In the September 2018 survey we received responses from 1,642,339,233 sites, 222,628,534 unique domains, and 7,785,976 web-facing computers. This reflects gains of 1.1 million unique domains and 28,000 web-facing computers, but a loss of 19 million sites.

Despite the overall increase in number of unique domains this month, all of the major web server vendors experienced losses. The largest gains in September came from lesser known server software — Pepyaka increased by just over 2 million domains, and DPS increased by 893k domains — with both returning to previously seen usage levels after a couple of months of near absence from the survey.

DPS (Data Protection Server), currently the 11th largest server by domains, is used exclusively by GoDaddy to host customer sites that have been created with its Website Builder tool. Last month saw a temporary swing on a single GoDaddy IP Address from DPS to Microsoft, accounting for both last month's Microsoft gains, and this month's loss.

Pepyaka, now the 7th largest server by domains, was last seen in the survey in large volumes in June 2018, being primarily used by Wix web development platform on Amazon AWS infrastructure. Wix has been a long-time user of nginx, and originally moved all user traffic to the commercial NGINX Plus product to future-proof its load balancing needs. The version numbering used by Pepyaka (currently 1.13.10) combined with Wix's previous usage of nginx suggests that it could be based on the March 2018 mainline version of nginx. The loss of Pepyaka from the survey two months ago coincided with Wix moving its customers' sites from Amazon to Cogent Communications. The return of Pepyaka in the September survey coincides with a similar movement of its customers' sites from Cogent Communications to a combination of Wix's own and Google's infrastructure.

In the web-facing computer market, nginx was the only major web server vendor to experience a gain this month, with an increase of over 41,000 (+2%). Unusually both Apache and Microsoft saw a small loss in absolute numbers of web-facing computers this month, dropping 4,900 and 9,500, in addition to their on-going gradual declines in market share. This has resulted in nginx's market share rising to 27.0%.

In the August 2018 survey we received responses from 1,661,467,123 sites, 221,524,704 unique domains, and 7,758,309 web-facing computers. This reflects a loss of 2.21 million sites, but a gain of 952k domains and 23.9k web-facing computers.

While the Apache web server remains the current leading platform in terms of its total number of domains, computers, active sites, and its proportion of the top million busiest sites, it continues to lose market share. All of Apache's figures decreased this month, continuing a slow long-term decline in most metrics. However, Apache continues to experience long-term growth in the absolute number of web-facing computers of approximately 200k per year, but is still losing overall market share. Over the past 12 months, Apache's usage amongst the top million sites has steadily decreased from 39.1% to 34.8%, and the number of domains using its server software has fallen from 83.7 to 75.3 million.

Microsoft's web servers power the largest share of sites, increasing its total from 670 to 675 million this month, representing a 40.65% share. Microsoft servers also experienced the largest growth in terms of domains this month, with an increase of 1.74%, adding just short of a million additional domains to reach a total of 58.4 million. The vast majority of sites using Microsoft web servers run IIS 7.x, which accounts for over 500 million sites. In comparison, IIS 8.x can only be found on around 50 million sites. Despite this, IIS 7.x and 8.x can both be seen on a similar number of computers—562k and 529k respectively. A large portion of IIS 7.x's larger site count can be attributed to link farming, where many sites are often hosted on just a few computers.

Although nginx doesn't yet lead in any metric, it continues to show significant growth. Whereas Apache and Microsoft servers have both lost active sites, nginx has been gaining in numbers, having increased 17.9% over the past year up to 41.9 million—a 22.67% market share. nginx has also increased its total number of web-facing computers by 41.0% over the past 12 months to reach 2.06 million, whereas Apache's and Microsoft's totals have seen comparatively little change of +7.9% and -0.16% respectively. Long-term nginx growth can be seen in all metrics except for the less stable site count. Over the past 12 months, nginx has gained 20.2% more domains, increasing its total to 50.9 million to hold a 23.00% share.

Web giants doing it their way

Apache, Microsoft, and nginx have each achieved their widespread popularity in the server market due to their general availability, but many large companies in the web industry choose to roll out their own solutions. Web giants such as Google, Cloudflare, Alibaba, and Amazon have each turned to creating or modifying their own specialised server implementations to suit their own unique requirements.

Google's custom server software operates on over 23.1 million hostnames and 2.0 million domains. Google open sourced part of its software, the Google Servlet Engine, at the end of 2008, but the software has not received any official public updates in 9 years. Despite this, servers identifying themselves as "GSE" make up over 75% of the active sites hosted by Google itself, with a large portion of those sites constituting Google's Blogger service (blogspot.com). In fact, the Google Servlet Engine was identified on 13.9 million active sites, which is 2.4 million more than all of Microsoft's server software combined, granting it third place in this metric, behind only Apache and nginx.

Taobao, China's largest online marketplace and part of Alibaba Group, developed their own fork of nginx. The fork, known as Tengine, was released back to the community as open source, leading to wider adoption. Tengine now runs on 56.8 million sites, making it the fourth most popular web server by this metric, despite it having only 1.2 million domains.

Cloudflare uses its own custom stack in order to provide content for 18.2 million sites and 6.7 million domains. Cloudflare historically identified their servers as "cloudflare-nginx", however in early 2018 Cloudflare transitioned to identifying their servers as simply "cloudflare" due to the ongoing evolution of their stack. These "cloudflare" servers are now the fourth most commonly identified in terms of total domains.

In the July 2018 survey we received responses from 1,663,673,364 sites, 220,573,018 unique domains, and 7,734,417 web-facing computers. This reflects a gain of 33.4 million sites, 2.80 million domains, and 120k web-facing computers.

In the web-facing computer market, nginx experienced the largest increase (+3.24%), contributing more than half of the overall growth and surpassing two million web-facing computers this month. As a result, it was the only major vendor to experience a gain in market share. nginx also experienced the largest growth in terms of active sites (+7.87%), and top million sites (+0.71%), further increasing its market share in those metrics. Although nginx has slightly fewer domains than last month, it is generally seeing long-term growth in all metrics, and has gained around 10 million domains over each of the past three years.

Apache remains ahead in terms of domains, active sites, web-facing computers, and sites within the top million. However, it continues to see both long and short-term losses in many metrics, with steadily decreasing counts of domains (-0.53%), active sites (-1.15%), and top million sites (-0.98%).

Microsoft's server software leads by total number of sites, of which it had 670 million this month (a 40.28% share), but sits behind Apache and nginx in most other metrics. Microsoft retains second place in total number of domains with a 26.02% market share, and experienced the largest increase this month of nearly 1.4 million domains. This has increased the gap between it and third-placed nginx, which has been steadily gaining on Microsoft, now leaving them 3.24 percentage points apart.

The one metric in which all major vendors continue to see ubiquitous long-term growth is web-facing computers. Since July 2017, the total number of web-facing computers has increased by 1.14 million (+17.3%). This rate of growth is more than double that seen in the year before between July 2016 and July 2017. Although there have been overall increases in the number of computers running Apache and Microsoft webservers, both have continued to lose market share to their faster growing competitor, nginx.

Google's .app TLD takes off

.app is one of many new gTLDs from ICANN's New gTLD Program. ICANN appointed control of the .app TLD to Google after it won the rights in a $25 million auction against twelve other applicants in February 2015. Google hopes that the appropriately named .app TLD will appeal to websites providing applications and application-related services.

The .app TLD only opened for public registration fairly recently on the 8^th May 2018. This month's survey found 185k unique domains running websites under the .app TLD. Whilst many of these domains return parking pages, a number of fully-fledged sites, such as cash.app, have already been launched, with the Netcraft survey detecting over 15k active sites.

One of .app's marketed features is its inclusion within browsers' HTTP Strict Transport Security (HSTS) preload lists. The .app TLD is one of only thirteen where an HSTS preload policy has been applied to a whole TLD. This TLD-wide HSTS policy means that modern browsers will only access .app websites over a secure HTTPS connection, protecting users from trivial man-in-the-middle attacks.

In the June 2018 survey we received responses from 1,630,322,579 sites, 217,776,658 unique domains, and 7,614,764 web-facing computers. This reflects a gain of 45 million sites and 162,000 web-facing computers, but a loss of 98,800 domains.

Apache currently leads by most metrics, with the largest market share of domains (35.23%), active sites (41.13%), computers (40.28%), and top million sites (35.54%). However, it continues to gradually decline in market share, losing out to continued growth elsewhere, particularly by nginx. Most of Apache's figures fell this month, with the exception of a small 35k (+1.16%) rise in web-facing computers. Despite this gain in web-facing computers, its share fell slightly, by 0.4 percentage points.

The only metric where Apache does not retain the lead is web sites: Microsoft's server software has held the lead since July 2016. Although Microsoft web servers now account for 601 million sites, or 36.9%, relatively few of these are active sites. Microsoft servers account for 11.8 million active sites, a 6.62% share of the entire active site market, placing it behind both Apache and nginx. Internet Information Services (IIS) accounts for 97.8% of all domains using Microsoft server products, with Microsoft's light-weight HTTPAPI making up just 2.2% of Microsoft's domains. Only 8.0% of the web-facing computers running Microsoft IIS run the latest version available, IIS 10.0, released in October 2016 as part of Windows Server 2016. A greater proportion, 10.1%, are still running IIS 6.0, which reached end-of-life along with Windows Server 2003 almost 3 years ago.

nginx continues to rise in popularity, growing faster than its Apache and Microsoft competitors in all metrics except web sites. Although nginx's 23.35% domain share is still behind Microsoft's 25.73%, its continued growth has it on track to overtake Microsoft in a few months, and potentially even bring Apache within its sights in a couple of years. nginx holds second place in terms of active sites (21.64%), computers (25.84%), and the number of sites within the top one million (24.68%). This month, nginx had the largest gains in all metrics with the exception of overall web sites. Apart from its original distribution, nginx also comes in two other popular variants: Openresty, which is based on an nginx core with additional Lua-based modules, was seen on 2.0 million domains this month; and Tengine, an nginx fork maintained by Chinese ecommerce site Taobao, was seen on 1.2 million domains.

The LiteSpeed web server, which currently accounts for 1.27% of all domains, has also been slowly but steadily gaining adopters. It experienced the 3^rd largest increase in domains this month, gaining 125k, giving it a larger relative increase than Apache, Microsoft, or nginx servers. LiteSpeed has a slightly higher market share of 1.50% of the top million sites and 1.86% of all active sites.

In the May 2018 survey we received responses from 1,584,940,345 sites, 217,875,435 unique domains, and 7,452,628 web-facing computers. This reflects a loss of 198 million sites, but a gain of 3.36 million domains and 65,600 web-facing computers.

nginx saw moderate growth this month, gaining 1.17 million unique domains. This has increased its market share of domains by 0.19 percentage points, even though it lost 44.2 million sites.

The nginx ecosystem has continued to evolve over the past month, with some notable software releases:

• nginx 1.14.0 was released on the 17 April, which adds HTTP/2 server push support to the nginx stable stream (the recommended release stream for production web servers). HTTP/2 server push can improve the performance of some websites by pre-emptively pushing assets to browser clients, avoiding the need for the client to explicitly make additional GET requests for assets on a page such as images, stylesheets & JavaScript.
• The first production-ready release of NGINX Unit 1.0 was released on the 12 April, ending the product's beta period. NGINX Unit is a web application server that can serve sandboxed Go, Perl, PHP, Python and Ruby applications on the same server. It is unique in allowing dynamic reloading & remote configuration via a REST API rather than individual configuration files. A bugfix release, NGINX Unit 1.1, was subsequently made available on 26 April.
• MySQL monitoring support was added to NGINX Amplify on 23 April. This commercial SaaS monitoring product from NGINX Inc. could increase the appeal of transitioning MySQL & PHP applications from Apache-based stacks to nginx-based ones.

Despite losing 59.7 million sites this month, Apache still powers sites on the largest number of unique domains. Apache is also running on 36% of the world's top 1 million websites – 12 percentage points ahead of its closest competitor, nginx.

There was also a 21% reduction of the number websites running Microsoft web server software this month, with the majority of these losses (77%) coming from hosting provider Raksmart, which lost 107 million of these sites. Despite this, the hosting provider gained 49,600 domains that point to Microsoft web servers. Many of the lost websites featured automatically generated content, and so were not counted as Active Sites.

In the April 2018 survey we received responses from 1,783,239,123 sites across 214,513,048 unique domain names and 7,387,066 web-facing computers. This reflects a gain of 12.8 million sites and 53,500 computers, but a loss of 261,000 domains.

Microsoft dominated this month's hostname growth, with 25.1 million additional hostnames bringing its leading market share up by 1.15 percentage points to 36.9%. Meanwhile, Apache lost 8.2 million sites and nginx lost 5.7 million.

Microsoft fared less well in most other metrics, however. Despite its large increase in hostnames, Microsoft's domain count fell by 1.4 million, and it also suffered a loss of 5,360 web-facing computers and 51,300 active sites. Nonetheless, its presence within the top million sites grew by 517 sites.

nginx may have lost 5.7 million hostnames, but it showed the strongest growth in some of the most important metrics. This included a gain of 46,700 web-facing computers, 3.8 million domains, and an additional 4,280 sites in the top million. The noticeable uptick in nginx-powered domains this month has increased its market share of domains by 1.81 percentage points to 22.5%, leaving it only 3.5 points behind Microsoft. nginx has demonstrated fairly consistent domain growth since this metric was introduced in 2009, and if these trends continue, it could feasibly take second place from Microsoft within a year.

Apache suffered losses in every metric this month, including a loss of 3.0 million domains and 1.1 million active sites, along with 2,840 sites within the top million. Nonetheless, it maintains a comfortable lead in every metric except hostnames, where its 25.6% market share is 11.4 points behind Microsoft's.

Some of the highest-traffic sites using Apache today include news website www.bbc.com; financial sites like www.xe.com and www.paypal.com; the Steam online gaming store at store.steampowered.com and its community forum at steamcommunity.com; and sites used by ad networks, like ads.pubmatic.com and c.betrad.com.

Apache Tomcat – the hidden backend

More than 450 million websites are currently using the Apache HTTP server, but this is not the only web server product offered by the Apache Software Foundation. The Apache Tomcat project provides an open source implementation of Java Servlet and JSP technologies, but its deployment is hard to quantify.

Tomcat is often used as a backend application server, with the Apache Tomcat Connectors project connecting it to other web-facing servers like Apache and Microsoft IIS. In many of these cases, Tomcat cannot be detected passively, although it may be possible to confirm its use during a web application security test – for example, by tricking the application into returning a Java stack trace.

Tomcat also includes its own native HTTP connector that allows it to be used as a standalone HTTP server, and these servers can be passively identified from their "Apache Tomcat" server headers. However, this is not a commonly used configuration: Only 10,300 websites exhibited the Apache Tomcat server header this month, and only 35 of these sites were ranked within the top million.

Several different versions of Apache Tomcat are available, depending which version of Java needs to be supported. Surprisingly, most Tomcat servers that are exposed directly to the internet are running Apache Tomcat 4.1.x, which has not been supported for several years. Actively maintained versions include 9.x, 8.5.x, 8.0.x and 7.x, although support for 8.0.x will end on 30 June 2018. The most recent versions of Apache Tomcat are 8.5.30 and 9.0.7, which were both released on 7 April.

Other new releases

The mainline branch of nginx has seen three new releases since last month's survey. nginx 1.13.10 was released on 20 March 2018, and added a few new features including the ngx_http_grpc_module module, which allows requests to be passed to a gRPC server. nginx 1.13.11 was subsequently released on 3 April, followed by nginx 1.13.12 on 10 April. These releases include a few bug fixes and an improved proxy protocol feature.

nginx also announced the release of njs 0.2.0 on 3 April. njs implements a subset of the JavaScript language, allowing location and variable handlers to be used in nginx's ngx_http_js_module and ngx_stream_js_module modules.

OpenLiteSpeed 1.4.31 (stable) and 1.5.0 RC3 were released on 11 April 2018. This open source server cannot be distinguished from the commercially available LiteSpeed Web Server, as both products use the same "LiteSpeed" server header. More than 12.5 million sites exhibit this header, across 13,600 web-facing computers.

Tengine 1.4.2

Nearly 28 million websites are using Taobao's nginx-based Tengine web server, but 74% are still running a version that was released several years ago, despite later releases including not just new features, but also security fixes. The most extensive user of Tengine 1.4.2 – which was released in November 2012 – is the Chinese cloud computing infrastructure service provider Aiyun Network.

Uptake of new Tengine releases is generally slow across the internet. The latest version, Tengine 2.2.2, was released on 26 January 2018, but only 262 sites are currently using it. Most of these sites are hosted by Internet Vision in Lithuania, while handfuls of other early adopters are hosted on low-cost cloud hosting platforms provided by Aliyun, DigitalOcean and Linode.

The poor uptake of newer releases could be partly caused by their lack of visibility on the Tengine website at tengine.taobao.org. The latest version that can be downloaded from the News section on the homepage is the 2.2.0 development version that was released in December 2016, followed by the 2.1.2 stable version from December 2015. Download links for the much-newer 2.2.1 and 2.2.2 releases can only be found on a separate download page.

cloudflare-nginx still lingers

Cloudflare's migration to its new cloudflare server header is not yet over, with more than 10,000 websites still using the old cloudflare-nginx header. These account for less than 0.07% of all Cloudflare sites in the survey, so the migration is very close to completion.

Cloudflare recently increased the size of its European network to 41 cities, expanding its global network to 151 cities across 74 countries. Its highest data centre is 2.6 km above sea level in the city of Bogotá, Columbia.