Ferron

A modern open-source web server with automatic TLS, readable configuration, and built-in

Ferron is a web server written in Rust, distributed as a single static binary. It handles static file serving, reverse proxying with load balancing and circuit breaking, PHP and CGI hosting, and automatic TLS certificate issuance and renewal, while supporting HTTP/1.1, HTTP/2 and HTTP/3. Configuration is validated before deployment, with a doctor command that flags syntax issues and best-practice warnings.

Observability is built in: every request carries a trace ID shared across access and application logs, with OTLP tracing export and a Prometheus metrics endpoint. An admin API exposes live configuration and runtime status, and reloads can be triggered over HTTP without dropping connections. Routing supports conditional matchers, rewrites, and canary traffic splitting, alongside compression, caching, rate limiting, and mTLS.

Ferron targets infrastructure engineers and operators running production servers. It is open source and available as prebuilt packages and images for Linux, Windows, macOS, FreeBSD, and Docker across multiple architectures, with no paid editions or usage-based pricing indicated.

12 alternatives to Ferron

Ranked by how well each tool replaces Ferron: shared features, audience, price and popularity.

Laravel
Simple server management for PHP and beyond.
Covers 0 of 15 key features.
61 out of 100 match$12/mo
Caddy
The Ultimate Server with Automatic HTTPS
Covers 0 of 15 key features.
Free planOpen source
60 out of 100 matchFree
Froxlor
Lightweight server management software for your needs.
Covers 0 of 15 key features.
Open source
59 out of 100 match—
lighttpd
A secure, fast, compliant, and flexible web server for high-performance environments.
Covers 0 of 15 key features.
Open source
59 out of 100 match—
FrankenPHP
The Modern PHP App Server, written in Go
Covers 0 of 15 key features.
57 out of 100 match—
Coolify
Self-hosting platform for deploying apps, databases and services to your own servers.
Covers 0 of 15 key features.
Free planOpen source
57 out of 100 match$5/mo
Abyss Web Server
A compact web server for hosting websites on your own computer, with HTTP/2, SSL/TLS, and
Covers 0 of 15 key features.
Free plan
56 out of 100 matchContact sales
Sentora
Hosting control panel for Linux servers, maintained by the community.
Covers 0 of 15 key features.
Free planOpen source
56 out of 100 matchFree
fortrabbit
Managed PHP-first cloud hosting with Git deploys, SSH access, managed MySQL, SSL and pay-0
Covers 0 of 15 key features.
55 out of 100 match$1/mo
Calagopus
Modern. Fast. Secure.
Covers 0 of 15 key features.
Free planOpen source
54 out of 100 matchContact sales
Algernon
Web server with built-in support for QUIC, HTTP/2, Lua, Teal, Markdown, Pongo2, and Hyper.
Covers 0 of 15 key features.
Open source
54 out of 100 match—
Static Web Server
Static content delivery with speed and reliability.
Covers 0 of 15 key features.
Open source
54 out of 100 match—

Key facts

Starts at: Free
Free plan: Yes
Free trial: No
Open source: Yes

What it does

Automatic tls with acme issuance and renewal on demand issuance local ca and mtls
Http 1 1 http 2 h2c and http 3 enabled by default
Static file serving with index files directory listings and precompressed zstd brotli gzip sidecars
Reverse proxy and load balancing with random round robin least conn p2c ewma strategies
Circuit breaking active health checks and retry budgets
Dns srv and multi ip upstream discovery
Php via fastcgi cgi and scgi support forward proxy mode
Routing and rewriting with composable conditional matchers rewrites redirects variables canary traffic splitting
Compression gzip brotli deflate zstd and file edge caching including lscache compatible wordpress acceleration
Access control basic auth forwarded auth rate limiting automatic abuse bans security headers mtls
Trace ids on every request following w3c trace context standard
Correlated structured logs in json or text linked by trace id
Otlp native tracing export to jaeger tempo or any otlp collector
Prometheus metrics scrape endpoint with ready made grafana dashboards statsd output available
Cli with run validate adapt daemon commands and verbose debug logging ferron doctor for best practice warnings ferron validate for syntax structure checks ferron adapt for json conversion sighup and post reload for reloads get status and runtime endpoints for runtime inspection admin api serving live config http triggered reloads supervisor friendly health checks file plus memory certificate storage surviving restarts snippets includes named matchers for reusable config compact conf block syntax json config for automation reload without dropping connections config validation before deploy per host access logs single grep debugging w3c traceparent and baggage propagation trace id echoed in responses statsd output io uring with epoll fallback on linux multithreaded async runtime no thread per connection overhead no artificial keep alive limits no worker count or connection pool tuning required low memory usage high concurrency handling replace the binary upgrades systemd docker bare metal friendly single static binary memory safe rust construction no significant c dependencies in hot path safe concurrency without data races tls 1 2 1 3 with safe defaults automatic ocsp stapling with caching session ticket key rotation http 01 tls alpn 01 dns 01 challenges lazy first connection certificate issuance scaling to thousands of domains manual certificates and keys local ca for internal networks http to https redirects on by default canary traffic splitting lscache compatible wordpress acceleration rate limiting and automatic abuse bans security headers forwarded auth basic auth statsd output prometheus scrape endpoint grafana dashboards for traffic backends tls otlp export built in works with any otlp collector json and text log formats per host access logs single grep debugging w3c traceparent and baggage propagation trace id echoed in responses and logs config as data via ferron adapt to json live config via admin api status and runtime endpoints proxy upstream health visibility http triggered reloads supervisor friendly health checks file plus memory certificate storage snippets and file includes reusable conditional matchers ferron validate for syntax and structure ferron doctor for best practices sighup and post reload get status and runtime endpoints compact block syntax conf json config for automation host blocks with plain directives automatic certificates acme issuance and renewal let s encrypt and any acme ca http 01 tls alpn 01 dns 01 challenges automatic renewal before expiry on demand issuance lazy first connection issuance scales to thousands of domains bring your own trust manual certificates and keys local ca for internal networks mtls client authentication hardened transport tls 1 2 and 1 3 with safe defaults automatic ocsp stapling with caching session ticket key rotation modern protocols by default http 1 1 http 2 h2c http 3 quic throughput with published benchmarks static file serving index files and directory listings precompressed zstd brotli gzip sidecars reverse proxy and load balancing random round robin least conn p2c ewma strategies circuit breaking and active health checks retry budgets against cascading failures dns srv and multi ip upstream discovery php cgi forward proxy php fpm via fastcgi cgi and scgi support forward proxy mode routing and rewriting composable conditional matchers rewrites redirects variables canary traffic splitting compression and caching gzip brotli deflate zstd file and edge caching lscache compatible wordpress acceleration access control and abuse defense basic auth and forwarded auth rate limiting and automatic abuse bans security headers and mtls trace ids on every request w3c traceparent and baggage propagation trace id echoed in responses and logs correlated structured logs json and text formats per host access logs single grep debugging otlp native tracing otlp export built in works with any otlp collector prometheus metrics and dashboards prometheus scrape endpoint ready made grafana dashboards statsd output also available cli that helps run validate adapt daemon verbose debug logging config as data ferron adapt to json live config via admin api runtime inspection status and runtime endpoints proxy upstream health visibility automation ready http triggered reloads supervisor friendly health checks file plus memory certificate storage one binary safe defaults memory safe by construction no significant c dependencies in the hot path safe concurrency without data races single static binary systemd docker bare metal friendly replace the binary upgrades async runtime tuned by default io uring with epoll fallback predictable under high concurrency optional io uring with epoll fallback runs where you run linux windows macos freebsd docker x86 64 arm64 armv7 risc v s390x powerpc configuration is a feature readable config files host blocks with plain directives compact block syntax conf json config for automation reuse don t repeat snippets and file includes reusable conditional matchers validate before you deploy ferron validate for syntax and structure ferron doctor for best practices reload without downtime sighup and post reload get status and runtime endpoints tls that renews itself automatic certificates acme issuance and renewal let s encrypt and any acme ca http 01 tls alpn 01 dns 01 challenges automatic renewal before expiry on demand issuance lazy first connection issuance scales to thousands of domains bring your own trust manual certificates and keys local ca for internal networks mtls client authentication hardened transport tls 1 2 and 1 3 with safe defaults automatic ocsp stapling with caching session ticket key rotation serve proxy and run apps modern protocols by default http 1 1 http 2 h2c http 3 quic throughput with published benchmarks static file serving index files and directory listings precompressed zstd brotli gzip sidecars reverse proxy and load balancing random round robin least conn p2c ewma strategies circuit breaking and active health checks retry budgets against cascading failures dns srv and multi ip upstream discovery php cgi forward proxy php fpm via fastcgi cgi and scgi support forward proxy mode routing and rewriting composable conditional matchers rewrites redirects variables canary traffic splitting compression and caching gzip brotli deflate zstd file and edge caching lscache compatible wordpress acceleration access control and abuse defense basic auth and forwarded auth rate limiting and automatic abuse bans security headers and mtls built for production debugging trace ids on every request w3c traceparent and baggage propagation trace id echoed in responses and logs correlated structured logs json and text formats per host access logs single grep debugging otlp native tracing otlp export built in works with any otlp collector prometheus metrics and dashboards prometheus scrape endpoint ready made grafana dashboards statsd output also available friendly to operators and automation a cli that helps run validate adapt daemon verbose debug logging config as data ferron adapt to json live config via admin api runtime inspection status and runtime endpoints proxy upstream health visibility automation ready http triggered reloads supervisor friendly health checks file plus memory certificate storage

Information is collected from ferron.sh and public sources. Spotted something wrong? Tell us