---
title: Features
description: Super is evolving day by day, and new features are being added all the time.
---
> ## Documentation Index
> Fetch the complete documentation index at: https://docs.page/luizfonseca/super/llms.txt
> Use this file to discover all available pages before exploring further.

Super is evolving day by day, and new features are being added with scalability in mind. Below is a list of the features that are currently available in Super:

- [x] **HTTPS**: SSL termination, automatic redirect from HTTP and certificate renewal (Let's Encrypt)
- [x] **DNS challenges** (Cloudflare) for wildcard certificates and hosts Let's Encrypt can't reach
- [x] **Plain HTTP** hosts (`tls = false`), for running behind another load balancer or on an IP address
- [x] **Hosts and locations**: the most specific location of a host serves each request (static paths, parameters and wildcards)
- [x] **Path rewriting** per location: strip or add a prefix to the path sent to upstreams
- [x] **Catch-all host** (`host "*"`) for names without a host of their own
- [x] **Wildcard hosts** (`host "*.example.com"`) for every name one label under theirs
- [x] **Listen addresses per host**: Super only opens the ports its hosts need
- [x] **Docker**: Swarm/Compose Label Support
- [x] **Load Balancing** (✅ Round Robin, ✅ Weighted Round Robin, ✅ Least Connections), and retries on another upstream
- [x] **Traffic splits** per location: canaries and A/B tests, sticky by cookie or address, chosen by rules too
- [x] **Request mirroring** per location: copies of a share of the requests, or the ones rules choose, sent to other upstreams in the background
- [X] Health Checks
- [x] **Upstream names** (`app:8080`) resolved again as their addresses change, following recreated containers
- [x] **Shared store** (Redis, SQLite, Postgres) to run many Super servers with the same routes and certificates
- [x] **Auto reload** of the configuration file: hosts applied live, other settings through an [upgrade](/configuration/upgrades) that keeps connections open (Linux)
- [x] **HCL functions** Extensible through configuration with `env` and `import`
- [x] Header manipulation for DOWNSTREAM & UPSTREAM (add/replace, remove)
- [x] **Caching** in memory or on disk
- [X] **Basic** Authentication
- [X] **OAuth2** Authentication (GitHub and WorkOS)
- [x] **JWT** authentication: tokens checked with a secret, a public key or the issuer's JWKS, claims sent as headers
- [x] **Forward auth** to an auth service (Authelia, Authentik, oauth2-proxy)
- [X] **RequestId** Middleware
- [x] **IP filtering** per location (`allow` and `deny` lists of addresses and networks)
- [x] **CORS** per location: preflights answered, exact, subdomain or any origins
- [x] **Rate limiting** per location and client
- [x] **Body limits** per location
- [x] **Compression** of responses (zstd, brotli, gzip)
- [x] **Redirects and fixed responses** per location (maintenance pages, `www` to apex)
- [x] **Static files** per location: single-page apps, ranges, `304`s, nothing outside the directory
- [x] **TCP** proxying: plain, TLS with the host's certificate (chosen by SNI) and TLS passthrough
- [x] Sharing port `443` between HTTPS and TCP, chosen by name (SNI) or protocol (ALPN), with TLS terminated or passed through
- [x] **Kubernetes** ingress controller: `Ingress` resources served with their ready pods as upstreams, TLS secrets, plugins through annotations, status and events, with a Helm chart
- [x] **Metrics** in the Prometheus format, per host, location and upstream, on an admin listener with a token
- [x] **Admin API**: live stats (requests per second, latency percentiles), hosts, certificates, and routes written to the store
- [x] **Notifications** to webhooks (JSON, Slack, Discord) when upstreams go down, certificates fail or expire, the configuration or the store changes (see [notifications](/configuration/notify))
- [x] **Certificate files** reloaded when they change, served with their whole chain
- [x] **Forwarded headers** (`X-Forwarded-For`, `-Proto`, `-Host`, `X-Real-IP`), and clients found behind trusted proxies
- [x] **Rules**: conditions on the method, host, path, query, headers, cookies or client (`and`, `or`, `not`), and what to do when they hold, in the server, a host or a location (see [rules](/rules))
- [x] **Timeouts** toward clients and upstreams, and a graceful stop that waits for open connections

## Planned

- [ ] Gateway API resources for Kubernetes
- [ ] WASM plugin interfaces
- [ ] AI gateway routes
- [ ] Many more

We are constantly adding new features, and we welcome your feedback and contributions. If you have any suggestions or ideas, please feel free to open an issue or a pull request on the GitHub repository.