Most Reliable Hosting Company Sites in November 2017

Rank Performance Graph OS Outage
hh:mm:ss
Failed
Req%
DNS Connect First
byte
Total
1 Webair Linux 0:00:00 0.000 0.145 0.048 0.095 0.097
2 Swishmail FreeBSD 0:00:00 0.000 0.138 0.055 0.110 0.156
3 vXtream Ltd Linux 0:00:00 0.005 0.148 0.066 0.132 0.132
4 Hyve Managed Hosting Linux 0:00:00 0.005 0.093 0.068 0.141 0.141
5 Pair Networks FreeBSD 0:00:00 0.005 0.236 0.073 0.144 0.144
6 Bigstep Linux 0:00:00 0.005 0.142 0.075 0.151 0.151
7 Netcetera Linux 0:00:00 0.005 0.096 0.089 0.180 0.180
8 CWCS Linux 0:00:00 0.005 0.217 0.150 0.231 0.231
9 New York Internet FreeBSD 0:00:00 0.010 0.289 0.024 0.048 0.049
10 One.com Linux 0:00:00 0.010 0.187 0.037 0.110 0.110

See full table

Both Webair and Swishmail responded to all of our requests in November 2017, but the faster average connect time for Webair means it takes the top spot. Webair is a US-based provider of fully managed hosting solutions and has appeared in the top ten a total of seven times in 2017, also taking the top spot in May. Swishmail, a provider of email and web hosting solutions using FreeBSD, has appeared in the top ten five times in 2017.

The six websites ranking third to eighth each failed to respond to only a single request in November. vXtream and Hyve (in third and fourth places) have both made their tenth appearances in the top ten in 2017 - vXtream was absent only in March, while Hyve narrowly missed out by ranking 11th in January. London based vXtream recently acquired Qube Managed Services contracts and infrastructure including presence in datacentres in London, New York and Zurich. Hyve places fourth with an average connect time of 68ms, 2ms slower than vXtream, it offers fully managed cloud hosting from datacentres in the UK, US and China.

Pair Networks owns its own datacentre in Pittsburgh and also offers space in the datacentre of a partner in Denver, it is one of the three websites in the top ten to be run on FreeBSD.

Linux is once again the most prevalent operating system in use for the top ten websites, with seven of the ten websites using it. FreeBSD is the operating system of choice for the remaining three.

Netcraft measures and makes available the response times of around thirty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

LinkedIn certificate blunder leaves users LockedOut!

Many LinkedIn users were unable to access the professional networking website today after its administrators failed to renew a TLS certificate before it expired.

Image10

The certificate in question was used by various country-specific LinkedIn websites such as https://uk.linkedin.com and https://de.linkedin.com. It expired at midday today, immediately preventing users from accessing the site via these hostnames.

The expired certificate was issued to us.linkedin.com, but was also valid for – and used by – dozens of other country-specific LinkedIn hostnames. The main site at www.linkedin.com was not affected.

The expired certificate was issued to us.linkedin.com, but was also valid for – and used by – dozens of other country-specific LinkedIn hostnames. The main site at www.linkedin.com was not affected.

The sites were still inaccessible a few hours after the problem manifested itself.

The sites were still inaccessible a few hours after the problem manifested itself.

Ironically, LinkedIn's better-than-average security made the expired certificate even more problematic. Most browsers will allow users to ignore certificate validation warnings — however unwise that may be — but the warnings cannot be ignored on these LinkedIn sites.

LinkedIn is in a minority of sites that make use of a security feature called HTTP Strict Transport Security. This feature protects HTTPS sites against trivial man-in-the-middle attacks, but unfortunately in this case, the additional security made the site completely unreachable for regular users.

Good security requires great care: Strict Transport Security is a good idea, but when a certificate expires, users cannot visit the site because browsers will not allow the warnings to be ignored.

Good security requires great care: Strict Transport Security is a good idea, but when a certificate expires, users cannot visit the site because browsers will not allow the warnings to be ignored when an active HSTS policy is in place.

Many modern browsers, such as Firefox and Chrome, simply do not allow users to add an exception when a site has an HSTS policy in place. LinkedIn's HSTS policy has a validity period of 30 days, which means that anyone who has visited the site within the past month would have been unable to add a certificate exception, and would therefore not be able to visit the site until LinkedIn renewed the certificate.

LinkedIn's expired certificate was renewed shortly before this article was published.

November 2017 Web Server Survey

In the November 2017 survey we received responses from 1,819,412,110 sites and 6,893,323 web-facing computers, reflecting a gain of 4.17M sites and 6,961 computers.

This month’s web server survey saw Microsoft’s market share amongst all sites fall by 12.64 percentage points due to a loss of 228M sites. Despite this, Microsoft still retains its place with the largest market share by this metric of 36.80%, with Apache trailing at 24.38%. The majority of the loss occurred at just one hosting provider where over 190M Microsoft sites were lost.

This change isn’t reflected in the active sites metric which only saw minor changes amongst the main web server vendors. Microsoft lost only 0.03 percentage points of its market share with a drop of 261k active sites. Apache leads in the active sites metric by a considerable margin, increasing its share slightly this month to 44.55%.

Amongst the top million busiest sites Microsoft experienced a small increase in market share, pausing its general decline in this market. nginx experienced the largest growth with an increase of 2,133 of the top million sites.

nginx also saw the largest increase in number of web-facing computers, gaining 25k and pulling 1 percentage point of market share clear of Microsoft, which it overtook last month. Apache also experienced a gain in computers, albeit smaller at just 7k. It remains considerably ahead with a 42.38% market share.

New gTLDs Seen for the First Time

This month the controversial new .search gTLD being run by Google’s Charleston Road Registry subsidiary was found for the first time, with www.nic.search responding to the survey. Google hopes it will be able to run .search as a dotless domain which will automatically redirect users to their search engine of choice. This proposal has been criticised for going against ICANN’s own rules, which prohibits this functionality due to the potential for conflicts with existing names on internal networks. This feature could also cause confusion for users who have come to expect that typing words into their address bar will perform a search query for that term.

It is currently uncertain whether or not Google will be allowed to run the .search TLD as a dotless domain, however with the launch of the first site on this TLD this month Google is one step closer to the provision of this service.

Total number of websites

Web server market share

DeveloperOctober 2017PercentNovember 2017PercentChange
Microsoft897,467,51749.44%669,517,17736.80%-12.64
Apache340,811,23518.78%443,521,99524.38%5.60
nginx333,942,60418.40%367,687,48920.21%1.81
Google21,127,0781.16%20,333,6041.12%-0.05
Continue reading

Major update to Netcraft Anti-Phishing Extension for Firefox

An update to the Netcraft Anti-Phishing Extension for Mozilla Firefox is now available. This release replaces the Toolbar interface with a modern Button interface to sit alongside the browser's address bar.

firefox-extension-cropped

The upcoming Firefox 57 — to be released on the 14th November — represents a major overhaul of the browser, and removes support for legacy XUL extensions. Future versions of Firefox will only support the new cross-browser WebExtensions API.

The Netcraft Anti-Phishing Extension (known then as the Netcraft Toolbar) was first made available for Internet Explorer in December 2004. A Firefox version followed in May 2005. The current button-style Anti-Phishing Extension was released for Google Chrome and the Opera browser in 2012 and 2013 respectively. The new extension enjoys a 4.5 star rating on the Google Chrome Store.

The Extension runs on any operating system supported by the desktop version of Mozilla Firefox and displays the hosting location, country, longevity, popularity, and an abstracted risk rating for each site visited. In particular its key features are:

  • Protection against phishing sites — The Netcraft anti-phishing community is effectively a giant neighbourhood watch scheme, empowering the most alert and most expert members to defend everyone within the community. As soon as the first recipients of a phishing mail report it, we can block it for all users of the extension providing an additional level of protection from Phishing. Netcraft processes reports of fraudulent URLs from a diverse variety of sources and proactively searches for new fraudulent sites.
  • Detailed site reports — simply click the Netcraft logo to access a wealth of information about the sites you visit, helping you to make informed choices about their safety.
  • Risk Ratings — we evaluate the characteristics of the site compared against those depicted by fraudulent sites. The result is a simple visual summary displayed on the site report.
  • Conveniently report suspected phishing & fraudulent sites — At the click of the button you can report suspected web forgeries to Netcraft, helping to protect the community. Netcraft operates an incentive scheme for Phishing site submissions, including iPads, backpacks, mugs, and more... Over 38.4 million phishing sites have been detected and blocked by Netcraft since the anti-phishing service was launched (November 2017).
  • Protection against cross site scripting (XSS) — The extension optionally traps XSS and other suspicious URLs which contain characters highly likely to deceive.
firefox-blocked-url

The Extension is available for download from the Firefox add-ons page and requires no special administrator privileges to install. Users of the existing Netcraft Anti-Phishing Toolbar will be upgraded automatically to the latest version.

Versions of the Extension are available for other browsers on the Google Chrome Store and Opera add-ons page.

Customised versions with corporate branding and navigation are also available.

Most Reliable Hosting Company Sites in October 2017

Rank Performance Graph OS Outage
hh:mm:ss
Failed
Req%
DNS Connect First
byte
Total
1 www.viawest.com Linux 0:00:00 0.000 0.273 0.005 0.200 0.201
2 vXtream Ltd Linux 0:00:00 0.000 0.137 0.058 0.117 0.117
3 Hyve Managed Hosting Linux 0:00:00 0.000 0.088 0.060 0.126 0.126
4 ServerStack Linux 0:00:00 0.000 0.119 0.063 0.125 0.125
5 Rackspace F5 0:00:00 0.000 0.161 0.074 0.150 0.150
6 One.com Linux 0:00:00 0.004 0.192 0.038 0.108 0.108
7 XILO Communications Ltd. Linux 0:00:00 0.004 0.216 0.066 0.132 0.132
8 Webair Linux 0:00:00 0.009 0.141 0.052 0.104 0.106
9 Memset Linux 0:00:00 0.009 0.144 0.062 0.234 0.362
10 EveryCity SmartOS 0:00:00 0.009 0.106 0.066 0.305 0.306

See full table

ViaWest had the most reliable hosting company website in October 2017, successfully responding to all of Netcraft's requests with an average connect time of just 5 milliseconds. This is ViaWest's third appearance in the top-ten this year, and its first time in the number-one spot. ViaWest was acquired by Peak 10 Inc. in August, and now operates as the combined company Peak 10 + ViaWest. It boasts 40 data centers connected by a 100 Gigabit core network backbone.

vXtream and Hyve came in second and third respectively. Both sites successfully responded to all of Netcraft's requests, but vXtream clinched second place with a marginally quicker average connect time of 58 milliseconds. Both companies are on a top-ten streak: vXtream appearing every month since April, and Hyve appearing every month since February.

ServerStack and Rackspace also had no failed requests this month, placing fourth and fifth based on their average connect time. ServerStack's site has had a 100% uptime record over the past two years, and has appeared in Netcraft's monthly most reliable hosting company sites more than 40 times since 2012. Serverstack operates three data centers across the US and Europe, and offers a 100% uptime SLA.

Linux remains the most popular choice of operating system, with eight of this month's top-ten hosting companies using it. F5 and SmartOS also make an appearance.

Netcraft measures and makes available the response times of around thirty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

October 2017 Web Server Survey

In the October 2017 survey we received responses from 1,815,237,491 sites and 6,886,362 web-facing computers, reflecting a gain of 10.2 million sites and 88,300 computers.

Web-facing computers: nginx takes second place from Microsoft

nginx made the largest gains in websites, active sites, and web-facing computers this month, as well as increasing its presence among the top million sites. Most notably, the additional 42,100 web-facing computers it gained has taken its total up to 1.55 million computers, putting it ahead of Microsoft for the first time.

Overtaking Microsoft means that nginx is now the second largest server vendor in terms of web-facing computers. With its remarkably consistent growth, nginx is likely to retain this newfound position for some time – not least because Microsoft's web-facing computer share has been on a general decline since 2010.

In the other metrics, nginx gained 18.4 million sites, 941,000 active sites, and slightly increased its share of the top million sites to 29.43%. It stays ranked in 2nd place within the top million sites and active sites, but 3rd in all sites.

While Microsoft's loss of 3,470 web-facing computers helped propel nginx into second place, it made more significant losses in other metrics – it lost 30.1 million sites this month, although this corresponds to a loss of only 85,500 active sites.

New releases

Apache 2.4.29 was released on 23 October. This security, feature and bug fix release represents the latest version of the current 2.4.x branch. As usual, it is recommended over all previous releases, but it is difficult to track how many website administrators take heed of this advice.

For instance, many Apache servers do not reveal via their Server headers or error pages which version has been installed, while others may have been updated with backported patches that do not affect the displayed version number. Consequently, a large number of Apache servers claim to be running older versions than they really are. Only 12.6% of the 341 million sites running Apache claim to be running a 2.4.x release, whereas the true proportion is likely to be much higher, given that almost two-thirds of Apache-using sites do not disclose any version number.

Apache continues to lead the market in terms of active sites and web-facing computers, where it has market shares of 44.5% and 42.3%. It also has the largest presence among the top million sites, with 386,000 of these using Apache.

Another new release this month was LiteSpeed Web Server 5.2.2 (stable), which was released on 17 October. This addresses a couple of bug fixes and improves compatibility with the latest version of the popular cPanel web-based control panel.

As well as its commercially supported LiteSpeed Web Server, LiteSpeed Technologies Inc also provides OpenLiteSpeed, which is freely available under the GPL version 3 licence. LiteSpeed is currently the 7th largest vendor in terms of hostnames and active sites: Nearly 11.5 million sites in the survey are powered by LiteSpeed, and 2.7 million (24%) of these are deemed to be active sites.

One of LiteSpeed's most prominent gains was made in November last year, when a large number of hostnames under the .science top-level domain switched to it from Taobao's Tengine web server. This caused LiteSpeed's market share of sites to leap from 0.39% to 3.29%, although it has since settled back down to 0.63%. Nonetheless, this is still noticeably larger than its share of web-facing computers, which currently stands at 0.17%.

nginx 1.13.6 (mainline) and nginx 1.12.2 (stable) were also released in October. Both releases consist solely of bug fixes.

NGINX Unit

Alongside the new releases of nginx, the nginx.org homepage unusually announced the release of a different product this month: NGINX Unit 0.2 Beta.

NGINX Unit is a lightweight dynamic web application server designed to run applications written in Python, PHP, Go, JavaScript, Java and Ruby, although the current beta release does not support all of these languages, nor does it support TLS, routing or proxying yet.

Precompiled binaries are available for CentOS 7 and Ubuntu 16.04, but as it is a beta release, it is not recommended for use in a production environment. Consequently, it is unlikely to have much of a presence on the web in the near future; also, for performance reasons, it is likely that NGINX Unit would be installed behind a regular nginx web server acting as a reverse proxy.

Total number of websites

Web server market share

DeveloperSeptember 2017PercentOctober 2017PercentChange
Microsoft927,540,45451.39%897,467,51749.44%-1.94
Apache329,105,83218.23%340,811,23518.78%0.54
nginx315,530,74617.48%333,942,60418.40%0.92
Google20,906,8491.16%21,127,0781.16%0.01
Continue reading