Mail Proxy Server and SMTP are quite effective features in the product. The tool's API connectivity across the hybrid network is pretty impressive, which is almost the same as the threat intelligence capabilities of NGINX.
Senior Manager at Contessabd
Has less complexities and is very user-friendly
Pros and Cons
- "The tool is not complex and is very user-friendly."
- "The product's price is high, making it an area of concern where improvements are required. The tool's licensing model is also not good."
What is most valuable?
What needs improvement?
The product's price is high, making it an area of concern where improvements are required. The tool's licensing model is also not good.
The product should have more documentation, especially like the ones provided by other OEMs.
For how long have I used the solution?
I have been using NGINX App Protect for five years. I use NGINX App Protect WAF Release 5.0. My company has a partnership with F5.
What do I think about the scalability of the solution?
My company is currently dealing with one enterprise-sized company and one financial organization.
Buyer's Guide
NGINX App Protect
May 2025

Learn what your peers think about NGINX App Protect. Get advice and tips from experienced pros sharing their opinions. Updated: May 2025.
856,873 professionals have used our research since 2012.
How was the initial setup?
The product's initial setup phase was a bit difficult since the articles and other documentation were not that good.
When it comes to the implementation part, at least seven days are needed for the testing phase since there may be some struggles in several places, and one may have to go directly to the OEM just to make sure that we can study the tool properly.
What's my experience with pricing, setup cost, and licensing?
The product's price is high.
Which other solutions did I evaluate?
If NGINX App Protect does not fit the budget of our customers, then my company recommends Radware to such clients. Radware's OEM engagement is better than that of NGINX App Protect.
I don't have any problem with NGINX App Protect's OEM engagement. When I directly engage with the tool's OEM, I see that they are really helpful. When it comes to OEM, F5 has an amazing feature set and is pretty technical. Technicians from F5 can help any time with any request of a client associated with the tool, and they also help to help clients so our company's deals with them can mature further.
What other advice do I have?
The product is good since NGINX is involved in a lot of research and development work. Two years ago, my company used the firewall from NGINX. In the previous year, my company entered into a deal with Radware.
Whether I would recommend the product to others depends on their requirements and the type of business they are doing, among other factors.
Speaking about how the tool has been able to handle new and emerging security threats, I would say that my company is testing the product to see if it fits our requirements. My company is testing some threats.
My company has not tested the product with any of the tool's AI-driven security initiatives, but we may do so later since we are only working on one deal associated with Radware.
The tool is not complex and is very user-friendly.
I rate the tool a ten out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner

Manager - Cyber Security at a financial services firm with 10,001+ employees
Great auto-learning and protection
Pros and Cons
- "NGINX App Protect's best features are auto-learning, which creates a profile of applications that are deployed, bot protection, and force protection, which lets you configure your brute force policy and alert for and prevent brute force attacks."
- "NGINX App Protect would be improved with integration with Shape and F5 WAF, which would make it easy for users to manage all their web application security with a single solution."
What is most valuable?
NGINX App Protect's best features are auto-learning, which creates a profile of applications that are deployed, bot protection, and force protection, which lets you configure your brute force policy and alert for and prevent brute force attacks.
What needs improvement?
NGINX App Protect would be improved with integration with Shape and F5 WAF, which would make it easy for users to manage all their web application security with a single solution. In the next release, I'd like to see some enhancements in bot protection, API security, and mobile application security.
For how long have I used the solution?
I've been using NGINX App Protect for four years.
What do I think about the stability of the solution?
NGINX App Protect is stable but has some areas for improvement, including HTML5 availability. I would rate its stability eight out of ten.
How are customer service and support?
NGINX's technical support is good, but sometimes their response time is delayed, or they don't have the technical skills to resolve issues. We're seeing these issues despite having premium support.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I previously used Imperva WAF.
What other advice do I have?
I would give NGINX App Protect a rating of eight out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Buyer's Guide
NGINX App Protect
May 2025

Learn what your peers think about NGINX App Protect. Get advice and tips from experienced pros sharing their opinions. Updated: May 2025.
856,873 professionals have used our research since 2012.
Senior Network Engineer at a comms service provider with 1,001-5,000 employees
Flexible and high availability
Pros and Cons
- "The most valuable feature of NGINX App Protect is its flexibility."
- "The setup of NGINX App Protect is complex. The full process took one week to complete. Additionally, we had to change the network infrastructure platform which took one month."
How has it helped my organization?
NGINX App Protect has improved the flexibility of services in our company and distributed new escalation applications. The downtime in our network has decreased substantially. In a short time, we can republish and resolve issues in our network.
What is most valuable?
The most valuable feature of NGINX App Protect is its flexibility.
For how long have I used the solution?
I have been using NGINX App Protect for approximately three years.
What do I think about the stability of the solution?
NGINX App Protect is stable.
What do I think about the scalability of the solution?
The scalability of NGINX App Protect is decent.
We have approximately 500 people using the solution in my organization. We have IT specialists that work with the core mobile network.
How are customer service and support?
We do not have technical support in Iran, we only use our own knowledge about the solution.
Which solution did I use previously and why did I switch?
I did not use a similar solution previous to NGINX App Protect.
How was the initial setup?
The setup of NGINX App Protect is complex. The full process took one week to complete. Additionally, we had to change the network infrastructure platform which took one month.
I rate the setup difficulty of NGINX App Protect a four out of five.
What about the implementation team?
We used an IT expert for the implementation of NGINX App Protect. We have three people who provide support for NGINX App Protect.
What was our ROI?
We have received a return on investment, NGINX App Protect was a good investment.
What's my experience with pricing, setup cost, and licensing?
I rate the price of NGINX App Protect a three out of five.
There are not any additional costs we had to pay to use NGINX App Protect.
What other advice do I have?
We have a complex project and we found some of our applications did not work as intended. However, moving forward we do not find we will experience this level of complexity.
I rate NGINX App Protect a nine out of ten.
Which deployment model are you using for this solution?
Private Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Reseller
IT Security at a insurance company with 501-1,000 employees
With an easy setup phase in place, the tool offers high stability and good scalability
Pros and Cons
- "It is a stable solution."
- "The product's user interface is an area with shortcomings as it can be quite confusing for users, making it an area where improvements are required."
What is most valuable?
The most valuable feature of the solution is that IVF and ICSI are covered under the firewall option offered by the tool. I don't have a specific feature I like the most since I look at features through comparisons of different firewall products and the features of such tools.
What needs improvement?
The product's user interface is an area with shortcomings as it can be quite confusing for users, making it an area where improvements are required. The main menu can be quite confusing.
After you implement it, it's not so easy to understand how it works. Though in my company, we understand the basics of the product, if you want to explore the more advanced features, then the principal product doesn't explain it to us, which can be quite confusing when navigating through the main menu.
For how long have I used the solution?
I have been using NGINX App Protect for five years. I use the solution in my company.
What do I think about the stability of the solution?
It is a stable solution.
What do I think about the scalability of the solution?
In our company, we never tried to use the scalability options provided by the tool.
How are customer service and support?
The solution's technical support is good. I rate the technical support an eight to nine out of ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Previously, our company was using Fortinet. I don't know why my company switched from Fortinet to NGINX App Protect because it happened before I joined the organization.
How was the initial setup?
The product's initial setup phase was easy.
What's my experience with pricing, setup cost, and licensing?
The price of NGINX App Protect is not much different from the products that fall under the leader category of Gartner Magic Quadrant.
Which other solutions did I evaluate?
My company needs to expand its options to see if some other brand apart from NGINX App Protect is faster.
As the license for NGINX App Protect in our company will expire in a few months, my company wants to make a decision on whether to extend the services of the tool or not based on the research we do on other platforms in the market.
What other advice do I have?
My company is satisfied with the product.
For the user interface, I rate the product an eight out of ten.
For the functionalities of the product, I rate the tool a ten out of ten.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Cyber Security Analyst at Link3 Technologies
A scalable solution for application firewall with easy deployment
What is our primary use case?
We use the solution for application firewall purposes. We use both mobile and web applications.
What needs improvement?
During the NGINX App Protect v1.1 upgrade, we encountered compatibility issues with our existing telecom infrastructure, specifically the load balancer and WAF. These issues manifested as difficulties with the HTTP 1.1 protocol. While attempting to solve the problem through upgrades, we ultimately opted for alternative solutions as the desired effect could not be achieved. This highlights the technical challenges of integrating NGINX App Protect with diverse network components.
For how long have I used the solution?
I have been using NGINX App Protect for more than five years.
What do I think about the stability of the solution?
The product is stable.
I rate the solution’s stability an eight-point five out of ten.
What do I think about the scalability of the solution?
The solution is scalable.
How are customer service and support?
The customer service’s response should be faster.
How was the initial setup?
The initial setup is straightforward. For deployment, we configured basic configuration, and after mounting, We observed our application for almost four months. After that, we proceed to enforcement blocking mode. Typically, all our applications are live, so we can't block it on day one. We observed it for a long time, like six months, and then we went into step-by-step blocking mode.
Three people are required for the solution's deployment.
What's my experience with pricing, setup cost, and licensing?
The product is expensive and has a subscription-based licence.
What other advice do I have?
NGINX App Protect's high price and limited support options can be a drawback. While troubleshooting basic issues is manageable, resolving advanced problems through paid support channels can be expensive and experience delays.
I recommend the solution if the client has no financial issues regarding their WAF or LTM solutions. Still, if they are budget constraints, one should think of other options like Fortinet.
Overall, I rate the solution an eight out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Chief Technology Officer at a tech company with 11-50 employees
Beneficial open-source environment, simple implementation, and reliable
Pros and Cons
- "The most valuable feature of NGINX App Protect is its open source."
- "NGINX App Protect could improve security."
What is our primary use case?
We are using NGINX App Protect as a web portal and we are planning to use it as an API gateway.
What is most valuable?
The most valuable feature of NGINX App Protect is its open source.
What needs improvement?
NGINX App Protect could improve security.
For how long have I used the solution?
I have been using NGINX App Protect for approximately five years.
What do I think about the stability of the solution?
NGINX App Protect is stable.
What do I think about the scalability of the solution?
The scalability of NGINX App Protect is good.
Everyone in my company that uses this solution are developers. We have a total of 150 concurrent users.
How are customer service and support?
The support from NGINX App Protect is too expensive. We did not end up receiving support because of the cost.
How was the initial setup?
The initial setup of NGINX App Protect is easy. It took us a couple of days maximum.
What about the implementation team?
NGINX App Protect is low maintenance and we did the implementation in-house with a couple of people.
What was our ROI?
We have seen a return on investment using NGINX App Protect.
What's my experience with pricing, setup cost, and licensing?
The price of NGINX App Protect is approximately $3,000 annually. All of our licenses are observed by a managed service partner.
What other advice do I have?
I rate NGINX App Protect an eight out of ten.
No solution is perfect, there is always room for improvement.
Which deployment model are you using for this solution?
Private Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Information Security Engineer at a computer software company with 1,001-5,000 employees
Beneficial reverse proxy, effective load balancer, and helpful support
Pros and Cons
- "The most valuable feature of NGINX App Protect is the reverse proxy."
- "The price of NGINX App Protect could improve."
What is our primary use case?
NGINX App Protect can be used as a reverse proxy, internet controller, and for caching.
How has it helped my organization?
NGINX App Protect has improved our organization by using the load balancer feature.
What is most valuable?
The most valuable feature of NGINX App Protect is the reverse proxy.
What needs improvement?
The price of NGINX App Protect could improve.
For how long have I used the solution?
I have been using NGINX App Protect for approximately two years.
What do I think about the stability of the solution?
NGINX App Protect is stable. It is lightweight and fast.
What do I think about the scalability of the solution?
The scalability of NGINX App Protect is good and it is easy to do.
How are customer service and support?
The experience I had with the technical support was good.
Which solution did I use previously and why did I switch?
We used another solution previously to NGINX App Protect. We switch to testing other solutions.
How was the initial setup?
The initial setup of NGINX App Protect is basic. The full deployment took approximately one day.
What about the implementation team?
We followed the documentation to do the implementation of NGINX App Protect in-house. We have one person that does the deployment and maintenance of the solution.
What was our ROI?
I have not seen a return on investment, it is too soon. We are only in the testing phase.
What's my experience with pricing, setup cost, and licensing?
There is a monthly or annual subscription to use NGINX App Protect. There are not any additional costs to the subscription.
I rate the price of NGINX App Protect a three out of five.
What other advice do I have?
I would recommend this solution to others because it performs well.
I rate NGINX App Protect a ten out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Senior Network and Security Specialist at a tech services company with 51-200 employees
Reasonably priced and responsive support, but scalability could be improved
Pros and Cons
- "NGINX App Protect has complete control over the HTTP session."
- "Currently, the policies have to be handled manually, and you have to create from scratch, which can be a bit time-consuming, in a large environment."
What is our primary use case?
I work with containers. I do the architecting, but there are times when I also do the implementation. So I'm familiar with the products, particularly NGINX.
NGINX App Protect is used in Kubernetes and OpenShift environments.
What is most valuable?
NGINX App Protect has complete control over the HTTP session. I can experiment with whatever I want. I can start with URLs and cookies. I can work with parameters and everything that I need. I can work with signatures also. I can inspect the traffic whenever I want.
What needs improvement?
As I see it now, there are some things to improve, but the F5's WAF is, more enhanced when compared to NGINX's. However, they have done a good job adapting it.
It should be automated in some way.
Currently, the policies have to be handled manually, and you have to create from scratch, which can be a bit time-consuming, in a large environment.
It would be good if some kind of automation was included.
For how long have I used the solution?
I have worked with NGINX App Protect for at least three or four years.
What do I think about the stability of the solution?
NGINX App Protect is a stable product. Because it's an additional module, we use it in conjunction with the Ingress Controller, but it can also be run anywhere, as a VM or whatever you need.
They did an excellent job porting the VSM code to NGINX.
What do I think about the scalability of the solution?
NGINX App Protect is scalable, but, handling the configuration is still time-consuming. It doesn't have a centralized option. They have the NGINX controller and some APIs to do it, but it isn't fully scalable in my opinion.
How are customer service and support?
I've known them for a long time because I began working with F5 more than ten years ago. Even though my primary experience is with F5, and I don't have many tickets open in NGINX in general, the service is quick. But, in my opinion, it's pretty solid.
Which solution did I use previously and why did I switch?
I began with F5 products such as ASM. It performs the functions of the various firewalls. When NGINX was acquired by F5, they adapted the module for NGINX, which was dubbed App Protect. When this became public, I began to work with NGINX in this case as well.
How was the initial setup?
The implementation process is not simple. If you have more than one, the policy must be created from scratch in YAML files, which is not automated and takes time.
What's my experience with pricing, setup cost, and licensing?
The pricing is reasonable because NGINX operates on an instance basis. There are differences. There is some leeway in how much the instance can cost, depending on the customer and other actions, but it's reasonable in my opinion.
Which other solutions did I evaluate?
I work as a consultant for a company and am currently evaluating some products.
What other advice do I have?
We are a partner with F5. I am currently evaluating Prisma Cloud because they have a WAF option on Palo Alto and I'm looking into it. But, aside from Prisma, I've never seen the WAF. So I'm attempting to make some comparisons in order to learn the Prisma side and see how it works with NGINX. I downloaded a document to get a head start on it and to form an idea for now.
I would rate NGINX App Protect a seven out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner

Buyer's Guide
Download our free NGINX App Protect Report and get advice and tips from experienced pros
sharing their opinions.
Updated: May 2025
Popular Comparisons
Prisma Cloud by Palo Alto Networks
Checkmarx One
Microsoft Azure Application Gateway
Azure Front Door
AWS WAF
F5 Advanced WAF
CrowdStrike Falcon Cloud Security
Fortinet FortiWeb
Cloudflare Web Application Firewall
Imperva Web Application Firewall
Imperva DDoS
Akamai App and API Protector
Azure Web Application Firewall
SUSE NeuVector
Akamai API Security
Buyer's Guide
Download our free NGINX App Protect Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- Which lesser known firewall product has the best chance at unseating the market leaders?
- Which WAF solution would you recommend to cater to 100 to 125 concurrent sessions?
- What do you recommend for a securing Web Application?
- Fortinet vs Sophos? Help choose a NGFW solution that can replace Microsoft TMG.
- Imperva WAF vs. Barracuda: Which One is Better?
- F5 vs. Imperva WAF?
- When should companies use SSL Inspection?
- NGFW with URL Filtering vs Web Proxy
- How does a WAF help to protect against DDoS attacks?
- What's right for me? Fortinet or Citrix?