NGINX App Protect Reviews

Vendor: F5

4.2 out of 5

24 reviews
95% willing to recommend

What is NGINX App Protect?

NGINX App Protect application security solution combines the efficacy of advanced F5 web application firewall (WAF) technology with the agility and performance of NGINX Plus. The solution runs natively on NGINX Plus and addresses some of the most difficult challenges facing modern DevOps environments:

Get the NGINX App Protect Buyer's Guide and find out what your peers are saying about NGINX App Protect, Prisma Cloud by Palo Alto Networks, Checkmarx One and more!

NGINX App Protect is the #2 ranked solution in API Security Solutions, #15 ranked solution in top Web Application Firewalls, and #17 ranked solution in Container Security Solutions. PeerSpot users give NGINX App Protect an average rating of 8.4 out of 10. NGINX App Protect is most commonly compared to Prisma Cloud by Palo Alto Networks: NGINX App Protect vs Prisma Cloud by Palo Alto Networks. NGINX App Protect is popular among the large enterprise segment, accounting for 57% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 19% of all views.

Helped 851,604 peers since 2012

Featured NGINX App Protect reviews

Saurav Kumar

Senior security architecture at National Payment Corporation Of India

NGINX App Protect secures our company's application, and it has helped me a lot, considering that we have critical infrastructure in India where we see how lots of attacks come onto our organization's servers. The tool offers protection against multiple threats present in India's IT ecosystem. The tool helps our company to make our payments secure, meaning it has the ability to provide a secure payment environment in India. Speaking about the improvements in our company's application performance since implementing NGINX App Protect, the gRPC support for the solution is very low. My company is not getting any proper documentation on how to deploy gRPC over NGINX App Protect. I recommend the product to those who plan to use it. People can use the product as their company's base server, WAF, or for its proxy manager, depending on the business requirements. My company follows PCI DSS compliance because we operate in a payment-related industry. Right now, my company follows all the standards, so we comply with all the requirements and policies. I rate the tool an eight out of ten.

Read full review

Tomaz Sobczak

Security System Engineer at Ascomp S.A.

NGINX App Protect is easier to automate and configure, or manage from an API. This is good for securing applications. However, it's not suitable for more complex tasks. NGINX App Protect positively impacted performance changes. There's a cache or it works like a proxy, so it can speed up applications. It can also offload some functions from servers, which NGINX can handle faster.

Read full review

MariosChristodoulou

Chief Information Officer at F.P. eSafe Solutions LTD

The solution is easy to deploy. Its scalability and integration capabilities depend on its performance and the extent to which you want to integrate it into your development process. It doesn't necessarily cost more money beyond the initial setup. You need to identify the placement. You must understand your application. Lastly, you should assess which NGINX features are suitable for the functionality you wish to implement. This initial phase involves analysis. Following the analysis, you proceed to the test deployment stage. Subsequently, you enter alert mode and finally enable NGINX App Protect. It's a simple deployment. A single engineer can do the job.

Read full review

NGINX App Protect mindshare

Product category:

As of May 2025, the mindshare of NGINX App Protect in the Web Application Firewall (WAF) category stands at 1.8%, down from 2.5% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Web Application Firewall (WAF)

PeerResearch reports based on NGINX App Protect reviews

Type	Title	Date
Category	Web Application Firewall (WAF)	May 20, 2025	Download
Product	Reviews, tips, and advice from real users	May 20, 2025	Download
Comparison	NGINX App Protect vs AWS WAF	May 20, 2025	Download
Comparison	NGINX App Protect vs F5 Advanced WAF	May 20, 2025	Download
Comparison	NGINX App Protect vs Microsoft Azure Application Gateway	May 20, 2025	Download

Title	Rating	Mindshare	Recommending
Prisma Cloud by Palo Alto Networks	4.2	2.1%	98%	110 interviews Add to research
Checkmarx One	3.8	N/A	87%	70 interviews Add to research

Valuable Features

NGINX App Protect offers flexible security management, reverse proxy capabilities, and integration across platforms. Users value its simple command-line interface, API connectivity, and robust automation for DevOps. Features include OWASP certification, load balancing, bot and brute force protection, flexible policies, and traffic management. The tool provides comprehensive HTTP session control and auto-learning for application profiling, streamlining backend programming while enhancing security with signature-based detection, DOS protection, and effective bot detection and IP blocking.

"I would say that the most valuable feature is the ability to operate in a DevOps environment and to be configured through API and pipeline by the developers themselves."
"Overall, I rate NGINX App Protect between eight and nine."
"There's a cache, or it works like a proxy, so it can speed up applications."

Room for Improvement

Configuration lacks flexibility, requiring more automation for setting policies and managing rules. High throughput challenges persist. Limited API exposure and slow bug fixes hinder performance. Licensing becomes expensive quickly. User interface and technical support need refinement. Compatibility issues with existing infrastructure are present. Integration with more security features and a clearer roadmap are desired. Documentation is insufficient, making advanced feature exploration difficult. Pricing and understanding of hardware requirements require attention.

"It would be better if it were easier to implement and if there was more information from F5 regarding hardware requirements and specifications to deploy the service, to avoid disruptions after implementation."
"It doesn't have more advanced features like no false-positive security, which you can configure in Advanced WAF."
"The product's price is high, making it an area of concern where improvements are required. The tool's licensing model is also not good."

ROI

Organizations experienced a notable ROI from NGINX App Protect, especially during the transition to remote work due to Covid. The investment in NGINX App Protect provided immediate advantages, enhancing application security and delivering cost-effectiveness. Some companies report being in early testing phases, lacking clear ROI visibility, although they acknowledge benefits like improved network security and integration ease with CICD pipelines. One entity invested $40,000 and anticipates $30,000 in returns within eight months.

Pricing

NGINX App Protect pricing is considered high, with licensing fees reported between $3,000 to $40,000 annually. Its subscription-based model offers flexibility with yearly or multi-year options. While some find the costs reasonable, others note it as expensive compared to alternatives like Imperva. Licensing is annual without additional fees, and pricing varies based on architecture and usage. Customers perceive it similar to top-tier Gartner Magic Quadrant products in cost.

"The product's price is high."
"NGINX App Protect is expensive."
"The price of NGINX App Protect is not much different from the products that fall under the leader category of Gartner Magic Quadrant."

Popular Use Cases

NGINX App Protect is mainly used for securing web applications, including internet banking and published services. It functions as a web application firewall, load balancer, and reverse proxy. Users employ it in container environments such as Kubernetes and OpenShift, in cloud perimeter security, and to protect APIs. It also integrates into deployment pipelines and guards against OWASP threats, with capabilities for automated cases and decentralized applications.

Service and Support

NGINX App Protect's customer service is fast and helpful, though some report delays in response time. Technical support is knowledgeable but sometimes asks unnecessary questions. Users experienced varying quality, with some finding it expensive, lacking technical skills, or requiring issue escalation. Previous experiences with BIG-IP were efficient. Though responsiveness has improved, some prefer alternatives. Many rate support highly, around eight to nine out of ten. Some customers rely on their expertise due to unavailable support.

Deployment

NGINX App Protect's initial setup is generally considered simple, especially for those familiar with similar tasks, but can become challenging due to security certificates and custom configurations. Most organizations faced additional work when dealing with certificates. Basic deployments are quick, but complex setups involving multiple applications or granular security require more time. Experience aids efficiency, while novices may find it more demanding. Deployment times vary from days to months, with automation and preparation easing the process.

Scalability

NGINX App Protect offers scalability with various licensing options, suitable for diverse user counts. While perceived as scalable by many, challenges exist in handling traffic and configuration complexities, especially with deployment lag and lack of centralized options. It supports a wide range of users but may require upgrading hardware for traffic expansion. Users report it to be scalable but note specific limitations related to policy design and application-specific scalability.

Stability

NGINX App Protect exhibits excellent stability. Many users highlight its dependable operation and compare it favorably against other options like Imperva. It can manage substantial traffic, handling up to 70,000 requests per second. Users often rate its stability between eight and eight-point-five out of ten, praising its lightweight and fast performance. Some mention areas for improvement but consistently note its reliability. The application is versatile, running efficiently as a module with Ingress Controller.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our NGINX App Protect Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

19%

Financial Services Firm

14%

Comms Service Provider

Retailer

Manufacturing Company

Energy/Utilities Company

Healthcare Company

University

Real Estate/Law Firm

Educational Organization

Government

Hospitality Company

Media Company

Wholesaler/Distributor

Non Profit

Insurance Company

Legal Firm

Construction Company

Performing Arts

Transportation Company

Pharma/Biotech Company

Logistics Company

Outsourcing Company

Consumer Goods Company

Leisure / Travel Company

Program Development Consultancy

Compare NGINX App Protect with alternative products

Learn more about NGINX App Protect

Integrating security controls directly into the development automation pipeline
Applying and managing security for modern and distributed application environments such as containers and microservices
Providing the right level of security controls without impacting release and go-to-market velocity
Complying with security and regulatory requirements

NGINX App Protect offers:

Expanded security beyond basic signatures to ensure adequate controls
F5 app‑security technology for efficacy superior to ModSecurity and other WAFs
Confidently run in “blocking” mode in production with proven F5 expertise
High‑confidence signatures for extremely low false positives
Increases visibility, integrating with third‑party analytics solutions
Integrates security and WAF natively into the CI/CD pipeline
Deploys as a lightweight software package that is agnostic of underlying infrastructure
Facilitates declarative policies for “security as code” and integration with DevOps tools
Decreases developer burden and provides feedback loop for quick security remediation
Accelerates time to market and reduces costs with DevSecOps‑automated security

NGINX App Protect was previously known as NGINX WAF, NGINX Web Application Firewall.