Web servers and proxies
Traefik and Caddy each have one supported release line. Traefik 2.11 reached end of life on Sep 7, 2026. Both are open source: Traefik under MIT, Caddy under Apache-2.0. OSV.dev lists 43 advisories from the last 12 months for Traefik and 16 for Caddy.
Last checked against deps.dev, endoflife.date, OSV.dev and CISA KEV.
Every value links to its source. Where a row doesn’t apply to one of them, the cell says why.
| Compared on |  Traefik |  Caddy |
|---|---|---|
| Support and releases | ||
| Supported release lines | ||
| Latest release | ||
| Releases in the last 12 months | ||
| Security | ||
| Advisories published in the last 12 months | ||
| OpenSSF Scorecard | ||
| Licence and hosting | ||
| Licence | ||
| How you run it | Self-hosted (a single binary or container) | Self-hosted (a single binary) |
| Adoption | ||
| GitHub stars | ||
| Traefik | Caddy |
|---|---|
| Supported release lines | |
| Latest release | |
| Releases in the last 12 months | |
| Traefik | Caddy |
|---|---|
| Advisories published in the last 12 months | |
| OpenSSF Scorecard | |
| Traefik | Caddy |
|---|---|
| Licence | |
| How you run it | |
Self-hosted (a single binary or container) | Self-hosted (a single binary) |
| Traefik | Caddy |
|---|---|
| GitHub stars | |
Read across for what matters to you. Each answer comes from the data above or the project’s licence and hosting options.
| If you need | Traefik | Caddy |
|---|---|---|
| An open-source licence | Yes: MIT | Yes: Apache-2.0 |
| Someone else runs it for you | No: You run it yourself | No: You run it yourself |
| You can run it on your own servers | Yes: Yes, it’s software you install | Yes: Yes, it’s software you install |
| A long support window | Only the newest line (3.7); no end dates published | Only the newest line (2); no end dates published |
| Traefik | Caddy |
|---|---|
| An open-source licence | |
Yes: MIT | Yes: Apache-2.0 |
| Someone else runs it for you | |
No: You run it yourself | No: You run it yourself |
| You can run it on your own servers | |
Yes: Yes, it’s software you install | Yes: Yes, it’s software you install |
| A long support window | |
Only the newest line (3.7); no end dates published | Only the newest line (2); no end dates published |
Modern HTTP reverse proxy and load balancer for microservices
Modern web server with automatic HTTPS
From StackPrism’s curated notes. Pricing isn’t covered here: it changes often, so check each vendor’s pricing page.
Both are reverse proxies written in Go with automatic HTTPS through ACME certificate authorities such as Let’s Encrypt. Traefik is built around discovering services from Docker and Kubernetes; Caddy is a general web server with a short config file that also serves static files.
Release lines and end-of-life dates come from endoflife.date, release counts from deps.dev’s publish dates, and advisories from OSV.dev, counted once per flaw even when it’s listed under several ids, and checked against CISA’s list of vulnerabilities known to be exploited. Status and incident history come from each vendor’s public status feed; licences from each project’s licence file or the vendor’s licensing page, linked in the table.
The data refreshes every few hours and the time it was checked is shown above. There’s no pricing and no overall winner: which one fits depends on your constraints. To see how the versions you actually run hold up, check your repo.
Paste a public GitHub repo and see what’s vulnerable, end of life or deprecated in it today. Free, no sign-up.