Load balancers are systems that sit in front of a group of servers and spread incoming requests across them, so that no single server is overloaded and the app keeps running if one server fails. A load balancer is also called an application delivery controller. Today most load balancers also protect the app from attacks.
A popular website or app does not run on one computer. It runs on many identical servers, and any of them can answer any request. Users reach a single address. The load balancer holds that address. It receives each request and decides which server should answer it.
Consider a train booking website at 10 a.m., when Tatkal booking for air-conditioned classes opens. Tatkal tickets are a quota of seats released one day before the journey, and they sell out within minutes. Say that in the first minute, about 1 lakh people try to log in, and the website runs on 40 servers. The load balancer sends each new request to the server with the fewest open connections at that moment. This rule is called least connections.
Every 5 seconds, the load balancer also sends each server a small test request. This is called a health check. At 10:01 a.m., server 17 stops replying. After three failed checks, the load balancer stops sending it new requests. The other 39 servers share the load, and no user sees an error page because of server 17. When it recovers, the load balancer adds it back. Keeping spare servers ready in this way is an example of redundancy.
The load balancer also handles encryption. A secure web connection is encrypted with the help of a certificate, a file that proves the website is genuine. Decrypting lakhs of connections would take a large share of the servers' computing power. So the load balancer decrypts each connection once, and passes the plain requests to the servers inside the data centre. Its certificates must be renewed before they expire, a job for certificate lifecycle management.
Every request passes through the load balancer, so it is a natural place to check for attacks. Many load balancers now include a web application firewall (WAF), which checks each request for attacks such as SQL injection. With DDoS protection, they also absorb floods of fake traffic. And they check requests to the app's APIs, the fixed formats in which other programs ask the app for data, with API security.
How do users reach the load balancer? When a user types the website's name, DNS returns the load balancer's address, not a server's address. A load balancer can be a hardware box in the data centre, connected to the data centre switches, or software running in the cloud.