In the March 2019 survey we received responses from 1,462,021,378 sites, 232,162,099 unique domains, and 8,526,624 web-facing computers. This reflects a loss of 15.8 million sites, but a gain of 2.57 million domains and 160k web-facing computers.

The March survey brings major upheaval in the domains metric. A large 8 million domain switch from Microsoft to nginx at GoDaddy has allowed nginx to overtake Microsoft to gain second place. Many of these freshly-switched domains do not host distinct content, instead redirecting elsewhere. Accordingly, nginx's share of active sites increased by a more moderate 3.3%. The total number of domains using nginx grew by 15.4%, a 3.24 percentage point increase of market share. Microsoft lost 3.95 p.p. Both remain some way behind Apache in the domains metric, which is 13.8 million domains ahead of nginx.

The largest three vendors - Apache, Microsoft, and nginx - showed at least minor increases in the number of active sites using their respective platforms this month. However, there has been an overall decrease in active site numbers over the past year. Apache in particular has seen a significant drop in active sites of around 20 million. In contrast, the LiteSpeed web server has seen more stable growth from month to month, having increased 960k (+31.7%) over the past year. Cloudflare’s server software, which had previously identified itself as a flavour of nginx prior to 2018, also demonstrated significant growth, serving content for 4.54 million more active sites (+65.6%) than it did a year ago.

Within the top million busiest sites, nginx continues to increase its share of the market, with a further small increase of 0.078 p.p. this month. Apache had its first monthly increase since September 2013, gaining back 0.051 p.p. Apache has been on a downward trend since late 2011 when it held around a 66% majority. Despite this, it has still remained the largest vendor amongst the million busiest sites, despite its market share halving to 32.5% as of March 2019. Microsoft servers have also seen a general decrease of market share over time, and its share has fallen to just under 9% this month.

F5 Acquires NGINX

On March 11th, F5 Networks, Inc. announced its acquisition of NGINX, Inc., the developer of the open source nginx web server. A similar announcement was made by NGINX on their website the same day. The acquisition comes with a $670 million price tag.

F5 and NGINX both provide rival sets of products, although the two have traditionally targeted different communities. F5’s BIG-IP line-up provides a variety of specialised products and service-based solutions for application delivery networking. Much of the key functionality provided by BIG-IP products, such as reverse proxying and load-balancing, overlap with the feature set of NGINX Plus, an exclusively software-based product providing a load balancer, web server, and content cache, along with exclusive features not included in the open-source edition of nginx. NGINX has made numerous blog posts and guides promoting its NGINX Plus product over F5’s BIG-IP, with competitive pricing and greater developer agility being common points of discussion.

In March 2019, Netcraft identified 12.6 million domains being served by F5 BIG-IP systems. Most of these BIG-IP systems are used in conjunction with other web server software.

In the February 2019 survey we received responses from 1,477,803,927 sites, 229,586,773 unique domains, and 8,366,753 web-facing computers. This reflects a loss of 40.4 million sites, and gains of 979k domains, and 157k web-facing computers.

Microsoft experienced the largest gain in domains this month, with a net increase of just over one million. Despite several months of relatively small fluctuating gains and losses, the number of domains running Microsoft server software is on a general upward trend. Its total now stands at 59.3 million domains, up by just under 2.6 million (+4.6%) since this time last year. However, this strong domain growth was not reflected in any other metric this month – Microsoft gained only 478 web-facing computers, made losses both in active sites and within the top million sites, and suffered a sizable loss of 65 million hostnames.

On 20 February, Microsoft published a security advisory regarding a potential denial of service vulnerability in IIS. It can be exploited by sending specially crafted HTTP/2 requests to a Microsoft IIS web server, causing CPU usage to spike to 100% until the malicious connections are killed by IIS. Microsoft has addressed this issue in February's "non-security" update by providing the ability to define limits on the number of HTTP/2 settings parameters allowed over a connection.

nginx's growth in the domains metric was some way behind Microsoft's this month, with an increase of 622k. nginx's current total of 52.6 million domains represents a growth of over 8.6 million domains (+19.1%) since February 2018 – over three times that of Microsoft – however, its market share has remained just under 3 percentage points behind Microsoft's since April 2018. In terms of web-facing computers, nginx experienced the largest increase (+102k), continuing its steady gains in market share. It now holds a 29.0% share of the web-facing computer market with a total of 2.4 million.

The latest version of nginx (1.15.9 mainline) was released on 26 February, with some small changes including two new features and two bug fixes. Another product in the nginx family, NGINX Unit 1.7.1, was also released in February to address a security vulnerability in its router process. NGINX Unit is a lightweight web application server that can serve sandboxed Go, Perl, PHP, Python, Ruby and – soon – Java applications.

Apache is still losing domains, with a decrease of 216k this month, and 7.3 million domains over the past year. Apache is also gradually losing market share in terms of web-facing computers, despite an overall increase in the number of public web servers using it: this month, Apache gained 32.9k web-facing computers, taking its total up to 3.2 million, while competitor growth caused its market share to fall to 38.04%. The latest version, Apache 2.4.38, was released on 22 January. This release in the 2.4.x stable branch is regarded as the best available version of Apache, and includes three security fixes and multiple bug fixes.

In the January 2019 survey we received responses from 1,518,207,412 sites, 228,607,903 unique domains, and 8,209,715 web-facing computers. This reflects a loss of 138 million sites, and gains of 768.9k domains, and 61.9k web-facing computers.

The vast majority of the loss of sites this month was seen for those using Microsoft web server software — dropping by 203 million sites (-29%). While much of this loss was concentrated at a single hosting provider and made up of automatically generated sites, Microsoft suffered losses in all metrics this month, albeit with much smaller reductions elsewhere. While Microsoft lost more than two hundred million sites in a single month, the net loss of domains was just 89k. Much of this drop can be attributed to IIS 6.0 and 7.5, while the latest version 10.0 saw a gain of 89k domains, and IIS 8.5 gained 164k.

nginx continues to gain market share in the web-facing computer metric, with the largest increase of 47k computers this month being more than double that of Apache's 21k gain. In the domains market nginx remains at somewhat of a plateau, with a loss of 144k domains taking its market share down to 22.7% — just 0.2pp higher than its share in April 2018. The largest factor this month — a single domain parking company, Bodis, moving all of its parked sites over to OpenResty. While the survey tracks these two products separately, OpenResty makes uses of the nginx core, integrating it with additional Lua-based modules.

Apache experienced a large gain in the domains metric this month with an increase of 245k. However, even with the losses seen for both Microsoft and nginx, it was not enough to boost Apache's market share which remains at 32.5%. The largest gain in domains came again for Cloudflare with an increase of 500k. Cloudflare predominantly uses its own server software originally based on nginx. OpenResty also saw greater gains than the market leader Apache, increasing by 388k with help from the movement of sites from nginx at Bodis.

Apache has released an update to httpd 2.4.38 to address an "important" remote DoS vulnerability, which allowed remote attackers to trigger an infinite loop through client-initiated renegotiation on servers using httpd 2.4.37 and OpenSSL version 1.1.1 or later. This is the first "important" level security issue in Apache HTTP Server since July 2017.