Optimise performance and availability with intelligent traffic management.
One server is a single point of failure. Our managed load balancer spreads application traffic across
multiple origins, terminates SSL, probes every backend continuously and fails over in under a second, so a traffic spike or a dead node never becomes an outage. Layer 4 and Layer 7, on any origin you own.
Most platforms end up using more than one. A single balancer handles all three, configured per service.
Multi-Region & Global Balancing
Steer visitors to the closest healthy region automatically. Traffic is routed on live latency and origin health rather than a static DNS record, so a regional outage reroutes in seconds instead of waiting out a TTL.
Layer 7 balancing for HTTP, HTTPS and HTTP/2 with SSL/TLS termination, keep-alive reuse and compression handled at the balancer. Your origins stop spending CPU on handshakes and start spending it on requests.
Raw TCP and UDP balancing for everything that is not a web app, game servers, mail, databases, message queues, custom protocols. Full transparency, connection multiplexing and high throughput.
A load balancer is only useful if you trust what it does when something breaks. Here is the whole path,
including the part that matters most, the failure case.
1
DNS resolves to your balancer
Your domain points at the load balancer instead of a single server, so no visitor ever holds the IP address of an individual origin.
2
Traffic is inspected and terminated
TLS is terminated at the balancer. For Layer 7 services the request line, host and headers are read so routing decisions can be made on real content, not just an IP tuple.
3
An origin is chosen
Round-robin, least-connections, weighted or IP-hash, whichever fits. Sticky sessions keep a returning visitor on the origin that already holds their session state.
4
Health checks run continuously
Every origin is probed on an interval. A failing origin is pulled from rotation before a real visitor ever lands on it.
5
Failover happens without you
When an origin misses its checks, traffic shifts to the healthy pool in under a second. When it recovers, it is eased back in with slow-start rather than being hit at full load.
Layer 4 vs Layer 7
Which layer should you balance on?
Both are included on every plan. This is the practical difference.
Comparison of Layer 4 and Layer 7 load balancing
Layer 4 (TCP/UDP)
Layer 7 (HTTP/S)
What it balances on
IP address and TCP/UDP port
URL path, hostname, headers, cookies, method
Protocols
Any TCP or UDP service
HTTP, HTTPS, HTTP/2, WebSocket
TLS handling
Passthrough to the origin
Terminated at the balancer, optional re-encrypt
Sticky sessions
Source-IP hash
Cookie-based, survives a changing client IP
Content-based routing
Not possible
/api to one pool, /static to another
Overhead
Lowest, packets are forwarded
Slightly higher, requests are parsed
Typical use
Game servers, databases, mail, SMTP
Websites, storefronts, REST and GraphQL APIs
Balancing a web app or API? Layer 7. Balancing anything else? Layer 4. Running both? Configure both on one balancer.
For application-layer DDoS protection and WAF, add Shield in front.
Features & benefits
Everything managed, nothing to configure
You register your origins and point your domain. We own the rest, algorithm, probes, certificates, capacity and the 3am failover.
Health Checks
Configurable HTTP, TCP or custom probes on every origin, with tunable intervals and thresholds so a slow origin is caught before a visitor notices it.
Global Anycast Network
A 120+ PoP anycast footprint across four continents puts the balancing decision close to the visitor rather than close to your servers.
SSL/TLS Termination
Free certificates issued and renewed automatically at the balancer, with optional re-encryption to the origin for end-to-end encryption.
No Latency Penalty
Connection reuse and keep-alive pooling to your origins mean the balancer usually removes more latency than it adds.
Real-Time Monitoring
Live per-origin traffic, connection counts, response times and health state, plus alerting when a pool degrades.
24/7 Operations
Real engineers on call. Failover is automatic, but when something needs a human, there is one.
Pricing
Pricing overview
Every plan is fully managed and includes both Layer 4 and Layer 7 balancing, SSL termination, health checks and DDoS protection.
It sits in front of your servers and distributes incoming traffic across them. Instead of one server handling every request, and taking your site down when it fails or saturates, the balancer spreads the load across a pool and continuously checks that each member is healthy. If one stops responding it is removed from rotation automatically, so visitors keep being served by the rest.
Layer 4 balances on the network tuple, IP address and TCP or UDP port, and simply forwards packets, which makes it fast, protocol-agnostic and ideal for game servers, databases or mail. Layer 7 reads the actual HTTP request, so it can route on hostname, URL path, headers or cookies, terminate TLS, and keep a user pinned to one origin with a cookie. Every TOSHOST plan includes both; you choose per service.
Not for distributing load, but often yes for availability. With a single origin there is nothing to fail over to. The usual first step is two smaller servers behind an LB Starter rather than one large server: the same total capacity, but a failed node becomes a non-event instead of an outage.
Yes. We provision, configure, tune and monitor the balancer. You point your domain at it and register your origins; we handle the balancing algorithm, health-check tuning, TLS certificates, failover behaviour and capacity. There is no HAProxy or nginx config for you to maintain.
It terminates SSL/TLS at the balancer with free, automatically renewed certificates, so your origins do not have to. If your compliance posture requires encryption all the way to the origin, we re-encrypt on the back half of the connection, you keep end-to-end TLS and still get the CPU saving of pooled handshakes.
Sub-second once an origin misses its health-check threshold. The interval and threshold are both tunable: an aggressive setting catches failures faster, a relaxed one avoids pulling an origin out over a single slow response. We tune it with you rather than shipping one default.
Yes. Origins can be TOSHOST VPS or dedicated servers, machines in your own data centre, or instances at another cloud provider. A common use is balancing across two providers deliberately, so no single vendor outage can take you offline.
Yes, when you need it to. Sticky sessions pin a visitor to the origin holding their session, by cookie on Layer 7, which survives a changing client IP, or by source-IP hash on Layer 4. The better long-term fix is shared session storage, and we will help you move to it, but sticky sessions make an existing app work today.
Yes. The balancer sits behind always-on mitigation, so volumetric floods are absorbed at the edge before they reach it. For application-layer attacks, credential stuffing and bot abuse, see our dedicated DDoS protection product, which adds a full Layer 7 WAF, TLS fingerprinting and challenge.
LB Enterprise removes the origin limit and adds active-active multi-region balancing, geo and latency-based steering, dedicated throughput, custom routing rules and a contractual SLA with credits. It is quoted rather than listed because the shape genuinely differs per platform, talk to us and we will size it.
Stop betting your uptime on one server
Add a second origin, put a managed balancer in front, and a failed node becomes something you read about
in a report instead of hearing about from customers.