Cybersecurity glossary
What is a Load Balancer?
Learn what a load balancer is, how it distributes traffic across healthy servers, how L4 and L7 balancing differ, and which security and reliability settings matter.
Definition
A load balancer is a networking component that distributes incoming traffic across multiple backend servers or services to improve availability, scalability, and performance—usually using health checks and routing algorithms.
Why load balancers matter
One server is a single point of failure and a capacity ceiling. As traffic grows, teams run multiple instances—but clients still need one stable address.
A load balancer sits in front of those instances, spreading work and removing unhealthy targets from rotation. It is foundational for high availability in web apps, APIs, and microservices.
How load balancing works
Clients connect to a virtual address
A DNS name or VIP points at the load balancer, not at individual instance IPs.
Balancer selects a healthy target
Algorithms consider weights, connection counts, hashes, or HTTP route rules.
Health checks continuously probe backends
Failed checks take instances out of the pool before users pile onto a dead node.
Optional TLS and policy apply
Certificates, WAF rules, header rewrites, and auth may run at L7 balancers.
Request is forwarded to an instance
The backend handles application logic and returns a response through the balancer.
Pools change during deploys
Instances drain, join, or scale so releases happen without hard downtime.
L4 vs L7 balancing
| Aspect | Layer 4 | Layer 7 |
|---|---|---|
| Decision data | IP, port, TCP/UDP connection | HTTP host, path, headers, cookies, methods |
| Performance profile | Very fast, lower inspection cost | More flexible, more CPU per request |
| Typical use | Raw TCP services, extreme throughput | Web apps, APIs, canary path routing |
| TLS visibility | Often pass-through or limited | Commonly terminates TLS to read HTTP |
Capabilities beyond “spread the traffic”
Health-aware routing
Keep users off crashing instances and support zero-downtime deploys with connection draining.
Session affinity
Sticky sessions can help stateful apps, but they reduce evenness and complicate failure handling.
TLS and certificate centralization
Manage certs in one place while backends speak plain HTTP or re-encrypted TLS.
Blue/green and canaries
Shift a percentage of traffic to a new pool to reduce release risk.
Security considerations
Hide direct instance access
If attackers can hit backend IPs, they bypass balancer policies. Restrict security groups accordingly.
Encrypt to origin when needed
After TLS termination, the balancer-to-app hop may still cross untrusted networks.
Preserve client identity carefully
X-Forwarded-For must be trusted only from the balancer; clients must not spoof it.
Align timeouts
Idle and request timeouts that disagree with apps cause mysterious 502/504 failures.
Operational checklist
- Put all public traffic through the balancer; block direct internet access to instance nodes.
- Choose L4 vs L7 based on whether you need HTTP-aware routing.
- Configure health checks that reflect real readiness—not only process uptime.
- Use connection draining during deploys and scale-in events.
- Decide TLS termination vs pass-through deliberately; re-encrypt if the path is untrusted.
- Sanitize forwarded client IP headers and document the trusted hop count.
- Monitor target health, 5xx rates, latency, and saturation per pool.
- Load-test failover by intentionally failing an instance in staging.
The practical takeaway
A load balancer spreads traffic across healthy backends so applications scale and survive instance failure. L4 focuses on connections; L7 adds HTTP intelligence for modern web routing.
Treat the balancer as part of your security boundary: lock down backends, handle TLS intentionally, trust forwarded headers only from the balancer, and keep health checks honest.
Related security terms
Reverse Proxy
Many L7 load balancers are reverse proxies with distribution features.
Content Delivery Network (CDN)
Global edge distribution that often sits in front of regional load balancers.
Origin Server
The backend targets a load balancer typically spreads traffic across.
Microservices
Architectures that rely heavily on service-level load balancing.
Service Mesh
Client-side or sidecar load balancing for east-west service traffic.
Frequently asked questions
What is a load balancer in simple terms?
It is a traffic director that spreads requests across several servers so no single machine takes all the load, and so healthy servers can take over when one fails.
What is L4 vs L7 load balancing?
L4 balances based on IP/port and connection data. L7 understands HTTP and can route by host, path, headers, or cookies.
Is a load balancer the same as a CDN?
No. A CDN caches and serves from many global edges. A load balancer usually distributes traffic within a region or cluster to your application instances.
Do load balancers terminate TLS?
Often yes. TLS termination at the balancer simplifies certificates on backends but requires encrypting or carefully trusting the hop to origin.
What happens when a backend is unhealthy?
Failed health checks remove it from the pool until it recovers, so users are steered to remaining healthy instances.
Can load balancers stop DDoS?
They help with scale and some connection management, but large attacks usually need upstream DDoS/CDN protection as well.
What algorithms are common?
Round robin, least connections, IP hash/stickiness, and weighted targets are typical starting points.
References
Explore authoritative guidance and frameworks related to load balancer.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.