In the April 2018 survey we received responses from 1,783,239,123 sites across 214,513,048 unique domain names and 7,387,066 web-facing computers. This reflects a gain of 12.8 million sites and 53,500 computers, but a loss of 261,000 domains.

Microsoft dominated this month's hostname growth, with 25.1 million additional hostnames bringing its leading market share up by 1.15 percentage points to 36.9%. Meanwhile, Apache lost 8.2 million sites and nginx lost 5.7 million.

Microsoft fared less well in most other metrics, however. Despite its large increase in hostnames, Microsoft's domain count fell by 1.4 million, and it also suffered a loss of 5,360 web-facing computers and 51,300 active sites. Nonetheless, its presence within the top million sites grew by 517 sites.

nginx may have lost 5.7 million hostnames, but it showed the strongest growth in some of the most important metrics. This included a gain of 46,700 web-facing computers, 3.8 million domains, and an additional 4,280 sites in the top million. The noticeable uptick in nginx-powered domains this month has increased its market share of domains by 1.81 percentage points to 22.5%, leaving it only 3.5 points behind Microsoft. nginx has demonstrated fairly consistent domain growth since this metric was introduced in 2009, and if these trends continue, it could feasibly take second place from Microsoft within a year.

Apache suffered losses in every metric this month, including a loss of 3.0 million domains and 1.1 million active sites, along with 2,840 sites within the top million. Nonetheless, it maintains a comfortable lead in every metric except hostnames, where its 25.6% market share is 11.4 points behind Microsoft's.

Some of the highest-traffic sites using Apache today include news website www.bbc.com; financial sites like www.xe.com and www.paypal.com; the Steam online gaming store at store.steampowered.com and its community forum at steamcommunity.com; and sites used by ad networks, like ads.pubmatic.com and c.betrad.com.

Apache Tomcat – the hidden backend

More than 450 million websites are currently using the Apache HTTP server, but this is not the only web server product offered by the Apache Software Foundation. The Apache Tomcat project provides an open source implementation of Java Servlet and JSP technologies, but its deployment is hard to quantify.

Tomcat is often used as a backend application server, with the Apache Tomcat Connectors project connecting it to other web-facing servers like Apache and Microsoft IIS. In many of these cases, Tomcat cannot be detected passively, although it may be possible to confirm its use during a web application security test – for example, by tricking the application into returning a Java stack trace.

Tomcat also includes its own native HTTP connector that allows it to be used as a standalone HTTP server, and these servers can be passively identified from their "Apache Tomcat" server headers. However, this is not a commonly used configuration: Only 10,300 websites exhibited the Apache Tomcat server header this month, and only 35 of these sites were ranked within the top million.

Several different versions of Apache Tomcat are available, depending which version of Java needs to be supported. Surprisingly, most Tomcat servers that are exposed directly to the internet are running Apache Tomcat 4.1.x, which has not been supported for several years. Actively maintained versions include 9.x, 8.5.x, 8.0.x and 7.x, although support for 8.0.x will end on 30 June 2018. The most recent versions of Apache Tomcat are 8.5.30 and 9.0.7, which were both released on 7 April.

Other new releases

The mainline branch of nginx has seen three new releases since last month's survey. nginx 1.13.10 was released on 20 March 2018, and added a few new features including the ngx_http_grpc_module module, which allows requests to be passed to a gRPC server. nginx 1.13.11 was subsequently released on 3 April, followed by nginx 1.13.12 on 10 April. These releases include a few bug fixes and an improved proxy protocol feature.

nginx also announced the release of njs 0.2.0 on 3 April. njs implements a subset of the JavaScript language, allowing location and variable handlers to be used in nginx's ngx_http_js_module and ngx_stream_js_module modules.

OpenLiteSpeed 1.4.31 (stable) and 1.5.0 RC3 were released on 11 April 2018. This open source server cannot be distinguished from the commercially available LiteSpeed Web Server, as both products use the same "LiteSpeed" server header. More than 12.5 million sites exhibit this header, across 13,600 web-facing computers.

Tengine 1.4.2

Nearly 28 million websites are using Taobao's nginx-based Tengine web server, but 74% are still running a version that was released several years ago, despite later releases including not just new features, but also security fixes. The most extensive user of Tengine 1.4.2 – which was released in November 2012 – is the Chinese cloud computing infrastructure service provider Aiyun Network.

Uptake of new Tengine releases is generally slow across the internet. The latest version, Tengine 2.2.2, was released on 26 January 2018, but only 262 sites are currently using it. Most of these sites are hosted by Internet Vision in Lithuania, while handfuls of other early adopters are hosted on low-cost cloud hosting platforms provided by Aliyun, DigitalOcean and Linode.

The poor uptake of newer releases could be partly caused by their lack of visibility on the Tengine website at tengine.taobao.org. The latest version that can be downloaded from the News section on the homepage is the 2.2.0 development version that was released in December 2016, followed by the 2.1.2 stable version from December 2015. Download links for the much-newer 2.2.1 and 2.2.2 releases can only be found on a separate download page.

cloudflare-nginx still lingers

Cloudflare's migration to its new cloudflare server header is not yet over, with more than 10,000 websites still using the old cloudflare-nginx header. These account for less than 0.07% of all Cloudflare sites in the survey, so the migration is very close to completion.

Cloudflare recently increased the size of its European network to 41 cities, expanding its global network to 151 cities across 74 countries. Its highest data centre is 2.6 km above sea level in the city of Bogotá, Columbia.

In the March 2018 survey we received responses from 1,770,411,187 sites across 214,774,438 unique domain names and 7,333,606 web-facing computers. This reflects a gain of 43,000 computers, and 738,000 additional domains. The total number of hostnames fell by 68.2 million, and the number of active sites fell by 3.4 million.

Domain growth this month was shared between nginx and Microsoft; nginx increased its market share by 0.15 percentage points by gaining 482,000 domains while Microsoft gained slightly fewer with 413,000. Market leader Apache lost 568,000 domains and continues to lose market share, its share now stands at 37.6%.

Apache also loses out when looking at the number of web-facing computers, 31,000 fewer computers were seen running the web server software in March leading to a drop in market share of 0.67 percentage points. Microsoft also lost computers, seeing 100 fewer, while nginx continues to gain both computers and market share. Nearly 1.8 million web-facing computers were seen running nginx in March, giving it 24.5% of the market.

New Releases

The Apache Software Foundation announced the release of Apache 2.4.33 on 23 March; this is the first release announced since Apache 2.4.29 in October 2017, the skipped version numbers were not publicly announced due to issues which came to light during the release process. The 2.4.x branch is recommended over all previous releases.

OpenLiteSpeed, the open source software behind the commercial LiteSpeed HTTP server, received releases to both its stable and latest branches in February, version 1.4.30 was released on 14 February and version 1.5.0 RC2 on 15 February, both releases fix the same set of issues.

lighttpd version 1.4.49 released on 11 March, with it the open source web server adds basic support for the HTTP CONNECT method along with several bug fixes. lighttpd is seen in use serving sites on 500,000 unique domains in the March survey; these are served from 21,000 web-facing computers.

In the February 2018 survey we received responses from 1,838,596,056 sites across 214,036,874 unique domain names and 7,290,968 web-facing computers. This reflects a gain of 63,000 computers, and nearly a million additional domains. Overall hostname growth was 33 million, and the number of active sites grew by 9.3 million.

Microsoft dominated this month's domain growth, with an extra 1.1 million domains (+2.0%) taking its market share up by 0.41 percentage points to 26.5%, while Apache lost 115,000 domains. Microsoft also saw the largest hostname growth, with an additional 59 million sites taking its leading hostname share up by 2.65 points to 34.5%.

After excelling in all growth metrics last month, nginx did not sweep the board this time. Although its computer growth continued to be strong – gaining 44,000 this month – it lost 11.2 million hostnames globally. The primary cause of this was more than 15 million sites switching from nginx to Apache. Most of these sites were previously hosted by Raksmart in China, but are now hosted by Data Foundry in the United States.

All four of the largest major vendors – Apache, nginx, Google and Microsoft – gained active sites this month. Apache made the largest gain of 2.1 million, but this was not enough to prevent its active sites share falling by 1.1 points to 42.7%. Nonetheless, Apache continues to lead with more than twice as many active sites as its closest competitor, nginx.

Cloudflare-nginx migration underway

For several years, every edge machine in Cloudflare's content delivery network (CDN) exhibited the Server: cloudflare-nginx HTTP response header. This reflected the fact that its custom software stack was based on nginx – but this month's survey saw a vast swathe of websites switching to a new Server: cloudflare header.

Although nginx remains part of Cloudflare's stack, it plays less of a role than it once did. The code that handles HTTP requests on Cloudflare's machines now goes far beyond the capabilities of nginx alone, and Cloudflare also hints that it will most likely end up writing its own caching software instead of using nginx.

In line with Cloudflare's reasoning, Netcraft's survey treats the new cloudflare server as a distinct product to nginx, and this has taken a chunk out of nginx's share in the top million sites. The new cloudflare server already accounts for 5.2% of the top million sites, and this share will undoubtedly increase next month.

The transition to the new cloudflare server banner started on 18 December 2017, and the February 2018 survey found nearly 60% of Cloudflare's sites using the new banner. It is likely that they will all use the new banner by next month's survey.

Other web server news

The developers of nginx have added support for HTTP/2 Server Push, which is likely to be made available in the next release. This feature allows web servers to send resources such as images and stylesheets before they are requested by the browser, which can make some webpages load faster.

After coming to prominence last month, DPS is now the 9th largest server by domains. It continues to be used almost exclusively by GoDaddy to host sites created with its Website Builder tool, and it is still being regularly updated. The current version in use at the time of writing is DPS 1.2.1, whereas a month ago it was 1.1.20.

OpenLiteSpeed 1.5.0 RC1 was released on 2 February, adding new Multi-Thread APIs and a module developer guide. This followed the 10 January release of 1.4.29, which is currently the latest stable version of the freely available open source server. Just over 2.5 million domains are currently using OpenLiteSpeed or the commercially available LiteSpeed Web Server product. Both products use the same LiteSpeed server banner and do not reveal version numbers.

Finally, NGINX Unit saw a few new releases since the last survey. NGINX Unit 0.4 was released on 15 January. This was the first release of the lightweight web application server to be compatible with DragonFly BSD, but it was mostly a bugfix release that eliminated some significant regressions in the previous version. NGINX Unit 0.5 was then released on 8 February, adding a Perl application module that allows it to run applications like Bugzilla; however, this release was not announced, as it contained a serious regression that could cause the main process to die. This was rectified in NGINX Unit 0.6, which was announced on 9 February.

In the January 2018 survey we received responses from 1,805,260,010 sites across 213,053,157 unique domain names and 7,228,005 web-facing computers. This reflects a gain of 214,000 computers, but only 183,000 domains. Overall hostname growth was 71 million, although the number of active sites fell slightly, by 311,000.

DPS powering GoDaddy's Website Builder

While the total number of domains across all web server vendors grew slightly, 1.5 million fewer domains used a Microsoft web server in the January 2018 survey. Its share of domain names has fallen by 0.74 points to 26.1%. Contributing to that loss were more than 985,000 unique domains hosted by GoDaddy, which are now using a lesser-known web server called DPS.

DPS (Data Protection Server) is now the 10th largest server by domains, and it is used exclusively by GoDaddy to host customer sites that have been created with its Website Builder tool. The DPS server appears to be frequently updated: sites using it currently return the Server: DPS/1.1.20 header, but these sites were using version 1.1.19 when the data was collected for the January 2018 survey. In the December 2017 survey, the sites were using version 1.1.16, and 1.1.10 in November 2017.

Cloud balancing with Pepyaka and F5 BIG-IP

Another lesser-known server, Pepyaka, also saw massive domain growth at a single hosting company this month. The Israeli web development platform Wix uses Pepyaka to host its customers' sites in the Amazon Web Services cloud, but many of these sites did not identify which server software they were using during the previous survey, causing a temporary absence. The number of domains using Pepyaka at AWS is now back up to more than 1.8 million, making it the 6th largest server by domains.

Nearly all of the Wix sites hosted at AWS use Pepyaka 1.11.3, which is likely based on the July 2016 mainline release of nginx 1.11.3; but it looks like Wix is in the process of rolling out an updated version: This month saw the appearance of 22 sites using Pepyaka 1.13.4, which most likely corresponds to the August 2017 mainline release of nginx 1.13.4.

Last month's temporary absence of Pepyaka could have been indicative of wider scale experimentation by Wix. Many of Wix's sites were served from machines that exhibited the TCP/IP characteristic of F5 BIG-IP, whereas this month, those sites are back to using Pepyaka running on Linux.

Wix has been a long-time user of nginx, and originally moved all user traffic to the commercial NGINX Plus product to future-proof its load balancing needs. The temporary appearance of F5 BIG-IP demonstrates that Wix may have been testing the waters with a different load balancing setup.

For most of its life, F5 BIG-IP has only been available on specialist hardware devices, such as BIG-IP appliances or VIPRION chassis; but F5's Virtual Editions make it possible to run BIG-IP software on commodity hardware in the cloud. F5 offers several BIG-IP Virtual Edition Amazon Machine Images (AMIs) in the AWS Marketplace, with pay-as-you-go licensing costs ranging from $0.33 to $4.40 per hour.

In May 2017, F5 also announced new public cloud solutions for Azure and Google Cloud, as well as a private cloud solution for the OpenStack cloud platform. This month's survey found more than 13 million domains being served from F5 BIG-IP devices, with Apache being the most commonly seen Server header.

Apache leads in most metrics, but nginx dominates in growth

Across the entire market, Apache remains in the lead with a 38.2% share of domains, but the ongoing trend makes it likely that both Apache and Microsoft could be overtaken by nginx in the next few years. nginx has continued to steadily increase its domain share, with a 0.21 point gain to 20.5% this month, while Apache has been experiencing a general decline of market share in recent years.

nginx's persistent growth has also manifested itself in every other metric this month, with it gaining the largest number of sites, active sites and web-facing computers, as well as increasing its presence amongst the top million sites. nginx is now used by 23.5% of all web-facing computers and 30.5% of the top million sites, but Apache still has the largest number of active sites, computers, domains and top-million sites.

The only metric graphed below in which Apache does not take the lead is hostnames, where Microsoft has a total of 575 million sites; but this metric is prone to fluctuations and is less indicative of market success. Microsoft has the second largest number of domains in the survey, but has been ranked third in web-facing computers since it was overtaken by nginx in October 2017.

While 1.5 million web-facing computers currently run Microsoft web server software, a slightly larger number – 1.8 million – run Windows operating systems. The bulk of the difference is made up of Windows computers that either run Apache or reverse-proxy traffic from backend Apache servers. The most commonly used Windows version is Windows Server 2008, followed by 2012 and then the aging, unsupported Windows Server 2003. Windows Server 2016 accounts for only 3.7% of all Windows web-facing computers at the moment, but it is steadily growing – this month, the number of Windows Server 2016 computers grew by 14% to 66,800.

In the December 2017 survey we received responses from 1,734,290,608 sites across 212,870,632 unique domain names and 7,014,428 web-facing computers. This reflects a gain of 5.34 million domains and 121,000 computers.

Web Server Developers - Market Share of Domains

The number of hostnames in use on the web has been a headline metric since the inception of the Web Server Survey, but it has been subjected to quite large fluctuations in recent years. Netcraft has therefore introduced the number of unique domains as an additional metric that provides a more stable view of the web.

The domains metric is not influenced by wildcarded domains or other large numbers of sites that can be hosted under a single domain name with minimal effort; but unlike the active sites metric, the domains metric still takes account of sites that are still under construction, or running hosting company or domain registrar holding pages.

The noticeable spike in Apache-powered domains in May 2013 was caused by the largest hosting company of the time, GoDaddy, switching a large number of its domains from Microsoft IIS to Apache Traffic Server (ATS) . GoDaddy switched back to using IIS 7.5 a few months later.

Today, Apache still has the largest market share by number of domains, with 81.4 million giving it a market share of 38.2%. It also saw the largest gain this month, increasing its total by 1.53 million. This growth was closely followed by nginx, with a gain of 1.09 million domains increasing its total to 47.5 million. While Microsoft leads by overall number of hostnames, it lags in 3rd position when considering the number of unique domains those sites run on, with a total of 22.8 million.

Web-facing Computers

The number of web-facing computers provides an alternative view that corresponds more closely to the install base of each server vendor.

With 1.63 million web-facing computers, nginx is already 97,800 computers ahead of Microsoft since it took second place in October, but Apache remains much further ahead with a total of 2.98 million. Apache experienced the largest gain of 58,000 computers this month, closely followed by nginx with 49,000, and with Microsoft trailing with an increase of just 22,000.

Web Server Updates

Microsoft's Internet Information Services platform has benefitted from a few improvements since the publication of last month's survey. The newest version of the IIS Administration API (2.2.0) introduced new endpoints that make it easy to monitor the health of a web server, as well as the individual websites and application pools running on it. There is also a new configuration endpoint for the files API, which allows the API's root folders to be configured – this means administrators no longer have to edit a file to configure which sections of the file system can be accessed via the API.

Version 1.0 of the IIS CORS Module, which works on IIS 7.5 or later, was also released in November. This enables support for the Cross-Origin Resource Sharing protocol, which lets webpages make use of resources that are hosted on other websites, such as web fonts and AJAX endpoints. If a website hosts these resources without setting a suitable CORS policy, the default same-origin policy enforced by all browsers would prevent other websites from accessing them.

The latest version of the open source LiteSpeed HTTP server, OpenLiteSpeed 1.4.28 (stable), was released on 8 November. This release adds multithreading APIs for LSIAPI – the API that allows it to support third-party modules. Although there are only 12,400 web-facing computers running LiteSpeed, these computers host 2.42 million domains. It is not clear how many of these computers are already running LiteSpeed 1.4.28, as this server does not expose version information in its headers.

lighttpd 1.4.48 was subsequently released on 11 November. This adds a new mod_authn_sasl module, which provides Simple Authentication and Security Layer (SASL) authentication similar to Apache's libapache2-mod-authn-sasl module. With 20,800 web-facing computers running lighttpd, it has a greater install base than LiteSpeed, but its market share of domains is noticeably smaller with a count of 565,000.

nginx 1.13.7 was released on 21 November, although this addresses several bugs rather than introducing any new features. There are, however, several new features in the latest version of its commercially supported product, NGINX Plus Release 14, which was announced on 12 December. This release features several improvements, including an updated live monitoring dashboard and JSON support in its nginScript scripting language; and there is also a technology preview of its extended clustering support, which lets NGINX Plus instances in a cluster share state information.

In the November 2017 survey we received responses from 1,819,412,110 sites and 6,893,323 web-facing computers, reflecting a gain of 4.17M sites and 6,961 computers.

This month’s web server survey saw Microsoft’s market share amongst all sites fall by 12.64 percentage points due to a loss of 228M sites. Despite this, Microsoft still retains its place with the largest market share by this metric of 36.80%, with Apache trailing at 24.38%. The majority of the loss occurred at just one hosting provider where over 190M Microsoft sites were lost.

This change isn’t reflected in the active sites metric which only saw minor changes amongst the main web server vendors. Microsoft lost only 0.03 percentage points of its market share with a drop of 261k active sites. Apache leads in the active sites metric by a considerable margin, increasing its share slightly this month to 44.55%.

Amongst the top million busiest sites Microsoft experienced a small increase in market share, pausing its general decline in this market. nginx experienced the largest growth with an increase of 2,133 of the top million sites.

nginx also saw the largest increase in number of web-facing computers, gaining 25k and pulling 1 percentage point of market share clear of Microsoft, which it overtook last month. Apache also experienced a gain in computers, albeit smaller at just 7k. It remains considerably ahead with a 42.38% market share.

New gTLDs Seen for the First Time

This month the controversial new .search gTLD being run by Google’s Charleston Road Registry subsidiary was found for the first time, with www.nic.search responding to the survey. Google hopes it will be able to run .search as a dotless domain which will automatically redirect users to their search engine of choice. This proposal has been criticised for going against ICANN’s own rules, which prohibits this functionality due to the potential for conflicts with existing names on internal networks. This feature could also cause confusion for users who have come to expect that typing words into their address bar will perform a search query for that term.

It is currently uncertain whether or not Google will be allowed to run the .search TLD as a dotless domain, however with the launch of the first site on this TLD this month Google is one step closer to the provision of this service.