles.
Brotli Compression Level⇑
Description
Controls the level of Brotli compression applied. Ranges from 0 (OFF) to 6 (highest).
This setting will only take effect when Enable Compression is enabled.
Default value: 2
Syntax
Number between 0 and 6.
Default Cipher Suite⇑
Description
Default cipher suite for SSL certificates.
Default value: Server Internal Default (Based on current best practices)
Syntax
Colon-separated string of cipher specifications.
SSL Strong DH Key⇑
Description
Specifies whether to use 2048 or 1024 bit DH keys for SSL handshakes. If set to "Yes", 2048 bit DH keys will be used for 2048 bit SSL keys and certificates. 1024 bit DH keys will still be used in other situations. Default is "Yes".
Earlier versions of Java do not support DH key size higher than 1024 bits. If Java client compatibility is required, this should be set to "No".
Syntax
radio
Enable Multiple SSL Certificates⇑
Description
Allows listeners/vhosts to set multiple SSL certificates. If multiple certificates are enabled, the certificates/keys are expected to follow a naming scheme. If the cert is named server.crt, other possible cert names are server.crt.rsa, server.crt.dsa, server.crt.ecc. If "Not Set", defaults to "No".
Syntax
Select from radio box
Enable Session Cache⇑
Description
Enables session id caching using OpenSSL's default setting. Default value is "No".
Syntax
Select from radio box
Session Cache Size (bytes)⇑
Description
Sets the maximum number of SSL session IDs to store in the cache. Default is 1,000,000.
Syntax
Integer number
Session Cache Timeout (secs)⇑
Description
This value determines how long a session ID will be valid within the cache before renegotiation is required. Default is 3,600.
Syntax
Integer number
Enable Session Tickets⇑
Description
Enables session tickets using OpenSSL's default session ticket setting. Server-level setting must be set to "Yes" for Virtual Host setting to take effect.
Default values:
Server-level: Yes
VH-Level: Yes
Syntax
Select from radio box
SSL Session Ticket Lifetime (secs)⇑
Description
This value determines how long a session ticket will be valid before a renegotiation is required. Default is 3,600.
Syntax
Integer number
SSL Session Ticket Key File⇑
Description
Allows the SSL Ticket Key to be created/maintained by an administrator. The file must be 48 bytes long. If this option is left empty, the load balancer will generate and rotate its own set of keys.
IMPORTANT: To maintain forward secrecy, it is strongly recommended to change the key every SSL Session Ticket Lifetime seconds. If this cannot be done, it is recommended to leave this field empty.
Syntax
Path
OCSP Proxy⇑
Description
Socket address used as the proxy server address for OCSP verification. Leave this setting unset If not using a proxy.
Default value: not set
Syntax
Socket Address
Strict SNI Certificate⇑
Description
Specifies whether to strictly require a dedicated virtual host certificate configuration. When enabled, SSL connections to virtual hosts without a dedicated certificate configuration will fail instead of using a default catch-all certificate.
Default value: No
Syntax
Select from radio box
SSL Dynamic SNI⇑
Description
SSL Dynamic SNI enables you to avoid using the load balancer's generic certificates by specifying a directory that the load balancer can then use to serve clients site specific certificates when handling requests.
SSL Dynamic Certificates Cipher Suite⇑
Description
Specifies a custom cipher suite for the Dynamic SNI certificates.
Default value: Use server default ciphers
Syntax
Colon-separated string of cipher specifications.
SSL Dynamic Certificates Base Dir⇑
Description
Sets the base directory that dynamic ssl certificates will be stored in. Certificates, keys, and CA Bundles are expected to be named "cert", "key", and "ca", respectively.
Syntax
Path
Example
SSL Dynamic Certificates Levels⇑
Description
The number of directory levels the certificate files will be in.
This is similar to PHP's Session.save_path
Syntax
Integer number
Example
SSL Dynamic Certificates Expire Time (secs)⇑
Description
Sets the expire time of a dynamically loaded certificate before it is invalidated.
Syntax
Integer number
SSL Dynamic Certificates Refresh Time (secs)⇑
Description
Sets the refresh time of a dynamically loaded certificate before it will check for file validity. If the file is removed before refresh time, the cert will be invalidated. If the file is updated before refresh time, the cert will be updated.
Syntax
Integer number
Enable HTTP3/QUIC⇑
Description
Enables the HTTP3/QUIC network protocol server wide. Default value is Yes.
Syntax
Select from radio box
Tips
When this setting is set to Yes, HTTP3/QUIC can still be disabled at the listener level through the Open HTTP3/QUIC (UDP) port setting, or at the virtual host level through the Enable HTTP3/QUIC setting.
QUIC SHM Directory⇑
Description
Specifies the directory used to save QUIC data to shared memory.
By default, the server's default SHM directory, /dev/shm, will be used.
Syntax
Path
Tips
A RAM based partition, such as /dev/shm, is recommended.
HTTP3/QUIC Versions⇑
Description
A list of enabled HTTP3/QUIC versions. This setting should only be used to limit HTTP3/QUIC support to the versions listed and is best left blank.
Syntax
Comma-separated list
Example
Tips
It is recommended to leave this setting blank to have the the best configuration applied automatically.
Congestion Control⇑
Description
The congestion control algorithm used. This can be set manually or left up to the QUIC library in use by selecting the "Default" option.
Default value: Default
Syntax
Select from drop down list
Connection Flow Control Window⇑
Description
The initial size of the buffer allocated for a QUIC connection. Default value is 1.5M.
Syntax
Number between 64K and 512M
Tips
A larger window size will use more memory.
Max Connection Flow Control Window⇑
Description
Specifies the maximum size that a connection flow control window buffer is allowed to reach due to window auto-tuning.
Default value is 0, which means that the value of Connection Flow Control Window is used and no auto-tuning is performed.
Syntax
0 or a number between 64K and 512M
Tips
A larger window size will use more memory.
Stream Flow Control Window⇑
Description
The initial amount of data a QUIC connection is willing to receive per stream. Default value is 1M.
Syntax
Number between 64K and 128M
Tips
A larger window size will use more memory.
Max Stream Flow Control Window⇑
Description
Specifies the maximum size that a stream flow control window is allowed to reach due to window auto-tuning.
Default value is 0, which means that the value of Stream Flow Control Window is used and no auto-tuning is performed.
Syntax
0 or a number between 64K and 128M
Tips
A larger window size will use more memory.
HTTP/3 Initial Incoming Streams⇑
Description
The maximum number of incoming concurrent QUIC/H3 streams.
Default value: 100
Syntax
integer number between 10 and 1000.
Tips
This setting can be increased to help in situations where there are an abnormally large number of concurrent streams, such as inactive concurrent streams not closing when finished.
Max Concurrent Streams Per Connection⇑
Description
The maximum number of concurrent streams allowed per QUIC connection. Default value is 100.
Syntax
Integer number between 10 and 1000
Handshake Timeout⇑
Description
The time in seconds a new QUIC connection is given to complete its handshake, after which the connection is aborted. Default value is 10.
Syntax
Integer number between 1 and 15
Idle Timeout⇑
Description
The time in seconds after which an idle QUIC connection will be closed. Default value is 30.
Syntax
Integer number between 10 and 30
QUIC DoS Mitigation Duration (secs)⇑
Description
How long, once triggered, the server will stay in DoS mitigation mode. After this many seconds have passed, the server will revert to it's normal mode. Set this to 0 to disable DoS Mitigation mode.
In DoS Mitigation mode, new clients are required to verify their IP address with a special 'retry' packet. Once verified, the requests proceed as normal.
Default value: 120
Syntax
Integer number between 0 and 86400
Bad Packet Rate⇑
Description
The number of bad packets X needed in an interval of Y seconds to trigger QUIC DoS Mitigation. Supplying a value of 0 for either X or Y will disable this feature.
Default value: 4000/4
Syntax
X/Y where X is the number of events, Y is the interval in seconds (0 - 30)
New Handshake Rate⇑
Description
The number of new handshakes X needed in an interval of Y seconds to trigger QUIC DoS Mitigation. Supplying a value of 0 for either X or Y will disable this feature.
Default value: 90/3
Syntax
X/Y where X is the number of events, Y is the interval in seconds (0 - 30)
Timed Out Handshake Rate⇑
Description
The number of handshake timeouts X needed in an interval of Y seconds to trigger QUIC DoS Mitigation. Supplying a value of 0 for either X or Y will disable this feature.
Default value: 40/4
Syntax
X/Y where X is the number of events, Y is the interval in seconds (0 - 30)
Enable DPLPMTUD⇑
Description
Enable Datagram Packetization Layer Path Maximum Transmission Unit Discovery (DPLPMTUD).
Background on DPLPMTUD (RFC 8899)
Default value: Yes
Syntax
Select from radio box
PLPMTU Base Value⇑
Description
The maximum value of PLPMTU (maximum packet size without headers) in bytes that QUIC will use by default. Setting this to 0 will allow QUIC to pick the size.
This setting should be set lower than PLPMTU Max Value.
Default value: 0
Syntax
0 or integer number between 1200 and 65527
PLPMTU Max Value⇑
Description
The PLPMTU (maximum packet size without headers) probe upper limit in bytes. This setting is used to limit the "maximum packet size" in the DPLPMTUD search space. Setting this to 0 will allow QUIC to pick the size (By default LSQUIC assumes that MTU is 1,500 bytes (Ethernet)).
This setting should be set higher than PLPMTU Base Value.
Default value: 0
Syntax
0 or integer number between 1200 and 65527