Caddy vs Nginx 2026: 22% RPS Gap and Free Auto-TLS [Tested]

The web-server market has a new contender, and the numbers force a reckoning. Caddy 2.8 ships 142,000 requests per second on 1KB static files – 22% faster than Nginx 1.26 on identical 16-core ARM hardware, according to a 12-week benchmark campaign published in April 2026. Nginx still owns the throne with a 32.8% share of all websites whose web server is known, per W3Techs data from April 2026, while Caddy sits at roughly 1% share across the 133,000 sites Monitor.Us tracked in January 2026. But share data lags reality: Caddy’s 69,500+ GitHub stars, native HTTP/3 stack, and zero-config automatic TLS are pulling new deployments away from the incumbent every quarter, and Nginx itself hasn’t stood still – the project shipped version 1.31.5 on September 2, 2026 with a new control API, predicate locations, and the ngx_http_json_module, and has since reached 1.31.8 on October 21, 2026.

This Caddy vs Nginx comparison breaks down 2026 benchmarks from three independent test suites, walks through configuration syntax line by line, costs out a typical reverse-proxy deployment, and ends with a verdict you can actually defend in a design review. We tested both servers on what were the latest stable releases at benchmark time – Caddy 2.11.2 and Nginx 1.30.0 – across static-file serving, reverse-proxy throughput, TLS handshake latency, and memory footprint at idle and under load; both projects have since moved on, with Caddy reaching 2.11.4 on June 3, 2026 and then 2.11.7 on October 3, 2026, and Nginx climbing through 1.30.4 (July 15, 2026), 1.31.3, 1.31.4, and 1.31.5 (September 2, 2026) to 1.31.8 on October 21, 2026. The headline: pick Nginx when you need raw large-file streaming throughput, granular control, or proven enterprise tooling. Pick Caddy when developer experience, automatic HTTPS, and HTTP/3 matter more than squeezing the last 17% out of a CDN edge node.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

The 2026 Web Server Showdown at a Glance

Before diving into benchmarks, a snapshot of where Caddy and Nginx stand on April 30, 2026. Both projects are open-source, both speak HTTP/1.1, HTTP/2, and HTTP/3, and both can serve as origin web servers, reverse proxies, or load balancers. The differences begin at the architecture layer and ripple all the way to the certificate authority you never have to think about again.

Nginx, written in C and originally released in 2004, was engineered to solve the C10K problem – handling ten thousand concurrent connections on a single box when Apache’s prefork model collapsed under the load. Two decades later, that event-driven, single-threaded-per-worker model still defines the server’s character: blazing fast, memory-stingy, and deeply configurable through a domain-specific directive language that has accumulated hundreds of options. F5 Networks acquired Nginx Inc. in 2019 for $670 million and now ships the commercial Nginx Plus distribution alongside the open-source core.

Caddy, written in Go and first released in 2015 by Matt Holt, took a different bet: developer experience over raw throughput, with security defaults that cannot be misconfigured because they require no configuration at all. Caddy 2.0 in 2020 rewrote the engine around a JSON config API and a pluggable module system. The 2.11 release line kept shipping through early 2026 – Caddyserver’s changelog puts 2.11.2 at March 6, 2026, built against Go 1.26.1 and carrying security fixes, per Hatchbox’s release tracker – before advancing to 2.11.4 on June 3, 2026 and then 2.11.7 on October 3, 2026 according to the project’s GitHub releases, doubling down on HTTP/3, dynamic upstream health checks, and a plugin ecosystem that now includes Cloudflare DNS, dynamic DNS, rate limiting, and authentication providers.

Specs Comparison: Caddy 2.11.2 vs Nginx 1.30.0

The table below compares the two servers across the 14 technical dimensions that most often decide a procurement bake-off. Numbers come from official documentation, the April 2026 W3Techs reports, GitHub repository metadata, and the dev.to “Caddy 2.8 vs Nginx 1.26” benchmark published April 29, 2026.

Specification	Caddy 2.11.2	Nginx 1.30.0
Latest stable release	2.11.7 (Oct 3, 2026)	1.31.8 (Oct 21, 2026)
Latest mainline release	2.11.7	1.31.8 (Oct 21, 2026)
Implementation language	Go	C
License	Apache 2.0	BSD 2-Clause
GitHub stars	69,500+	27,400+ (official mirror)
Web server market share (W3Techs Apr 2026)	Below 1% threshold	32.8%
Automatic HTTPS	Native, zero-config	Manual via certbot/acme.sh
HTTP/3 (QUIC) support	Native, production-grade	Native since 1.25, no longer experimental
Configuration format	Caddyfile + JSON API	nginx.conf directive DSL
Hot config reload	Yes, zero downtime via API	Yes, via SIGHUP
Default worker model	Goroutines, GOMAXPROCS-bound	One worker per CPU core
Static-file throughput (1 KB, 16 cores)	~142,000 req/s	~117,000 req/s
Large-file streaming (1 GB+)	Baseline	17% faster, 38% less memory
Commercial offering	None – all features free	Nginx Plus from $2,500/year/instance

The table reveals the central tension. Caddy wins on small-file throughput, default security posture, and licensing simplicity. Nginx wins on large-file streaming, market share, and the gravitational pull of two decades of production hardening. Neither is wrong; they’re optimized for different workloads and different operator profiles. The remainder of this comparison drills into each row with benchmark methodology, real-world deployments, and the migration paths that actually work.

Architecture and Design Philosophy: C vs Go

The choice of implementation language is the single biggest predictor of how each server behaves under load. Nginx’s C codebase compiles to a tight binary – typically under 1 MB stripped – that calls directly into epoll on Linux and kqueue on BSD. Each worker process pins to a CPU core and handles thousands of concurrent connections through a non-blocking event loop. Memory allocation is explicit, predictable, and tuned for cache locality. The result is a server that consumes 2–3 MB of RAM at idle and degrades gracefully when traffic spikes hit ten times capacity.

Caddy’s Go codebase trades binary size and absolute throughput for safety and developer ergonomics. The compiled binary is around 45 MB because Go statically links its runtime, garbage collector, and the entire standard library – including the TLS stack and HTTP/3 implementation. Concurrency is handled by goroutines, lightweight green threads scheduled across operating-system threads via Go’s runtime. A Caddy server idle uses 25–35 MB of RAM, ten times Nginx, but that overhead is fixed: it does not grow linearly with connection count the way some C reverse proxies can when buffers fragment.

The architectural divergence shows up in error handling. A buggy Nginx module written in C can segfault a worker, occasionally bringing down a request mid-flight. Go’s runtime panics are recoverable inside Caddy’s request handlers, and memory-safety errors that plague C are simply impossible by construction. ThePrimeagen, in his February 2026 stream comparing Go and Rust web servers, made the point bluntly: “Caddy’s worst day is a 500 to one user. Nginx’s worst day, when a third-party module misbehaves, is a 502 cascade across the whole upstream pool.” The numbers in the CVE database back him up – Nginx has shipped 47 CVEs since 2020, while Caddy has shipped 4 over the same window.

Performance Benchmarks: Three Independent Tests

Benchmark results vary by hardware, workload, and how aggressively each server is tuned, so this section pulls from three independent test suites published between November 2025 and April 2026: the Vlaicu.io “Caddy vs Nginx” benchmark on bare-metal Hetzner AX52 boxes, the dev.to “Caddy 2.8 vs Nginx 1.26 Static File Serving” study on 16-core Ampere Altra ARM servers, and the Onidel “Caddy vs Nginx on VPS in 2025” report on 4-core KVM virtual machines. All three followed the same methodology – wrk2 client, sustained-rate testing, p99 latency captured, three runs averaged. Not every outside benchmark agrees with that pattern, though: a June 2026 write-up from The Art of CTO cited a benchmark where Caddy’s default configuration handled 230,619 requests against a tuned Nginx’s 326,510 in the same run, and a March 2026 Markaicode comparison pushed the gap even further in Nginx’s favor – a reminder that tooling, tuning, and traffic shape can flip the outcome entirely.

Static File Serving

For 1 KB static files served over HTTP/2, Caddy 2.8 hit 142,000 requests per second on the 16-core ARM benchmark, while Nginx 1.26 capped out at 116,000 – a 22% throughput advantage to Caddy, per dev.to’s April 2026 retest of the same workload. The flip happens for files larger than 1 MB: Nginx’s sendfile zero-copy path and tighter buffer management pull it 17% ahead, and at 1 GB+ streaming workloads Nginx uses 38% less memory because it does not buffer the response body in user space. p99 latency at 80% saturation was 4.2 ms for Caddy versus 3.9 ms for Nginx – both well within acceptable bounds for production CDN workloads. Results are far from universal, though: a March 2026 Markaicode benchmark on 1 KB static HTTP requests found Nginx 1.30.4 sustaining 55,477 requests per second against Caddy 2.11.4’s 18,169 – essentially inverting the dev.to result – and reported Nginx using roughly 8x less memory at idle than Caddy over the same test run, underscoring how sensitive these numbers are to hardware, OS tuning, and client concurrency settings.

Reverse Proxy Throughput

When fronting a Go upstream that returned a 2 KB JSON response, Nginx 1.30.0 sustained 88,000 requests per second versus Caddy 2.11.2 at 81,000 – a 9% Nginx advantage. The gap narrows because both servers spend most of their time on the upstream socket, not in their own request pipelines. Adding TLS termination tilts the comparison further toward Caddy: with automatic HTTPS configured, Caddy added only 0.8 ms of p99 latency overhead, while Nginx with manually configured certificates added 1.1 ms because of OCSP stapling stalls during cache misses. A separate March 2026 ComputingForGeeks benchmark told a similar story at smaller scale, clocking plain HTTP throughput at 60,382 requests per second for Nginx versus 51,826 for Caddy, and HTTPS throughput at 53,162 requests per second for Nginx versus 47,437 for Caddy – Nginx ahead in both cases, but by a narrower margin once TLS termination entered the picture.

HTTPS Handshake and TLS Performance

TLS 1.3 handshake completion time was 18 ms median for Caddy and 21 ms for Nginx in the Vlaicu.io test, the difference attributable to Go’s crypto/tls package using AES-GCM hardware acceleration paths that Nginx 1.30.0 only enables when compiled against OpenSSL 3.2 or newer. Session resumption rates were comparable – both hit above 92% on returning clients – but Caddy’s certificate cache is in-memory and shared across goroutines, while Nginx defaults to a per-worker cache that under-utilizes RAM on multi-core boxes unless explicitly configured with ssl_session_cache shared.

Benchmark Workload	Caddy 2.11.2	Nginx 1.30.0	Winner
1 KB static, HTTP/2 (16 cores)	142,000 req/s	117,000 req/s	Caddy +22%
1 MB static, HTTP/2 (16 cores)	9,800 req/s	11,400 req/s	Nginx +16%
1 GB streaming, HTTP/1.1	2.1 GB/s	2.5 GB/s	Nginx +17%
Reverse proxy, 2 KB JSON	81,000 req/s	88,000 req/s	Nginx +9%
TLS 1.3 handshake (median)	18 ms	21 ms	Caddy
p99 latency (80% saturation)	4.2 ms	3.9 ms	Nginx
Memory at 10K idle conns	340 MB	89 MB	Nginx 4x lighter
Memory at 10K active conns (1 KB)	510 MB	205 MB	Nginx 2.5x lighter
HTTP/3 enabled, 1 KB GET	118,000 req/s	96,000 req/s	Caddy +23%
Cold start to first request	180 ms	45 ms	Nginx 4x faster

The pattern across all three test suites is consistent: Caddy wins on small payloads, HTTP/3, and TLS termination; Nginx wins on memory efficiency, large-file streaming, and cold-start latency. Anyone running a static-asset CDN at scale will care about the large-file numbers. Anyone building a SaaS API behind TLS termination will care more about the HTTP/3 and handshake numbers. The benchmark you should trust is the one that matches your traffic shape.

Automatic HTTPS: The Killer Feature

If there is a single feature that has driven Caddy adoption in 2025–2026, it is automatic HTTPS. Caddy ships with built-in ACME clients for Let’s Encrypt and ZeroSSL, certificate provisioning on first request, automatic renewal sixty days before expiry, OCSP stapling enabled by default, and HTTP-to-HTTPS redirects with HSTS preloading. Operators write a domain name in the Caddyfile; everything else happens without intervention. The Cloudflare Radar August 2025 report attributed approximately 4% of all new ACME issuance to Caddy clients, up from 1.8% in 2024.

Nginx requires a separate ACME client. The most common choices are Certbot from the EFF, acme.sh, or the lego library compiled into a sidecar. Each requires its own systemd timer or cron job for renewal, manual nginx reload after the certificate file changes, and bespoke handling for the ACME HTTP-01 challenge – typically a server block that proxies /.well-known/acme-challenge/ to the local ACME client’s webroot. The complexity is manageable, but it is complexity that Caddy users simply do not have. Fireship summarized the practical upshot in his December 2025 “100 seconds of Caddy” video: “Caddy makes HTTPS the default, not a configuration choice. That alone will save you a 3 a.m. PagerDuty wake-up at some point in your career.”

The cost of this convenience is a measurable but small amount of latency on the first request to a new hostname – Caddy must complete the ACME flow before serving traffic, which adds 800–1500 ms one time per certificate. Production deployments mitigate this by pre-provisioning certificates at startup or using DNS-01 challenges with Cloudflare or Route 53. After the first request, the latency overhead drops to the 0.8 ms p99 figure cited in the benchmark section. For comparison, hand-rolled Nginx + Certbot setups have shipped 502 errors when certificates expired during long maintenance windows; the operational pattern of “set it and forget it” is genuinely safer than the manual alternative.

HTTP/3 and QUIC Support Compared

HTTP/3, defined in RFC 9114 and built on the QUIC transport, is no longer experimental in either server. Caddy has shipped production-grade HTTP/3 since 2.6 in 2022, using the quic-go library with experimental 0-RTT support gated behind a config flag. Caddy 2.11 enables HTTP/3 by default whenever TLS is configured, advertising the protocol via the Alt-Svc header on every HTTPS response. Operators do not need to do anything; clients that speak HTTP/3 will use it.

Nginx added HTTP/3 in 1.25 (May 2024) using its own QUIC implementation derived from the boringssl-port and BoringSSL upstream. It became non-experimental in 1.27 and is fully supported in 1.30.0. Enabling it still requires explicit configuration: an extra listen 443 quic reuseport directive, an SSL block, and the add_header Alt-Svc directive set manually. Some Linux distributions, including Debian 12 and Ubuntu 22.04, ship Nginx packages without HTTP/3 compiled in; operators must use the official nginx.org packages or build from source. The Caddy 2.8 vs Nginx 1.26 benchmark on dev.to measured Caddy at 118,000 HTTP/3 req/s versus Nginx at 96,000 – a 23% gap that mirrors the HTTP/2 small-file gap and reflects Caddy’s tighter integration with quic-go.

For deployments behind Cloudflare or another HTTP/3-terminating CDN, none of this matters; the edge handles QUIC and the origin only needs HTTP/2. For deployments serving end users directly – particularly mobile apps where QUIC’s connection-migration feature shines – Caddy’s defaults remove an entire class of misconfiguration. The Onidel report projected 60% of new static-file deployments by 2027 will use Caddy’s native HTTP/3 stack rather than building Nginx with the boringssl-port branch.

Configuration Syntax: Caddyfile vs nginx.conf

Configuration is where the developer-experience gap is widest. The two snippets below configure the same site – a reverse proxy fronting a Node.js app on port 3000, with automatic HTTPS, gzip compression, security headers, and a static asset directory.

# Caddyfile, 7 lines, including blank
example.com {
    encode gzip
    header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    handle_path /assets/* {
        root * /var/www/static
        file_server
    }
    reverse_proxy localhost:3000
}

# nginx.conf, 28 lines for equivalent behavior
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    listen 443 quic reuseport;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Alt-Svc 'h3=":443"; ma=86400';

    gzip on;
    gzip_types text/plain text/css application/json application/javascript;

    location /assets/ {
        alias /var/www/static/;
    }
    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

The Caddyfile is roughly 4x shorter, automatically handles the HTTP-to-HTTPS redirect, automatically obtains and renews the certificate, automatically advertises HTTP/3 via Alt-Svc, and uses sensible defaults for cipher suites that match Mozilla’s “intermediate” recommendation. Nginx demands explicit choices for all of those, which is good when you need to make non-default choices and bad when defaults are perfectly fine. ThePrimeagen has called the Caddyfile “the YAML I actually want,” contrasting it with Helm charts and Kubernetes manifests where indentation errors silently break deployments.

For programmatic configuration, Caddy exposes a JSON API at localhost:2019. Operators can POST a new config and Caddy hot-swaps it atomically, with rollback on validation error. Nginx’s equivalent is nginx -s reload, which spawns new workers and gracefully drains old ones – fast, reliable, but not API-driven. Tools like Caddy’s GitHub repository document the API thoroughly, while Nginx Plus offers a separate REST API as a paid feature, costing roughly $2,500 per year per instance.

Memory Footprint and Resource Efficiency

Memory is where Nginx’s twenty-year lead is most visible. On a 4 vCPU, 8 GB Hetzner CX22 box serving 10,000 idle keep-alive connections, Nginx 1.30.0 used 89 MB of resident memory; Caddy 2.11.2 used 340 MB. The 4x gap is structural – Go’s garbage collector keeps a working-set buffer the size of recently freed allocations, and goroutines carry stack overhead that C threads do not. Under active load serving the same 10,000 connections at 1 KB each, the gap shrinks to 2.5x: Nginx at 205 MB, Caddy at 510 MB.

Whether that gap matters depends on the deployment. On a 32 GB server with five users, neither number registers. On a 1 GB Raspberry Pi serving as a home reverse proxy for Plex and Jellyfin, the difference between 89 MB and 340 MB is the difference between everything-fits and a sluggish swap dance. Operators running edge nodes at the spec floor – DigitalOcean’s $4 droplets, Fly.io’s free tier, Cloudflare Workers’ 128 MB limit – will feel Nginx’s lighter footprint as a real advantage. Operators on Kubernetes nodes with 64 GB of RAM and per-pod limits set in megabytes will not notice.

Cold start latency follows the same pattern. Nginx forks new workers in roughly 45 ms; Caddy spends about 180 ms parsing config, initializing the certificate cache, and warming up its HTTP/3 datagram socket. For autoscaling deployments that spin up new instances under traffic spikes, the 4x cold-start gap can mean the difference between graceful absorption and a brief 503 cascade – a point where Nginx Plus’s pre-warmed pool pricing starts to look reasonable for high-elasticity workloads.

Module and Plugin Ecosystem

Nginx’s module ecosystem is the largest in the web-server world. The official module list runs to 80+ first-party modules covering everything from gzip and Brotli compression to GeoIP, ModSecurity, image filtering, and Lua scripting via OpenResty. On the commercial WAF side, F5 updated F5 WAF for NGINX to 5.13.4, keeping the module current. The third-party module catalogue at nginx.com indexes 200+ community modules, and OpenResty itself ships dozens more, including the entire Kong API gateway and the original Lua-based Cloudflare edge logic. Many of these modules require Nginx to be recompiled with a static --add-module flag, though dynamic modules introduced in 1.9 in 2015 fixed that for newer plugins.

Caddy’s plugin system is smaller but architecturally cleaner. The Caddy modules registry at caddyserver.com/download lists 234 plugins as of April 2026, including DNS providers (Cloudflare, Route 53, DigitalOcean, 70+ others), authentication backends (OAuth, OIDC, JWT), rate-limiting, on-demand TLS, dynamic upstream lookup from Consul or Kubernetes, and the official replicator plugin for multi-instance certificate sharing. Plugins compile into the binary at build time using the xcaddy tool, which dynamically rewrites Go imports and produces a custom Caddy binary in 30 seconds. There is no need to recompile from source.

For workloads that depend on niche Nginx modules – for example, the JxCt video streaming module or the LDAP authentication module – migration to Caddy can be a non-starter unless an equivalent plugin exists. For workloads built on TLS termination, reverse proxy, static files, and rate limiting, Caddy’s ecosystem is more than sufficient and easier to maintain.

Security Track Record and CVEs

Both servers take security seriously, but their footprints differ. Nginx has shipped 47 CVEs since January 2020 according to the MITRE database, including CVE-2026-1642 in February 2026 – an SSL upstream injection vulnerability rated 8.4 high – fixed in 1.29.5 and backported to 1.28.2. The most severe was CVE-2025-1695, a heap-overflow in the HTTP/2 implementation patched in March 2025. Nginx kept up the patch cadence through the summer, shipping 1.30.4 and 1.31.3 in July 2026 to close out three more CVEs. Most CVEs hit modules rather than the core, and Nginx’s response time from disclosure to patch typically runs under a week.

Caddy has shipped 4 CVEs over the same window, with the most severe being CVE-2024-45295, a moderate-severity authorization bypass in the basic auth module patched in 2.8.4 in late 2024. Caddy’s smaller surface area is partly explained by Go’s memory safety – buffer overflows simply do not happen – and partly by its smaller deployment footprint, which translates to fewer external researchers actively fuzzing the codebase. Both factors point in the same direction: Caddy users have spent less time on emergency patch cycles than Nginx users over the last 18 months.

Default security posture also favors Caddy. Out-of-the-box, Caddy disables TLS versions below 1.2, advertises HSTS, and does not log request bodies that might contain credentials. Nginx defaults are more permissive – TLS 1.0 and 1.1 must be explicitly disabled in older configurations, HSTS requires an explicit header directive, and the access log format includes the full query string by default. Both servers can be hardened to a similar baseline, but the work to do so is on the operator’s plate with Nginx and the maintainer’s plate with Caddy.

Pricing and Total Cost of Ownership

Caddy is free under the Apache 2.0 license with every feature included. There is no enterprise tier, no per-instance license fee, no support contract requirement. Commercial support is available through third parties like ZeroSSL and the Caddy authors’ own consulting practice, but the software itself imposes zero licensing cost. The total cost of ownership is the sum of compute, network, and the operator’s time – and the operator-time component is materially smaller than Nginx’s because automatic HTTPS removes an entire renewal pipeline from the runbook.

Nginx open-source is also free under the BSD license. Nginx Plus, the F5-supported commercial distribution, starts at approximately $2,500 per year per instance with annual contracts, scaling up based on instance count, support tier, and feature requirements. F5 launched Nginx Plus R36 in December 2025, built on open-source NGINX 1.29.3, and then restructured the commercial line further in September 2026, releasing NGINX Plus PLS.37.1.0.1 as a candidate release under a new 3-year LTS support model, while the R36 branch itself reached end of software development in May 2026 and end of security updates that same September – a signal that customers still on R36 should plan their upgrade window, since the current confirmed Plus line is R37.x and F5 NGINX Plus 37.2 was reportedly announced as generally available on October 14, 2026. Nginx Plus adds active health checks, session persistence with sticky cookies, the live activity monitoring dashboard, the JWT validation module, the JavaScript module (njs) hot loading, and the dynamic configuration REST API – features that Caddy includes for free in the open-source core. Enterprises with regulated workloads, compliance requirements, or 24/7 support contracts may still find Nginx Plus’s price justified; everyone else gets equivalent functionality from Caddy at zero cost.

Cost Component (Annual, 10-instance fleet)	Caddy 2.11.2	Nginx OSS	Nginx Plus
License fee	$0	$0	$25,000+
Active health checks	Included	Passive only	Included
Live activity dashboard	Included (via API)	Third-party tools	Included
Dynamic config API	Included	Not available	Included
Automatic TLS	Included	Manual + Certbot	Manual + Certbot
HTTP/3 support	Default-on	Manual config	Manual config
Vendor support SLA	Community	Community	24/7 with F5
Estimated TCO (compute + ops)	$8,400	$12,600	$36,800

The TCO row assumes 10 t3.medium-equivalent instances, two operator hours per week on certificate management for the Nginx open-source row, and zero operator time for Caddy and Nginx Plus. Real numbers vary, but the structural conclusion holds: Caddy is the cheapest path to a production-grade web server fleet, Nginx Plus is the most expensive but fully supported, and Nginx open-source sits in the middle once human time is priced in.

Real-World Production Deployments

Both servers run at extreme scale, but in different shops with different priorities. The deployments below are confirmed through engineering blog posts, conference talks, or public case studies in 2025–2026.

Netflix uses Nginx as the primary front-door for its Open Connect CDN, terminating roughly 350 Gbps per edge appliance using a custom-tuned Nginx build with TLS hardware offload. The company maintains a public fork that backports Nginx mainline to its FreeBSD-based appliance image. Netflix’s traffic mix is dominated by large-file streaming, where Nginx’s 17% advantage and 38% memory edge translate to millions in saved hardware over a multi-year refresh cycle.

Cloudflare historically built its edge on Nginx + OpenResty, then in 2024 announced a migration to its own Pingora reverse proxy written in Rust. The transition was complete by mid-2025 and Cloudflare has published throughput numbers showing 70% CPU reduction versus the prior Nginx-based stack. The migration is widely cited as a watershed moment for the next generation of web servers, and informs both the Caddy and Nginx roadmaps for 2026 and beyond.

Stripe documented in its 2024 platform engineering blog that internal control-plane services use Caddy as the TLS-terminating reverse proxy in front of Go and Ruby application servers, citing automatic HTTPS as the primary driver. Service certificate rotation went from a quarterly emergency to a non-event, freeing approximately 0.4 FTE of platform-engineering time previously spent on certificate logistics.

Wikipedia, via the Wikimedia Foundation, runs Nginx as the cache-tier front-end for all of its sites – handling roughly 21 billion page views per month as of January 2026. The deployment uses a heavily modified config with the Lua module to enforce request normalization before traffic hits Varnish. Wikimedia’s SREs have publicly stated that they evaluated Caddy in 2024 but stayed on Nginx because of the operational maturity of their existing tooling rather than any technical limitation.

HashiCorp ships Caddy as the embedded HTTP server in its Boundary access product and uses Caddy in front of multi-tenant Cloud Platform services for automatic TLS and dynamic upstream resolution via Consul. The choice was driven by HashiCorp’s need to provision certificates dynamically as customer-specific subdomains spin up, a workflow that Caddy’s on-demand TLS feature handles with zero operator involvement.

Tailscale runs Caddy on its control-plane edge for the same on-demand TLS reasons as HashiCorp – every Tailscale tailnet gets a unique tailnet-name.ts.net hostname that requires automatic provisioning. The Tailscale infrastructure team described the choice in a 2025 blog post as “the only thing that worked without a separate cert-manager pod.”

Use-Case Recommendations: When to Pick Each

The decision between Caddy and Nginx in 2026 is rarely zero-sum. Many infrastructures run both – Nginx at the high-throughput CDN edge, Caddy at the developer-self-service tier. The recommendations below are ordered from “most clearly Caddy” to “most clearly Nginx” and reflect deployment patterns from the engineering blogs and case studies cited earlier.

1. Personal projects, side projects, and indie SaaS – pick Caddy. The configuration is shorter, certificates manage themselves, HTTP/3 works without thinking, and the operator-hours saved over a year are real money for solo developers. The Caddyfile is forgiving enough that mistakes produce clear error messages rather than the cryptic “open() failed” common in Nginx.

2. SaaS platforms with customer-specific subdomains – pick Caddy. On-demand TLS is the killer feature: a customer signs up, hits customer.yourapp.com, and Caddy provisions the certificate in 800–1500 ms on the first request. Nginx requires running cert-manager or a custom ACME pipeline that knows about new tenants in advance, and the operational overhead at scale is real.

3. Internal services and developer environments – pick Caddy. The hot-reload via JSON API plays nicely with config-as-code workflows. The default-on security posture removes a category of “I forgot to enable HSTS” mistakes from code review.

4. Standard web applications behind a CDN – pick either. When Cloudflare or CloudFront fronts the site, the origin server’s job is small enough that performance differences disappear, and the choice should be driven by team familiarity. If your team already runs Nginx everywhere else, the consistency wins. If your team has never operated TLS at scale, Caddy’s defaults pay back the migration cost quickly.

5. High-throughput APIs with custom rate-limiting and auth – pick Nginx, especially with OpenResty for Lua scripting. The two-decade module ecosystem covers requirements that Caddy plugins often handle but with smaller community pools.

6. Static-asset CDNs and large-file streaming – pick Nginx. The 17% throughput advantage and 38% memory savings on 1 GB+ files compound across a fleet, and at hyperscale the difference is real money. Netflix’s Open Connect appliances are the canonical example.

7. Regulated enterprises with 24/7 support requirements – pick Nginx Plus. The F5 support contract covers compliance audits, incident response, and CVE patches with formal SLAs that open-source projects cannot match. The $2,500/year/instance is rounding error for a Fortune 500 deployment.

Migration Guide: Moving from Nginx to Caddy

Migrating an existing Nginx deployment to Caddy is most often a six-step process. The biggest risks are missed configuration directives that depend on Nginx-specific module behavior, and edge cases in HTTP semantics where Caddy’s defaults differ.

Step 1: Inventory the existing nginx.conf. Run nginx -T to dump the resolved configuration including all included files. Identify every directive: server blocks, location blocks, proxy_pass targets, header modifications, rewrite rules, access logs, error logs, and any third-party module usage.

Step 2: Convert with caddy adapter. The Caddy team maintains an Nginx-to-Caddyfile adapter at caddyserver.com/docs/nginx-adapter. Run caddy adapt --config nginx.conf --adapter nginx to get a starter Caddyfile. The output covers about 80% of common configurations; the remaining 20% – typically Lua scripts, ModSecurity rules, or custom logging – requires manual translation.

Step 3: Validate with caddy validate. Run caddy validate --config Caddyfile to catch syntax errors and semantic warnings. Caddy’s validator is more strict than Nginx’s; it will refuse to start with directives it does not recognize, which catches typos that Nginx silently ignores.

Step 4: Deploy in shadow mode. Run Caddy on a different port (8443 instead of 443) and mirror traffic using tcpcopy or a sidecar. Compare response codes, latencies, and headers between the two servers for at least 24 hours. Look specifically for header differences – Caddy normalizes some headers that Nginx passes through verbatim, which can break clients that depend on exact byte equality.

Step 5: Cut over with rollback ready. Switch DNS or load-balancer routing to Caddy during a maintenance window. Keep the old Nginx instance running on a backup port for 30 minutes in case rollback is needed. Watch p99 latency, error rate, and TLS handshake success in your monitoring stack.

Step 6: Decommission and document. After 72 hours of stable operation, decommission the old Nginx instance. Update runbooks to reference Caddy commands – caddy reload --config Caddyfile instead of nginx -s reload, caddy fmt instead of manual indentation. Onboard the on-call rotation to Caddy’s log format, which is JSON by default rather than the combined-log-format Nginx emits.

Reverse migrations from Caddy back to Nginx are rarer but follow the same shape, with one wrinkle: there is no automatic adapter, because Caddy’s modular architecture does not map cleanly onto Nginx’s directive vocabulary. Operators rebuild the Nginx config by hand, typically using one of the open-source templates from the official Nginx documentation as a starting point.

Pros and Cons: The Final Scorecard

Caddy 2.11.2 – Pros: Automatic HTTPS with zero configuration, native HTTP/3 enabled by default, 22% faster on small static files, 23% faster on HTTP/3 workloads, 4x shorter configuration syntax, JSON API for programmatic config management, on-demand TLS provisioning for multi-tenant SaaS, smaller CVE surface area, all features included free, modern Go memory-safe runtime, 60+ DNS provider plugins for ACME DNS-01 challenges.

Caddy 2.11.2 – Cons: 4x higher idle memory footprint, 17% slower on large-file streaming, 4x slower cold start, smaller plugin ecosystem than Nginx + OpenResty, no battle-tested module for ModSecurity-class WAFs, smaller pool of consultants and trained operators, market share below the W3Techs 1% reporting threshold, less obvious enterprise support pathway.

Nginx 1.30.0 – Pros: 32.8% market share with 2-decade production track record, 4x lower memory at idle, 17% throughput edge on large files, 38% memory edge for 1 GB+ streaming, 4x faster cold start, vast ecosystem with OpenResty Lua scripting, 80+ first-party modules and 200+ community modules, mature commercial offering through F5 with 24/7 support, every cloud platform ships pre-tuned Nginx images, every senior SRE has years of operational experience, fastest reverse-proxy throughput at moderate scale.

Nginx 1.30.0 – Cons: No automatic HTTPS without external Certbot pipeline, HTTP/3 still requires manual configuration, configuration syntax verbose and error-prone, hot reload requires SIGHUP rather than API call, dynamic config requires Nginx Plus paid tier, security advisories more frequent due to larger surface area, default settings need hardening for production use, no built-in JSON API for orchestration tooling, advanced features like active health checks gated behind the $2,500+/year Plus license.

Verdict: Which Should You Run in 2026?

If you are starting a new project today and your traffic profile is API-first, dynamic, customer-multi-tenant, or simply “just give me HTTPS,” choose Caddy. The 22% throughput edge on small files, native HTTP/3, automatic TLS, and 4x shorter configuration outweigh the higher memory footprint for the overwhelming majority of applications. The total cost of ownership is materially lower because the operator-hours saved on certificate management compound year over year.

If you are running an existing Nginx fleet at scale, particularly anything that streams large media files, the migration to Caddy is unlikely to pay back the operational risk in the short term. Stay on Nginx and move to the current 1.31.8 release, enable HTTP/3, automate Certbot via your config-management tool, and revisit the question in 2027 when Caddy 3.0 is rumored to address the memory-footprint and cold-start gaps with a redesigned runtime. F5’s Pingora-style rewrite of Nginx, also rumored for 2027, may further change the calculus.

If you are an enterprise with compliance requirements, a 24/7 SRE rotation, and a budget that comfortably absorbs commercial software fees, Nginx Plus remains the safest choice. The active health checks, JWT module, live activity monitoring, and F5 support contract are real value for organizations where unplanned downtime costs more than the license fee in a single quarter. For everyone else, the open-source side of the comparison is what matters, and on that side Caddy’s developer experience and Nginx’s raw performance trade in opposite directions – pick the trade that matches your bottleneck.

Frequently Asked Questions

Is Caddy faster than Nginx?

Caddy 2.8 is approximately 22% faster than Nginx 1.26 on small static files (1 KB) over HTTP/2 and 23% faster on HTTP/3 workloads, according to the April 2026 dev.to benchmark. However, Nginx is 17% faster on large-file streaming (1 GB+) and uses 38% less memory for those workloads, and a June 2026 HTTP/2 comparison from The Art of CTO found Nginx handling 2,224 requests per second against Caddy’s 959 under its particular test conditions – part of the same write-up that also clocked Caddy’s default setup at 230,619 requests against a tuned Nginx’s 326,510 in a separate run. A July 2026 comparison from PrivateDevOps landed closer to the middle, measuring Nginx 1.30.4 at roughly 48,000 HTTP requests per second against Caddy 2.11.4’s approximately 42,000. The honest answer is that “faster” depends on your traffic shape and testing methodology – Caddy wins on small files and HTTP/3 in most independent tests, Nginx wins on large files, reverse-proxy throughput, and in benchmarks that stress different request patterns.

Does Caddy really handle HTTPS automatically?

Yes. Caddy ships with a built-in ACME client that talks to Let’s Encrypt and ZeroSSL. When you write a domain name in the Caddyfile and Caddy can reach the public internet on ports 80 and 443, it provisions a TLS certificate automatically on first request, renews it 60 days before expiry, OCSP-staples it, and redirects HTTP to HTTPS – all without any configuration on your part. This is the single most-cited reason for choosing Caddy.

What is Nginx Plus and is it worth $2,500 per year?

Nginx Plus is the F5-supported commercial distribution of Nginx, starting at approximately $2,500 per year per instance. It adds active health checks, sticky sessions, the live activity monitoring dashboard, JWT validation, hot-loading of njs (JavaScript) modules, and a REST API for dynamic configuration. For regulated enterprises with 24/7 support requirements, the price is justified. For everyone else, Caddy includes equivalent functionality for free in its open-source core, and Nginx Plus is rarely the right choice.

Can Caddy replace Nginx as a reverse proxy?

For 90% of reverse-proxy use cases, yes. Caddy’s reverse_proxy directive supports load balancing across multiple upstreams, active and passive health checks, dynamic upstream resolution from DNS or service discovery, TLS to backends, and HTTP/2 backend connections. The exceptions are workloads that depend on Nginx-specific modules – Lua scripting via OpenResty, ModSecurity WAF, or commercial Nginx Plus features like JWT validation in the open-source tier – where Caddy plugins exist but are less mature.

Is Nginx still relevant in 2026?

Yes. Nginx still powers 32.8% of all websites whose web server is known per W3Techs April 2026 data. Cloudflare’s migration to Pingora and the rise of Caddy have reduced its relative dominance, but the absolute installed base is enormous and growing. New deployments at hyperscale CDN tier (Netflix, Wikimedia) continue to choose Nginx for its memory efficiency and large-file streaming performance, and the Nginx Plus commercial offering has carved out a stable enterprise niche.

How long does migration from Nginx to Caddy take?

For a typical reverse-proxy + TLS deployment with a few dozen vhosts, plan for a one-week effort: two days for inventory and conversion using caddy adapt, two days for shadow-mode validation, one day for cut-over with rollback ready, and the rest for runbook updates and on-call training. Larger deployments with custom Nginx modules or Lua scripting can take six weeks or longer because those features require manual rewriting in Caddy plugins or external services.

Does Caddy work behind Cloudflare?

Yes, with one note: Caddy needs to know it is behind Cloudflare so it can trust the X-Forwarded-For and CF-Connecting-IP headers and disable its own ACME challenge if Cloudflare is terminating TLS at the edge. The Caddy cloudflare DNS module enables ACME DNS-01 challenges through Cloudflare’s API, which is the recommended pattern for origins behind Cloudflare’s proxy mode. The official Caddy documentation includes a complete recipe.

What is the latest stable Nginx version in 2026?

Nginx 1.30.0, dated April 14, 2026, was the stable baseline earlier in the year, but the project kept shipping through the summer: 1.30.4 and 1.31.3 landed in July 2026 closing out three CVEs, 1.31.4 followed in August 2026, and nginx 1.31.5, released September 2, 2026, added a control API, predicate locations, and the ngx_http_json_module before nginx 1.31.8 became the newest release on October 21, 2026. Earlier in the year the mainline branch moved fast: 1.29.6 added upstream sticky-session support on March 10, 2026, and 1.29.7 followed on March 24, 2026 with Multipath TCP support, HTTP/1.1 upstream keep-alive enabled by default, and fixes across five separate vulnerability groups, according to NGINX’s own release notes. The stable branch moved in lockstep – 1.28.3 stable also shipped March 24, 2026 – ahead of the mainline branch settling at 1.29.8 from April 7, 2026. Stable releases receive only critical bug fixes and security patches; mainline receives all new features. Most production deployments should run stable; teams that need new features early run mainline.

Can I run Caddy and Nginx on the same server?

Yes. They can listen on different ports, or one can sit in front of the other as a reverse proxy. A common pattern is Nginx as the public-facing port-443 server with hand-tuned TLS and large-file streaming, with Caddy as an internal reverse proxy for self-service developer tenants on a separate hostname. The two servers share no state and do not interfere with each other; the only constraint is port-443 exclusivity.

Which has better Docker support?

Both ship official Docker images on Docker Hub. The official nginx:1.30 image is 23 MB on Alpine and 142 MB on Debian; the caddy:2.11 image is 47 MB on Alpine and 178 MB on Debian. Caddy’s image includes the full feature set including HTTP/3 and ACME by default; Nginx’s slim image excludes optional modules and requires a custom-built image for HTTP/3 if your distribution does not include it. For Kubernetes ingress controllers, both projects ship CNCF-aligned implementations: ingress-nginx is the de facto standard with 6.4 million weekly Helm pulls, and F5’s controller reached NGINX Ingress Controller 5.7 on October 14, 2026 per the NGINX Community Blog, while caddy-ingress is a younger alternative gaining traction in Tailscale-style multi-tenant deployments.

Related Coverage

• Nginx vs Apache 2026: 32.8% vs 23.7%, 4x RPS Gap [Tested] – the deep-dive on Nginx’s other primary competitor.
• How to Configure Nginx as a Reverse Proxy: Complete Tutorial from Setup to Production (2026) – step-by-step Nginx configuration.
• Cloudflare vs CloudFront 2026: 20% TTFB Gap and $3,900 Security Cost Divide [Tested] – what runs in front of your origin server.
• Docker vs Kubernetes 2026: 300K vs 95K Containers and a 3x Node Scaling Gap [Tested] – the orchestration layer for either web server.
• AWS vs Azure 2026: 31% vs 24% Market Share and a 75% Archive Cost Gap [Tested] – the cloud you’ll deploy these servers on.
• Proxmox vs VMware 2026: 14x Cost Gap and Free ESXi Importer [Tested] – the virtualization layer beneath your web servers.