

Find out in this report how the two Web Application Firewall (WAF) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
Operational efficiency has improved; we no longer have staff consistently monitoring backend servers during deployment or scaling events, as HAProxy's health checks and hitless reloads allow us to push changes with minimal manual intervention.
This resulted in a drastic decrease in costs and, at the same time, the accuracy of the hits coming on HAProxy was almost around 100% or 99.99%.
I estimate seeing a return on investment with HAProxy, as it significantly reduced staff requirements and enhanced scaling capabilities, particularly when transitioning from NGINX, which faced issues.
Their support is truly exceptional when I compare it with similar large-sized companies.
The expertise of engineers varies across different time zones, affecting the effectiveness of the support provided, especially during our daytime.
The back-end development team is available, and if any issue arises, they will help us immediately by providing solutions when contacted.
Since we are utilizing the open-source edition, community forums, mailing lists, and GitHub have been invaluable, with typically someone having encountered the same problems we faced.
My interactions with HAProxy's customer support were limited, but the feedback from my team indicated satisfactory service.
You can add additional boxes that combine together to achieve a bigger throughput for investigation and research.
We manage an automatic load balancing feature where we add HAProxy servers dynamically behind the application load balancer to handle more traffic.
HAProxy's scalability is excellent; as our traffic expands, it handles load increases effortlessly.
For scalability, HAProxy meets my needs, supporting our initial horizontal scaling and then adapting to vertical scaling in a VMware environment.
We have not faced any significant issues during deployments.
This reliability serves as a key reason for our choice, providing us with confidence even when faced with heavy traffic.
The hot reload feature of HAProxy also really helped us so that we never had to shut it down to reload it.
We have reduced a lot of servers, replacing them with one or two HAProxy servers which deliver better performance, accuracy, and an almost 100% success rate with requests.
If the GUI includes notifications and improved logging capabilities that allow us to see traffic and store logs for six months, that would be very helpful.
Fine-tuning is a room for improvement in Fortinet FortiWeb.
After the customer submits a specific question and requests troubleshooting help from Fortinet support, it takes at least three to five days to provide a proper answer.
The configuration syntax is powerful yet can become overwhelming for newcomers; a more beginner-friendly interface or a native GUI without relying on third-party tools would ease the onboarding process.
An easier desktop interface to connect to a remote server and make changes on my PC would be beneficial.
The reloading functionality is effective as it allows soft reloads without interrupting traffic patterns.
For VM machines, the price increases based on CPU configurations of 2, 4, or 8 CPUs.
Most security products charge less at the time of purchase because of competition, but when we go to renewals, the prices become very high.
Fortinet FortiWeb is cost-effective compared to solutions like F5.
Since we use the open-source edition, there are no licensing fees, with the main cost being the infrastructure running on EC2 instances in AWS, which helps maintain low expenses.
Setting up HAProxy didn't cost anything for me.
The pricing remains competitive compared to other vendors.
Fortinet FortiWeb has positively impacted my organization because most of our servers and applications are secure from hackers and other security threats.
Fortinet's pricing is way more competitive than Cisco or Palo Alto.
The machine learning-based threat detection is significant, as it uses a learning method that eases the configuration burden, making it very useful.
By moving all SSL termination to the load balancer, I now manage certificates in a single place, and I can also utilize Let's Encrypt with HAProxy's built-in ACME support, making renewal automatic.
HAProxy positively impacted our organization by exceeding scalability expectations, initially projected at 200k requests but ultimately handling over 15 million transactions per second without any issues.
As a production engineer at that time, I definitely wanted to ensure that the system could handle massive connections, especially since we operated an e-commerce platform where we could not lose any customer calls.
| Product | Mindshare (%) |
|---|---|
| Fortinet FortiWeb | 4.1% |
| HAProxy | 1.9% |
| Other | 94.0% |

| Company Size | Count |
|---|---|
| Small Business | 61 |
| Midsize Enterprise | 27 |
| Large Enterprise | 37 |
| Company Size | Count |
|---|---|
| Small Business | 18 |
| Midsize Enterprise | 15 |
| Large Enterprise | 16 |
Fortinet FortiWeb provides advanced web application protection, using AI-driven threat detection and seamless integration with Fortinet products, ensuring robust security and easy management. It's favored for its scalability in protecting websites, mobile apps, and APIs from threats like SQL injection.
Fortinet FortiWeb offers robust web application security with features like machine learning-driven threat detection, load balancing, and OWASP protection. Its comprehensive security measures include web traffic filtering and DDoS protection, making it ideal for securing APIs and web servers. Cost-effectiveness and easy deployment further enhance its appeal as it serves banking, e-commerce, and industrial sectors. Areas needing enhancement include load balancing capabilities, comprehensive documentation, and improved support response times, addressing user-reported issues such as false positives and integration challenges. Documentation for cloud deployment is crucial for enhanced logging and performance stability.
What are Fortinet FortiWeb's Key Features?Companies across banking, e-commerce, and financial sectors implement Fortinet FortiWeb for its comprehensive security features in protecting web applications from SQL injection and cross-site scripting. Its use as a web application firewall provides essential protection and load-balancing capabilities, ensuring compliance with standards like PCI DSS in cloud environments and industrial settings.
HAProxy delivers reliability, high performance, and efficient load balancing solutions. Its open-source model ensures cost-effectiveness and scalability, ideal for managing extensive infrastructure demands with minimal latency while offering seamless integration with modern platforms.
HAProxy is renowned for its robust performance in load balancing across TCP and HTTP protocols, featuring multiple algorithms such as round-robin. Users appreciate its customizable configuration and seamless SSL termination, which make it an excellent choice for managing complex infrastructures. The platform's open-source nature supports scalability, reducing costs while providing flexible proxy operations. HAProxy efficiently handles high concurrency, enabling smooth traffic management and ensuring stability within diverse systems.
What key features does HAProxy offer?HAProxy is extensively used in load balancing implementations across various sectors. Companies deploy it for managing high traffic, Layer 4 and Layer 7 applications, and SQL databases. It supports microservices architecture, performs SSL offloading, and manages email services like SMTP. As a reverse proxy, HAProxy delivers high availability for systems like Redis, RabbitMQ, and Apache while integrating with Docker and Kubernetes. Its features enhance web application firewall capabilities and traffic routing, making it suitable for industries demanding reliable and efficient network management.
We monitor all Web Application Firewall (WAF) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.