In the March 2023 survey we received responses from 1,116,018,952 sites across 269,281,081 domains and 12,106,182 web-facing computers. This reflects a loss of 11.6 million sites, 1.4 million domains, and 36,610 web-facing computers.

This month, for the first time, nginx overtook Apache within the top million busiest sites. nginx gained 1,447 sites, which increased its market share by 0.14pp to 21.37%, compared to Apache at 21.18% (-0.16pp). This allowed it to regain 2nd place, which it lost when Cloudflare overtook both to claim the top spot in January.

nginx was created by Igor Sysoev, with development starting in Spring 2002, and it first became publicly available in October 2004. It slowly gained popularity over the following years, largely due to its ability to handle a much large number of connections with a lower memory footprint compared to Apache. NGINX, Inc. was founded in 2011 to provide commercial support for nginx while maintaining the open source version. Igor left NGINX, Inc. at the start of 2022 after having worked on nginx for 20 years.

nginx first featured in the Web Server Survey in January 2008. When we started publishing our top million busiest sites metric in April 2009, nginx was already 3rd with a market share of 3.16% behind Microsoft (18.91%) and Apache (67.56%). It overtook Microsoft in May 2013 and remained in 2nd place until January this year. When looking at all the sites in the survey, not just the top million busiest sites, nginx overtook Apache to become the market leader in April 2019. It now has a market share of 25.94%, ahead of Apache (20.58%) and Cloudflare (10.17%).

Cloudflare made extensive use of nginx in its custom software stack for many years. However, it was slowly replaced by Cloudflare’s in-house technologies, reflected by it migrating its server banners from cloudflare-nginx to just cloudflare starting in December 2017, and it announced a complete replacement in-house HTTP proxy Pingora in September 2022.

Across the survey as a whole, Cloudflare saw a small loss of 296,120 sites (-0.26%), its first drop since April 2022. Despite this, its market share increased by 0.08pp to 10.17%. It saw a more significant loss of 1.1 million domains (-4.19%), reducing its market share for domains by 0.37pp to 9.58%.

LiteSpeed had the largest percentage growth in March: it grew by 814,945 sites (+1.39%) and 352,384 domains (+3.96%). It now has a market share of 5.33% sites and 3.43% domains, up by 0.13pp and 0.15pp respectively.

Apache suffered losses across the board this month, losing 1.4 million sites (-0.61%), 223,028 domains (-0.38%), and 32,965 web-facing computers (-1.00%). However, despite its losses, it now has a market share of 20.58% (+0.09pp) sites and 21.45% (+0.03pp) domains.

nginx also saw large losses in March, dropping by 6.2 million sites (-2.10%), 318,827 domains (-0.44%), and 7,456 web-facing computers (-0.16%). It now accounts for 25.94% of sites (-0.28pp) and 26.97% of domains (+0.03pp).

Similarly, OpenResty saw a significant loss of 6.6 million sites (-6.92%) and 237,667 domains (-0.61%). Its market share of sites dropped to 7.94% (-0.50pp), and its market share of domains dropped to 14.36% (-0.01pp).

Vendor news

• njs 0.7.10 and njs 0.7.11, the scripting language used to extend nginx, were released on 2nd February 2023 and 9th March 2023 with new features and bugfixes.
• Apache Tomcat versions 8.5.86, 9.0.72, 10.1.6, and 11.0.0-M3 were released in February, which contain bugfixes and documentation improvements.
• lighttpd 1.4.69 was released on 10th February 2023, including bugfixes and portability improvements.
• AWS announced that it is working on an AWS region in Malaysia.
• Azure announced a new planned datacenter region in Saudi Arabia (Saudi Arabia Central).

In the January 2023 survey we received responses from 1,132,268,801 sites across 270,967,923 unique domains, and 12,156,700 web-facing computers. This reflects a gain of 6,894,269 sites, but a loss of 270,799 domains and 77,725 computers.

Within the top million busiest sites, Cloudflare has jumped from 3rd to 1st place — overtaking both Apache and nginx in a single month — its market share increased by 0.56pp and now stands at 21.64%. Along with Apache (21.40%) and nginx (21.20%), the top three web servers power almost two-thirds of the top million busiest sites.

Cloudflare’s journey to the top of the million busiest sites metric began in the February 2021 Web Server Survey, when we started tracking it separately from nginx to reflect Cloudflare’s extensive use of in-house technologies. At the time of this split, Cloudflare was already the third most used within the top million busiest sites, having overtaken Microsoft in March 2019. In September 2022, Cloudflare announced its replacement of nginx with Pingora, a new in-house HTTP proxy.

Cloudflare was founded in 2009 and launched publicly in 2010. Its core service is a content delivery network which sits between end-users and websites, providing increased performance by caching content and using optimised routes across the Internet.

It grew quickly, with its core service available for free and with generous bandwidth limits. In 2014 it launched Universal SSL, providing free access to HTTPS for sites using Cloudflare. The company went public in 2019. It has mitigated some of the largest denial-of-service attacks ever observed on the Internet: most recently a 2.5 Tbps attack targeting a server for the video game Minecraft in 2022.

However, its growth has not been without controversies. Its content neutrality policy has been criticised, with it providing service to cybercriminals and sites containing hate speech and far-right content. In 2017 a buffer overflow in Cloudflare’s code caused private information from a small percentage of requests, such as authentication tokens, to be leaked.

In recent years, Cloudflare’s offering has expanded and it now competes with cloud computing giants Amazon Web Services, Google Cloud and Microsoft Azure in areas such as serverless computing, object storage and managed databases.

Cloudflare has also seen sustained growth in other metrics in January: across all sites, Cloudflare saw the largest growth, with an increase of 9.3 million sites (+9.07%) and 473,405 domains (+1.82%).

Google had the second largest growth amongst all sites, with a gain of 0.33 million sites (+0.63%), 37,483 domains (+1.46%). OpenResty saw a decrease of 419,469 sites (-0.45%) and 571,662 domains (-1.45%), but an increase of 8,608 computers (+4.83%).

nginx saw growth in sites and domains for the first time since August 2022, with an increase of 311,521 sites (+0.11%) and 527,542 domains (+0.79%), but still lost 23,344 computers (-0.49%). Apache saw a decrease across all metrics, losing 1.9 million sites (-0.81%), 900,956 domains (-1.52%) and 51,758 computers (-1.53%).

Vendor News

• Apache Tomcat versions 9.0.70 and 10.1.4 were released in December, which contain bugfixes and documentation improvements.
• LiteSpeed Web Server 6.1 was released on 9th January 2023. The LiteSpeed Web Server 6.1 stream introduces support for the PROXY protocol. This is the first stable release for this version stream; it includes various improvements and fixes since the previous release candidate.
• lighttpd 1.4.68 was released on 3rd January 2022, including strengthened defaults for TLS, various bugfixes and removal of some deprecated features.
• nginx 1.23.3 was released on 13th December 2022, containing bugfixes.
• Oracle opened a new cloud region in Chicago on 15th December 2022.

In the November 2022 survey we received responses from 1,135,089,912 sites across 271,689,143 domains and 12,306,625 web-facing computers. This reflects a gain of 4.7 million sites, a loss of 194,480 domains, and a gain of 6,685 web-facing computers.

The biggest growth this month comes from Cloudflare, with it gaining 8.3 million sites (+8.91%) and 490,000 domains (+1.94%). Cloudflare now accounts for 8.93% of all sites seen by Netcraft, up by 0.70pp since October.

nginx saw significant losses in its number of sites and domains this month. It lost 8.5 million sites (-2.75%) and 490,000 domains (-0.66%). However, nginx still holds its strong lead as the most widely used web server software, with a market share of 26.51% sites. Apache has the second largest number of sites, with a market share of 21.40%.

LiteSpeed continues its strong growth — this month it gained 720,000 sites (+1.28%) and 110,000 domains (+1.32%). This brings its market share of sites from 4.97% to 5.01% (+0.04pp).

Following its web-wide trend, Cloudflare has also seen growth in the top million sites. Since October, it gained 1,733 of the top million sites, with its market share increasing from 20.83% to 21.00% (+0.17pp). Meanwhile, both Apache and nginx have lost market share in the top million sites, with Apache down from 21.72% to 21.66% (-0.06pp) and nginx down from 21.36% to 21.21% (-0.15pp).

Vendor news

• nginx 1.23.2 was released on 19th October 2022. This version fixes memory corruption and disclosure vulnerabilities in ngx_http_mp4_module.
• njs 0.7.8, the scripting language used to extend nginx, was released on 25th October 2022, adding many language features and bug fixes.
• Apache Tomcat versions 8.5.83, 9.0.68, 10.0.27, and 10.1.1 were released on 3rd October 2022. Most of the changes are bugfixes.
• Cloudflare announced early access for Privacy Gateway, a proxy allowing HTTP traffic to be securely encapsulated. It is based on the Oblivious HTTP IETF draft.
• AWS announced two new Local Zones: Hamburg, Germany and Warsaw, Poland. These are the first locations in Europe, and add to the now 20 generally available Local Zones.

In the September 2022 survey we received responses from 1,129,251,133 sites across 271,625,260 unique domains, and 12,252,171 web-facing computers. This month all three metrics have decreased since August, with a loss of 5.82 million sites, 115,512 unique domains and 113,356 web-facing computers.

nginx had the largest increase in web-facing computers, gaining 28,887 (+0.56%) this month. OpenResty had the second largest increase, gaining 6,008 (+3.54%) web-facing computers, along with a gain of 339,813 (+0.86%) domains and 149,893 (+2.35%) active sites. Google showed strong growth in all metrics, with an increase of 5,127 web-facing computers, 211,135 (+8.83%) domains, and 895,225 (+4.71%) active sites.

Within the top million busiest sites, Apache lost 0.21pp of its market share. Despite this, it continues to be the most commonly used web server in the top million. nginx also continued its long-term downward trend, but lost only 0.14pp, further closing the gap between Apache and nginx. The gap now stands at 4,499 sites, a decrease of 13.8% since last month. Meanwhile, Cloudflare’s growth continues, with its market share in the top million increasing by 0.25pp.

Apache also experienced a loss in overall market share, losing 414,684 (-0.94%) active sites and 18,156 computers (-0.49%). The only other developers to lose active sites were Microsoft and nginx, with losses of 58,443 (-1.01%) and (-0.10%) respectively.

LiteSpeed’s market share continues to increase at a steady rate, with it gaining 92,704 (+1.14%) domains and 70,146 (+0.73%) active sites this month.

Vendor news

• njs 0.7.7, the scripting language used to extend nginx, was released on 30 August 2022, with new features and bug fixes.
• Lighttpd 1.4.67 was released, with a variety of bug fixes.
• Amazon AWS opened a new region in the United Arab Emirates. This is the second AWS region in the Middle East, joining the existing region in Bahrain.
• Microsoft’s Windows Server 2022 is now generally available.
• Cloudflare published an article about the development of its purpose built HTTP Proxy, Pingora.

In the July 2022 survey we received responses from 1,139,467,659 sites across 271,728,559 unique domains and 12,341,172 web-facing computers. This reflects a loss of 7.5 million sites and 1.3 million domains, but a gain of 116,386 computers.

Cloudflare continues its trend of strong growth across the sites and domains metrics this month, increasing by 5.8 million (8.6%) and 259,000 (1.24%), around double that of last month. This gives Cloudflare a total market share of 6.4% share of sites and 8.6% domains, increases of 0.5pp and 0.1pp compared to June.

Whilst still being the most popular vendor across the sites, domains and web-facing computers metric, nginx takes a loss of 4.99 million sites (1.43%), 775,000 domains (1.02%) and 3,400 computers (0.1%) this month. Apache also saw losses, dropping by 1.28 million sites (0.49%) and 379,000 domains (0.61%), however experienced the largest gain in web-facing computers of almost 22,000 (0.6%).

Apache continues to hold on to the top spot in the market share of the top million busiest sites with 22.33%, with nginx in close second at 21.55%. Both however have seen decreases in market share of 0.22pp and 0.1pp respectively, with Cloudflare increasing by 0.08pp to 20.26%. If this trend continues, we should expect to see Cloudflare overtake its rivals within the next year.

OpenResty saw its most significant change over the last 4 months with a decrease of 2.9 million sites (3.21%) and 354,000 domains (0.87%). Conversely, it experienced a significant gain of 17,700 web-facing computers (12.0%).

Lightspeed saw strong growth this month with an increase of 745,000 sites (1.4%), 88,000 domains (1.1%) and 4,500 computers (3.3%).

Vendor News

• nginx 1.23.1 was released on 19 Jul 2022 containing bug fixes, and most notably a memory usage optimization for setups using SSL proxying.
• njs 0.7.8, the scripting language used to extend nginx was also released on 19 Jul 2022, adding various language features and bug fixes.
• Google introduces a preview release of batch on 13 July 2022, a managed service for scheduling batch jobs at scale on the Google Cloud Platform. Batch can manage a job queue, provision and autoscale resources, run jobs, execute subtasks, and deal with common errors automatically.
• Oracle announce the general availability of their Oracle Database Service on Microsoft Azure.
• Cloudflare announces Location-Aware DDoS Protection for Cloudflare Enterprise customers that are subscribed to the Advanced DDoS service. The technology records the typical locations of traffic to a website and uses this as a metric to detect DDoS attacks coming from more unusual and wider spread locations.
• Microsoft warns that attackers are increasingly leveraging Internet Information Services (IIS) extensions as covert backdoors into servers this month, encouraging organisations to follow security practises to help defend their servers.

In the May 2022 survey we received responses from 1,155,729,496 sites across 273,593,762 unique domains and 12,069,814 web-facing computers. This reflects a loss of 5.23 million sites but a gain of 1.63 million domains and 95,200 computers.

nginx gained the largest number of domains (+1.24 million) and also a hefty amount of web-facing computers (+21,500), further securing its lead in both metrics. The total number of domains powered by nginx is now 75.0 million (+1.68%) and its market share has increased to 27.4% (+0.29). In terms of web-facing computers, nginx now has a total of 4.60 million; and although its leading market share fell slightly to 38.1%, Apache’s fell slightly further, extending the gap between the two to 9.54 percentage points.

nginx also continues to lead with a 30.7% share of all sites, despite losing the largest amount this month (-6.57 million). Apache follows with a share of 23.0%, but also lost a large number of sites (-2.32 million). The largest gain in this metric was seen by Google, which added 2.96 million sites to its total and increased its market share to 4.14%. LiteSpeed made the second largest gain of 1.26 million sites, and stays slightly ahead of Google with a share of 4.35%.

Google and LiteSpeed also made the only significant gains in the active sites metric, with Google gaining 977,000 and LiteSpeed gaining 151,000. Google has a greater lead in this metric, with a market share of 9.49% versus LiteSpeed’s 4.60%.

Cloudflare is continuing to edge its way up towards the leaders in the top million websites. This month it gained an additional 1,822 sites and now accounts for more than 20% of the top million sites for the first time. Meanwhile, both Apache and nginx lost more than a thousand sites each in the top million, making it look ever more likely that Cloudflare could gain places by the end of the year. Apache, nginx and Cloudflare currently have top-million site shares of 22.8%, 21.7% and 20.0% respectively.

One surprise this month was that the largest computer growth was seen not by nginx, but by the awselb (Amazon Web Services Elastic Load Balancing) web server, which gained 26,200 computers to reach a total of 378,000. These computers are likely to form only a small fraction of the AWS infrastructure used by the 1.86 million sites that are served from these computers, as AWS ELB achieves fault tolerance and scalability by automatically distributing incoming application traffic across multiple targets, and can also spread traffic across multiple AWS Availability Zones.

Vendor news

• nginx 1.22.0 was released on 24 May 2022. This is the first release in the 1.22.x stable branch and incorporates new features and bug fixes from the 1.21.x mainline branch. Some of the notable new features include support for OpenSSL 3.0 and the PCRE2 library, as well as some security improvements such as hardening against potential request smuggling and cross-protocol attacks.
• njs 0.7.4 was also released on 24 May 2022. This version of nginx’s JavaScript-based scripting language includes several bug fixes and adds extended directives for configuring the Fetch API.
• Apache Tomcat 9.0.63, 10.0.21 and 10.1.0-M15 (alpha) were released on 16 May 2022. Tomcat 8.5.79 was later released on 23 May. Amongst other changes, all of these versions include a new error message that is shown when the Linux kernel duplicate accept bug is detected. This change follows the identification of the root cause of the bug along with the kernel version that includes the fix.
• OpenResty 1.21.4.1 was released on 18 May 2022. This web platform now uses nginx 1.21.4 mainline as its core and incorporates many other new features, including support for BoringSSL.
• On 3 May 2022, Microsoft announced the general availability of its next-generation WAF (web application firewall) engine on Azure Application Gateway. This makes use of Open Web Application Security Project (OWASP) Core Rule Set 3.2 (CRS 3.2), which is intended to provide increased coverage for web vulnerabilities, reduce false positives, and protect against specific vulnerabilities like Log4J and SpringShell.
• Microsoft has also expanded its Azure Migration and Modernization Program (AMMP) to encourage more customers to move their web applications to Azure. Azure also offers free Extended Security Updates for SQL Server 2012 and Windows Server 2012, giving more time to modernize older applications for three additional years beyond the 10 years granted by Microsoft Support.
• Cloudflare made several new features available during the month of May, including:
  • The ability for everyone to proxy DNS wildcard records. This feature was previously only available to enterprise customers.
  • Cloudflare Pages now support direct uploads.
  • The Cloudflare R2 object storage solution has entered open beta.
  • Cloudflare D1 – an SQL database based on SQLite – was also announced. A demo site that runs on Cloudflare Workers can be seen at https://northwind.d1sql.com/.
  • Cache Reserve provides a new way to persistently serve all static content from Cloudflare’s global cache.
  • Workers Analytics Engine provides a new way to get telemetry about anything that uses Cloudflare Workers.
  • Cloudflare has open sourced a Cloudflare Relay Worker that takes a generic webhook response and delivers it to Rocket Chat.
  • Cloudflare’s Ethereum and IPFS gateways are now publicly available to all Cloudflare customers.
  • Workers for Platforms, Pages Plugins, and Custom Domains for Workers were also announced.

In the March 2022 survey we received responses from 1,169,621,187 sites across 272,177,331 unique domains and 11,877,217 web-facing computers. This reflects a loss of 4.00 million sites, but a gain of 977,000 domains and 103,000 web facing computers.

Cloudflare gained the largest number of sites, with 1.32 million more than in the February survey. Its growth was also consistent across other metrics, having gained +176,000 domains (+0.77%) and +256,000 active sites (+1.24%), with an extra 0.12pp share of the top one million sites.

nginx, the current leader by most metrics, had a particularly strong growth in terms of domains, having gained 978,000 domains (+1.35%) this month—the largest gain of any vendor in this metric. Though it lost 2.98 million sites, it appears to be serving more interesting content overall, as measured by a 158,000 increase in its number active sites. It also gained the most additional web-facing computers out of all vendors this month, with 39,300 more than the previous month. OpenResty, which uses nginx, is serving 62,300 more active sites and now counts towards an additional 441 of the top one million sites. OpenResty was also counted on 6,640 more computers (+5.04%) than last month.

Apache has the greatest number of active sites and, by a narrow 1.03pp margin over nginx, the greatest share of the top one million sites. However, it shrunk in both of these metrics, losing 583,000 active sites and 2,130 of the top one million. Apache lost out in most other metrics too, with 756,000 fewer domains and just over 5 million fewer sites. It did, however, gain a few more computers over last month, but nginx’s large growth meant that Apache still lost market share in this measurement.

Microsoft saw declines in all metrics this month, losing 3.22 million sites (-7.13%), 156,000 domains (-1.75%), 118,000 active sites (-1.88%), and 7,620 computers (-0.57%). Microsoft also lost 1,000 sites from its share of the top million.

Although one of the smaller web servers on the market, LiteSpeed has frequently shown strong and consistent growth, with this month being no exception. It had the largest sites and active sites growth of all web servers in the March 2022 survey, gaining 1.92 million sites and 277,000 active sites.

Vendor news

• Apache released version 2.4.53 of their httpd web server. This version contains security fixes for four different CVEs. The release also brings a number of general bug fixes. Apache also released bug patches for several versions of Tomcat.

• OpenSSL released versions 3.0.2 and 1.1.1n of their cryptography library in order to patch against a high severity denial of service vulnerability. OpenSSL is used by both Apache and nginx, which together account for a majority of all sites, domains, and web-facing computers.

• Microsoft Azure has expanded to a new region in the North of China. Microsoft’s share of the web server software market is much larger in China compared to the rest of the world, with 16.5% of active sites, 20.1% of domains, 13.4% of sites, and 15.0% of web-facing computers.

In the January 2022 survey we received responses from 1,167,715,133 sites across 269,835,071 unique domains and 11,700,892 web-facing computers. This reflects a loss of 1.15 million sites, but a gain of 1.51 million domains and 31,100 computers.

nginx lost 7.33 million sites this month (-1.91%) but continues to be the most commonly used web server with 32.3% of all sites using it. Although nginx’s share has fallen, Apache is still more than eight percentage points behind after losing 3.70 million sites (-1.31%), which has taken its own market share down to 23.9%.

nginx also leads in the domains metric, where it has a share of 26.6% compared with Apache’s 23.9%. This reflects a small reduction in nginx’s share – despite a modest gain of 25,400 domains – while Apache suffered the largest loss of 287,000 domains.

The largest site and domain growth was seen by Pepyaka, which is a web server that has primarily been used by the Wix web development platform since it switched from using nginx in 2018. The number of sites using Pepyaka grew by 4.02 million to 7.30 million this month, while its domain count went up by 1.80 million to 3.30 million.

The next largest domain growth was seen by OpenResty, which gained 686,000 domains this month, and 1.34 million sites in total. The second largest site growth was seen by Microsoft, which gained 2.46 million sites and now accounts for 4.86% of all sites and 5.00% of all domains.

Constraining the view to active sites, Apache is still the most commonly used web server, but its market share has fallen slightly to 23.4% after losing more than half a million active sites this month. Meanwhile, nginx gained 230,000 active sites and has increased its share to 20.2%.

Apache also maintains a slight lead in the top million websites, where it is used by 235,000 sites compared with 222,000 for nginx. However, Cloudflare has increased its presence by a further 4,959 sites and is now not too far behind with a total of 191,000. If this trend continues, Cloudflare could soon overtake both nginx and Apache to become the most commonly used top-million web server.

Looking at web-facing computers, nginx’s strong growth continues unabated. This month it is being used by an additional 32,700 web-facing computers and its market share has increased to 37.7%. Its lead over Apache was further extended by Apache’s loss of 29,100 computers, which sent Apache’s share down to 29.9%.

Vendor news

• Apache 2.4.52 was released on 20 December 2021. This is the latest release from the 2.4.x stable branch and includes two security fixes amongst a host of other changes.
• Apache Tomcat 9.0.56, 10.0.14 and 10.1.0-M8 (alpha) were released on 8 December 2021. Each of these versions include a fix for a known operating system bug that could cause incoming connections to be reported more than once.
• nginx 1.21.5 was released on 28 December 2021. This is the latest release in the mainline branch of nginx and is now built with the PCRE2 library by default.
• njs 0.7.1 was also released on 28 December 2021. This release includes several bugfixes and some other changes to ensure that njs scripts use the same regular expression library as nginx.
• Microsoft has mitigated an insecure default behaviour in the Azure App Service that inadvertently exposed hundreds of source code repositories. The team that found the vulnerability noted that it had existed since September 2017 and has probably been exploited in the wild. The problem could have impacted PHP, Node, Ruby, Python and Java applications that serve static content, as well as some Azure App Service Linux applications that were deployed using Local Git after files were created or modified in the content root.
• Cloudflare has introduced a new product called Bulk Redirects, which lets website administrators upload and enable large numbers of URL redirects. These were typically implemented with Page Rules before, which are limited to a maximum of 125 redirects.
• OpenResty 1.21.4.1 RC1 was released on 16 December 2021. This version is based on nginx 1.21.4 and adds several new features including support for BoringSSL.

In the November 2021 survey we received responses from 1,175,392,792 sites across 267,027,794 unique domains and 11,525,855 web-facing computers. This reflects a loss of 4.06 million sites, but a gain of 1.60 million domains and 137,000 computers.

nginx gained the largest number of domains (+741,000) and web-facing computers (+81,300) this month and continues to lead in both metrics with market shares of 30.1% and 37.3%.

Further down in the market, there was also a noticeable increase in the total number of web-facing computers running LiteSpeed, which went up by 11,200 to 101,000 (+12.5%), although this resulted in only a 1.44% increase in domains. These counts include sites that run on LiteSpeed Web Server and its open source variant, OpenLiteSpeed, both of which exhibit the same “LiteSpeed” server banner.

Both nginx and Apache lost nearly 4 million hostnames each, reducing their sites market shares to 34.7% and 24.4%. Meanwhile, Cloudflare gained 1.15 million sites, which has taken its total up to 58.6 million (+2.00%) and increased its sites share to 4.99%.

nginx and Apache also suffered losses amongst the top million websites, paving the way for Microsoft to increase its presence by 2,369 sites (+3.75%). Microsoft web server software is now used by 65,600 of the top million sites, but Apache is still the most commonly used web server in this sector, with 240,000 of the top million sites using it, and nginx is not far behind with 224,000.

Apache 2.4.49 vulnerability

Following last month’s news of a path traversal vulnerability in Apache 2.4.49 being actively exploited in the wild, this month’s survey shows that more than 11 million websites had server banners containing “Apache/2.4.49” before a fix was released. The only other version vulnerable to attack was Apache 2.4.50, which failed to fix the vulnerability properly – but this version was released after the survey ran and was promptly replaced with Apache 2.4.51, where the vulnerability was resolved properly.

The true number of websites that were vulnerable during the survey period is likely to have been much greater than the 11 million websites that openly reported themselves to be running Apache 2.4.49, as nearly two-thirds of all Apache-powered websites do not reveal a version number in their server banners. This configuration is often a deliberate act towards security through obscurity, although attackers can often deduce precise version numbers by carrying out additional tests. There may also have been additional vulnerable instances of Apache 2.4.49 hidden behind frontend load balancers or content delivery networks such as Cloudflare.

Conversely, some websites running on Apache 2.4.49 may not have been vulnerable if they used an appropriately configured web application firewall that prevents path traversal attacks. More generally, the true number of web servers that contain a version-specific vulnerability can also be masked by future backported security patches, which typically fix vulnerabilities without changing the apparent version number of the software. From an external perspective, a server might appear to be running a vulnerable software version but may not actually be vulnerable to the issues affecting that version.

Vendor news

• LiteSpeed Web Server 6.0.11 was released on 10 November. This is the latest version in the LSWS 6.0 stream and includes improvements in HTTP/2 and HTTP/3 throughput, new support for WebSocket proxy targets in rewrite rules, and several bugfixes.
• Microsoft has announced new Azure Bounty Program rewards of up to $60,000 to encourage and reward research into vulnerabilities that would have the highest potential impact on the security of its customers.
• nginx 1.21.4 mainline was released on 2 November. This version includes some new features and changes relating to TLS and HTTP/2.
• Lighttpd 1.4.61 was released on 28 October to address a number of bugs. Lighttpd is used by 245,000 unique domains in this month’s survey.
• njs 0.7.0 was released on 19 October to add HTTPS support for its Fetch API, along with a few other new features and bugfixes.
• Apache Tomcat 9.0.54, 10.0.12 and 10.1.0-M6 (alpha) were released on 1 October, followed by Tomcat 8.5.72 on 6 October.
• Cloudflare Pages now supports custom headers natively, without having to use Cloudflare Workers. This makes it easier for developers to add best-practice security headers and others to their JAMstack applications.
• Cloudflare for SaaS is now generally available to all, following a beta launch earlier in the year.

In the August 2020 survey we received responses from
1,230,576,586 sites across 261,821,287 unique domains and
10,349,486 web-facing computers. This represents a loss of 3.65 million
sites, but a gain of 1.16 million domains and 128,000 computers.

The number of web-facing computers using nginx increased by 83,000 this month,
which means that – for the first time – nginx is in use by more web-facing
computers than any other web server, including Apache. This is another
milestone for nginx, and reflects its impressive growth in recent years.

Apache still serves more active sites than nginx, and a greater proportion of
the top million busiest sites, but this month its decline in these metrics
continued. One year ago, among the top million busiest sites, nginx trailed
Apache’s market share by 6 percentage points. nginx has since halved this gap,
and is now less than 3 percentage points behind. If the current trend
continues, it won’t be long before nginx overtakes Apache in this area too.

As well as a marked decrease in total sites this month of 22.14 million
(-15.8%), Microsoft also suffered in other metrics this month. The number of
domains served using Microsoft software dropped by 8.27 million (-18.4%), and
19,000 fewer web-facing computers (-1.2%) are running Microsoft web servers.
Microsoft also lost 633,000 active sites (-7.3%).

New vendor releases

Apache released three new
versions of httpd this
month. Version 2.4.44 fixed
several bugs, version 2.4.45
dropped support for the abandoned HTTP2 Cache Digests
proposal, and version
2.4.46 fixed three security
vulnerabilities.

This month nginx released updates for three of its
products. nginx 19.1.2 mainline was released on
11 August with a few minor optimizations and several bugfixes. On the same day,
njs 0.4.3 was released, adding support for the
querystring module.
On 13 August nginx Unit 1.19.0 was
released, which introduced several new features, improved performance, and fixed
a number of bugs.

In the June 2020 survey we received responses from 1,224,760,416 sites across 262,406,750 unique domains and 10,042,047 web-facing computers. This reflects a gain of 1.21 million domains and 149,000 computers, but a loss of 13.3 million sites.

Microsoft lost the largest number of sites – more than 20 million – taking its total down by 13% to 135 million. This has decreased its market share by 1.51 percentage points to 11.0%. Apache also suffered a sizable loss of 10.7 million sites, decreasing its total to 304 million and taking its share down by 0.60 points to 24.8%.

nginx continues to lead with a total of 449 million sites, an increase of 2.95 million since last month. Coupled with the other major vendors’ losses, this has increased nginx’s market share by 0.63 points to 36.6%.

nginx also showed the largest computer growth, with 115,000 more computers taking its total up to 3.35 million and putting it only 76,000 computers away from Apache’s leading total.

While nginx looks set to soon become the largest vendor in terms of computers – possibly even by next month – celebrations by F5 Networks are likely to be marred by the latest developments in the dispute over the ownership of the nginx web server source code: it is now being sued by Lynwood Investments, who claim it owns the software.

The latest move comes after police raids on the offices of nginx and the home of one of its co-founders, Igor Sysoev, in December 2019. Russian search engine and e-commerce service provider, Rambler, alleged the webserver was developed while Igor Sysoev was a Rambler employee. Rambler transferred the rights to pursue the dispute to Lynwood Investments.

Meanwhile, nginx has also extended its recent new lead in the domains metric, with it now being used to host sites across 1.82 million more domains than last month.

Google was the only major vendor to gain active sites this month – a 2.12% increase to 19.3 million – and LiteSpeed was the only one to increase its presence among the top million websites, where it now has a share of 1.92%.

New vendor releases

nginx 1.19.0 mainline was announced on 26 May. This first release in the 1.19.* stream adds client certificate validation with OCSP, as well as a few bug fixes. The latest stable version is still 1.18.0, which was released in April. The difference between these two release streams is that the mainline branch is where new features are added, while the stable branches receive only security and bug fixes. This gives the stable releases a fixed feature set, which increases compatibility with third-party modules.

In the April 2020 survey we received responses from 1,246,121,153 sites across 260,089,947 unique domains and 9,669,267 web-facing computers. This reflects a gain of 10,000 computers and 2.90 million domains, but a loss of 16.9 million sites.

nginx and Microsoft lost the most sites this month — 13.4 million and 10.4 million each — but like all other major vendors, they both gained domains.

Since attaining the largest share of domains last month, nginx has extended its lead with net growth of 1.84 million domains and now has a 28.5% share of this market, compared with Apache’s 27.8%.

Although Apache gained the largest number of sites this month — more than 2 million — it lost 598,000 active sites and its presence amongst the top million websites decreased by 4,230 sites, which took its top-sites count down by 1.43%. Nonetheless, Apache still has the largest share of the top million sites for now (29.1% compared with nginx’s 25.5%), and also continues to lead in terms of active sites and web-facing computers.

Vendors respond to COVID-19

As the coronavirus pandemic continues to affect many people’s lives in an unprecedented fashion, some web server vendors have offered to help in a variety of direct and indirect ways.

Microsoft has made an initial $1 billion donation to Puget Sound’s COVID-19 Response Fund; published a map that tracks active, recovered and fatal cases; and has offered its Healthcare Bot service powered by Microsoft Azure to help frontline organisations screen patients for potential infection and care.

NGINX and F5 are offering free resources for websites impacted by the crisis. This includes free access to its core training for NGINX Open Source; providing additional help and one free year of NGINX Plus to the education, public government and non-profit sectors; and encouraging its employees to respond to NGINX related matters on Stack Overflow and Twitter.

Google has made its COVID-19 datasets free to access and query. Researchers can also use Google’s BigQuery ML language to create and execute machine learning models for free. Google’s COVID-19 public dataset program is to remain in effect until 15 September.

Google has already had a number of measures in place to ensure that its systems stay up and running during the coronavirus crisis. For more than ten years it has carried out regular disaster recovery testing to identify and address potential problems before they happen, and its engineers operate from multiple locations. With some businesses experiencing increased online sales while consumers stay at home, Google has also activated its enhanced support structure which was developed for peak demand situations like Black Friday.

Last month, Google announced availability of Game Servers beta, which is a managed service offering the Kubernetes-based, open source Agones game server hosting project cofounded by Google and Ubisoft. Agones automatically scales Kubernetes to meet unpredictable player demand, and so its launch is conveniently timed to help cope with the increased amount of online multiplayer gaming taking place while many people are either self-isolating or on lockdown during the global coronavirus crisis.

Online gaming is helping some companies to weather the pandemic, such as Chinese technology group Tencent, which expects revenues from its games business to hold up better than that of its main rival, Alibaba, whose Taobao Tengine web server currently powers 13.7 million websites. Alibaba’s co-founder, Jack Ma, has donated coronavirus test kits and masks to Europe and the US despite the effect the pandemic has had on its Tmall and Taobao retail businesses.

Cloudflare has made its Cloudflare for Teams service free for small businesses during the outbreak, helping employees to work from home securely and effectively.

Finally, Netcraft has been protecting consumers and businesses from the despicable — yet inevitable — influx of
coronavirus-themed cybercrime,
which has recently scaled up a notch.
The types of fraudulent activity that are purposely exploiting the pandemic include tax refund scams and other phishing attacks
that have been modified to make use of coronavirus-themed emails, as well as smishing, password-stealing malware, advance fee scams,
and masses of fake online stores purportedly selling COVID-19 vaccines, cures and related protective equipment.

In the February 2020 survey we received responses from 1,260,909,305 sites across 254,192,929 unique domains and 9,564,965 web-facing computers. This reflects a loss of 35.1 million sites and 11,900 computers, but a gain of 4.57 million domains.

The largest swings this month were seen for nginx. Despite losing 28.7 million sites and 64,500 web-facing computers, nginx excelled in other metrics this month, including a 3.06 million increase in unique domain count and a 675,000 increase in active sites count, building upon its rapid growth from last month.

Apache increased its share of the sites market this month by 0.53 percentage points, owed largely to the aforementioned drop in sites for nginx. This comes despite a drop of 1.77 million sites for Apache. Apache also lost 187,000 domains and 97,500 active sites this month. Apache did, however, gain an extra 6,400 web-facing computers. Apache is presently the most commonly used web server in terms of domains, active sites, and computers, and also has the greatest portion of the top one million busiest sites. The only metric in which it is currently beaten is the relatively unstable total count of sites (hostnames), for which nginx currently holds first place.

Microsoft saw modest growth in its counts of active sites (+193,000), web-facing computers (+9,890), and domains (+536,000). Microsoft saw a reduction of 2.65 million sites, but, like Apache, was left with an increase in its market share overall.

Vendor News

Apache released versions 7.0.100, 8.5.51, and 9.0.31 of its Tomcat Java Servlet software. The updates, which are largely the same across the major versions, include fixes, improvements, and some refactoring. Coyote, the HTTP connector component of Apache Tomcat, was found serving around 325,000 domains this month.

NGINX released an update for NGINX Unit, their open source dynamic application server, adding support for Ruby 2.7 and addressing a number of bugs.

In the December 2019 survey we received responses from 1,268,289,402 sites across 243,753,534 unique domain names and 9,430,985 web-facing computers. This reflects a loss of 40.1 million sites, but a gain of 19,200 domains and 156,000 computers.

nginx gained the largest number of sites (+41.2 million), while Apache lost 50.1 million and Microsoft lost 17.5 million; but in terms of unique domains, all major vendors suffered losses. Microsoft lost the most domains (-2.67 million), followed by Apache (-572,000); and, despite gaining so many sites, nginx lost 422,000 domains.

nginx has continued its strong and steady growth in web-facing computers, this month gaining 58,500 computers compared with Apache’s gain of 42,900. nginx is edging ever-closer to Apache’s leading market share, which fell by 0.13 percentage points to 35.3%, leaving it only 3.4 points ahead of nginx.

If current trends continue, nginx looks set to overtake Apache at some point in late 2020, which would make it the largest vendor in terms of web-facing computers. nginx has already been in the lead by sites since April 2019, and is also closing in on domains, but is still some way behind Apache in active sites and the top million sites.

Vendor news

OpenLiteSpeed 1.6.4 was released on 18 November.
This is the open source version of the LiteSpeed web server, which was first to ship HTTP/3 support
in July, and boldly claims to outperform nginx when handling HTTP/3 traffic. More than 20 million sites across 3.9 million domains are running either LiteSpeed or OpenLiteSpeed – both variants exhibit the same “LiteSpeed” server header.

QUIC and HTTP/3 have been supported by Cloudflare’s partly nginx-based edge network since September; and in October, Cloudflare released a patch that
allows its savoury implementation of these protocols (quiche) to be integrated into the upstream nginx codebase. LiteSpeed’s HTTP/3 benchmarks were carried out against this patch.

On 19 November, Microsoft announced the availability of Microsoft Azure from its new cloud
datacenter regions in Norway. Norway’s largest financial services group, DNB Group, has already chosen the new region to migrate services into the cloud in accordance with Norwegian data handling regulations.

Finally, NGINX Plus Release 20 (R20) was released on 3 December. Based on the open source nginx web server, NGINX Plus is a commercial offering, and R20 includes real-time monitoring and logging of rate-limited traffic, enhancements to
connection limiting, and some security improvements for HTTP/2.

In the October 2019 survey we received responses from 1,300,884,420 sites across 241,553,033 unique domain names and 9,045,029 web-facing computers. This reflects a gain of 9.71 million sites, 421,000 domains and a loss of 23,000 computers.

Amongst the largest web server vendors, only nginx and Google gained sites this month with the two vendors increasing by 5.67 million (+1.34%) and 1.80 million (+5.45%) sites respectively, whilst Apache and Microsoft lost 2.14 million (-0.57%) and 6.77 million (-3.56%) sites.

nginx was in fact the only major web server vendor to see increases in most metrics this month, with gains in domains (+480,000), web-facing computers (+12,000), and top million websites (+472).

Apache saw substantially the largest loss of domains, dropping by 762,000 (-1.04%), with Microsoft following with a smaller drop of 125,000 (-0.26%). These losses were largely offset by increases in domains using other smaller vendors, such as Cloudflare and Tengine, both of which are based on nginx.

In terms of web-facing computers, Microsoft saw the largest loss of 56,000 (-3.46%), followed by Apache which dropped 15,000 (-0.46%). A large proportion of Microsoft’s loss came at hosting provider Cloud Innovation which appeared to switch many sites to Tengine.