In the March 2017 survey we received responses from 1,760,630,795 sites and 6,271,146 computers, reflecting a loss of 31 million sites, but a gain of 34,000 computers.

nginx was the only major web server vendor to increase its market shares in all four metrics this month. Its share of websites grew by 0.49 percentage points, reaching nearly 20%, and its share of web-facing computers grew by 0.39 p.p. to 19.6%. The latter gain was driven by a 31,000 growth in the number of computers running nginx, which was by far the largest computer growth in the survey.

Microsoft suffered the largest loss in March, falling by 70 million sites and taking its share down by more than 3 percentage points. This drop paved the way for Apache to claw back 0.91 points with its gain of 9.4 million sites. Microsoft's market share of sites now stands just below 40%, though this remains nearly as much as Apache and nginx combined.

Microsoft also suffered the largest and only loss of active sites among the major vendors, reducing its total count of active sites by 421,000. Microsoft's active sites share is now less than 9%, far behind nginx's share of 19.7% and Apache's 45.8%.

nginx was the only major vendor to increase its presence within the top million sites, increasing its count by 1,592, while Apache lost 3,502 and Microsoft lost 746.

Microsoft web servers

Among the 704 million sites that are powered by Microsoft web server software, Windows Server 2008 is still the most commonly used platform. The original version of this operating system shipped with Microsoft IIS 7.0 as its web server, while the subsequent Windows Server 2008 R2 release included IIS 7.5. More than half a billion websites are hosted on Windows Server 2008 computers (including R2), which accounts for 72% of all Windows-hosted websites.

Although its R2 version was released more than 7 years ago, Windows Server 2008 is likely to remain prevalent for several more years. Last year's launch of the Windows Server Premium Assurance program allows customers to extend Windows Server 2008's support period from 10 to 16 years, giving access to security updates (as well as "critical" and "important" bulletins) until January 2026.

A further 185 million sites are still running on Windows Server 2003 computers, which are not covered by the Windows Server Premium Assurance program. The extended support period for Windows Server 2003 ended on July 14, 2015, so unless site operators have a special agreement in place, Microsoft will no longer be issuing security updates for any version of Windows Server 2003. US-CERT warned that these unsupported installations of Windows Server 2003 are exposed to an elevated risk of cybersecurity dangers, such as malicious attacks or electronic data loss.

Microsoft's newest operating system, Windows Server 2016, may still seem in its infancy, but it is now starting to show promising growth. 80,200 sites are now being served from Windows Server 2016 machines, which is nearly 20,000 more than last month. The number of web-facing computers running Windows Server 2016 also grew by 2,509, while Windows Server 2008 lost 2,316.

Windows Server 2016's computer growth was outpaced only by Window Server 2012, which gained 7,100 computers this month. Windows Server 2012 now accounts for 463,000 web-facing computers, which is nearly half as many as Windows Server 2008, but it is used to host far fewer websites – just 22 million compared with the 535 million sites hosted on Windows Server 2008 computers.

In the February 2017 survey we received responses from 1,792,104,054 sites and 6,236,791 web-facing computers, reflecting a loss of 7.9 million sites and 91,200 computers.

nginx gains sites and computers

nginx had the largest growth of both sites and web-facing computers amongst the major vendors this month, enjoying a gain of 31 million sites and 13,400 computers, while hefty losses by Microsoft and Apache led to the overall losses seen in this month’s survey. Microsoft lost 48 million sites and 9,900 computers, while Apache lost 13 million sites and 85,700 computers.

Much of the loss of web-facing computers using Apache is the result of declining numbers of Western Digital My Cloud personal storage devices being found in Netcraft's survey. These devices allowed consumers to access their files remotely using public hostnames under the wd2go.com domain. This disappearing act might have been influenced by the three My Cloud firmware updates that were released in December – the first of these changed how files are accessed from the My Cloud web and mobile apps, and the other two resolved a security vulnerability related to remote access.

Despite suffering the largest loss, Microsoft web servers power 43.2% of all sites on the internet, more than twice Apache's share. Meanwhile, nginx's growth has increased its own count to 348 million, bringing it to within striking distance of Apache. This highlights a dramatic change in fortunes for Apache, which was comfortably in first place a year ago, but is now under threat of falling into third place.

In terms of web-facing computers, Apache continues to fare well. While its 3% decline is significant in the space of a month, Apache's 2.7 million computers still give it the lion's share of the market (44.1%). This is followed by Microsoft's 1.5 million computers (24.7%), and nginx's 1.2 million (19.2%).

nginx was also the only major vendor to make a gain within the top million busiest sites. Its share grew slightly to 28.34%, while Apache suffered the largest loss of 0.21 percentage points, taking its share down to 41.41%, though Apache maintained its first-place position with a lead of 13.1 percentage points over nginx.

Apache still strong in active sites

Despite its losses elsewhere, Apache gained 887,000 active sites this month. nginx made the second largest gain, with an increase of 757,000 active sites. The active sites metric is more appropriate for some applications, as it counts websites but excludes those that contain automatically generated content such as domain holding pages.

Apache also has the largest share of this market (45.8%), with its total number of active sites now reaching almost 80 million – comfortably ahead of nginx, which takes up second place with 34 million active sites.

LiteSpeed 5.1.13 addresses DDoS vulnerability

February saw some new releases of the LiteSpeed web server. Most notably, version 5.1.13 was released on 17 February, after some LiteSpeed Enterprise customers reported service disruptions. These were caused by a surge of distributed denial of service (DDoS) attacks that specifically targeted a bug in LiteSpeed servers earlier that day. Rather impressively, it took LiteSpeed less than two hours to identify the heap buffer overflow that was responsible for the problem, push a bug fix build of 5.1.12, and release 5.1.13.

Looking ahead, it is likely that the first release in the 5.2 branch of LiteSpeed will support HTTP/2 Server Push, which could speed up some websites by allowing the server to send resources to clients before the browser has requested them. This feature has already been implemented in the second release candidate (5.2RC2), which was made available on 13 February.

LiteSpeed gained 42 million sites this month as a large number of sites under the .science gTLD reappeared. This did not have a positive impact on its computer count, however, which fell by 666 to 23,240.

Other new releases from web server vendors

Apache 2.2.32 was released on 13 January. This is the latest version in the 2.2 legacy branch, which now enforces a stricter HTTP request grammar, corresponding to RFC 7230 for request lines and request headers. This addresses a security vulnerability (CVE-2016-8743) that might have allowed malicious clients or downstream proxies to carry out response splitting and cache pollution attacks. This release also mitigates the "httpoxy" (CVE-2016-5387) issues that were already addressed in the 2.4 stable branch.

New stable and mainline versions of nginx were also released in the past month. nginx 1.10.3 stable was released on 31 January, followed by nginx 1.11.10 mainline on Valentine's Day. Both versions include several bugfixes, while the mainline release also introduces a few new features.

Meanwhile, documentation for the Microsoft IIS Administration API is now available. This REST API allows IIS instances to be configured with any HTTP client, using tools such as the one available at manage.iis.net. The rationale for providing the API is to have an open and standard interface that can be used from any platform, unlike AppCmd.exe, which can only be run on Windows.

In the January 2017 survey we received responses from 1,800,047,111 sites and 6,328,006 computers, reflecting a gain of 61 million sites and 159,000 computers.

Microsoft gained the largest number of sites this month – 38 million – although it was closely followed by Apache, which gained 32 million. Nearly 822 million sites (45.7%) are now powered by Microsoft webserver software.

Meanwhile, nginx gained 17 million sites, and has also continued to show strong and steady computer growth. This month's gain of 60,000 web-facing nginx computers was the largest seen by any vendor, outweighing Microsoft's and Apache's gains of 40,000 and 20,000. If last year's trends continue in 2017, it seems plausible to expect that nginx could overtake Microsoft to become the second largest vendor (by computers) in the second half of 2017.

Microsoft's latest version of Internet Information Services – IIS 10.0, which uses Windows Server 2016 as its primary platform – was found powering 45,000 websites this month. Future migration to IIS 10.0 may be slower than with previous IIS versions, however, as Microsoft announced Windows Server Premium Assurance in December 2016, which extends the support period from 10 to 16 years for existing Windows Server products. This means Premium Assurance customers will continue to receive security updates (as well as "critical" and "important" bulletins) for Windows Server 2008 until January 2026. In January 2017, more than 600 million sites are served from Windows Server 2008 machines.

Each of the other major server vendors released updates last month. nginx 1.11.7 mainline version was released on 13 December, followed by 1.11.8 on 27 December. Both releases included several bug fixes and a few new features.

The mainline 1.11.x branch of nginx is typically updated every 4-6 weeks and is aimed at users who require the latest features, whereas the 1.10.x stable branch is only updated when critical issues need to be fixed. Only two updates have been released on the stable branch since 1.10.0 was forked from mainline in April 2016. Stable is the most commonly used branch: nearly 24 million sites are using 1.10.x stable, compared with 2.2 million using 1.11.x mainline.

Apache 2.4.25 was released on 20 December 2016, incorporating security, feature and bug fixes (including many from the unreleased 2.4.24 version). The security fixes include a mitigation for issues caused by the httpoxy vulnerability, and better enforcement of the HTTP request grammar in RFC 7230 to reduce the likelihood of response splitting and cache pollution attacks.

While many sites still use older versions of Apache, such as the 2.2.x legacy versions, the Apache Project continues to point out that the latest release from the 2.4.x stable branch represents the best available version of Apache HTTP Server. Nonetheless, most sites—just over 100 million— report to be using 2.2.x legacy versions, compared with 69 million sites that use 2.4.x. The most commonly observed Apache Server banners are Apache/2.4.7 (Ubuntu) (36 million sites), followed by Apache/2.2.15 (CentOS) (25 million); however, these servers may not necessarily be as old and vulnerable as their version numbers imply. Netcraft previously discussed this "backporting" behaviour a few years ago.

LiteSpeed suffered the largest loss of sites this month, returning to October 2016 levels after plummeting by 42 million sites to leave a total of 5.5 million. Despite the large loss of sites, the number of web-facing computers using LiteSpeed increased modestly by 323 to 9,740. LiteSpeed 5.1.11 was released on 15 December, featuring improved caching and a few bug fixes.

December also saw the release of Tengine 2.2.0 development version, which came nearly two years after the previous development version, and a year after the most recent stable version. Not only does Tengine have a relatively sedate release cycle, but its latest version is based on nginx 1.8.1 (the final version of nginx's previous stable branch), which itself is already a year old.

Despite having relatively infrequent releases, 58 million sites are currently using Tengine. Most of these sites do not reveal which version has been installed, but among the 18 million that do, about two-thirds are using the relatively old 1.4.2 development version which was released in November 2012 and based on the nginx 1.2.x stable branch. Tengine was originally created by the Chinese marketplace Taobao, which modified the nginx core to better suit its requirements. It was released as an open source project in December 2011, and today sites under the taobao.com domain account for only 5% of its users.

In the December 2016 survey we received responses from 1,739,031,487 sites and 6,169,471 web-facing computers; this reflects a large increase of 302 million sites, but a small loss of 55,900 computers.

All three of the largest server vendors gained sites this month, with growth concentrated at a handful of lesser-known web hosting providers. These changes have triggered large jumps in market share, with nginx (+3.2 percentage points) and Microsoft (+1.6 p.p.) gaining, and Apache losing (-2.2 p.p.).

The growth in number of sites was not reflected in other metrics this month, however, with small drops being seen in both the total number of web-facing computers (-0.9%) and the number of active sites (-0.8%).

Nginx was the only major web server vendor to experience gains across all metrics this month, including active sites, web-facing computers, and the million busiest sites. It now stands only 390,000 computers (6 percentage points) behind second place Microsoft, having surpassed Microsoft in terms of active sites in January 2012, and the top million busiest sites in May 2013.

Previously the 10th most commonly seen web server in terms of active sites, “Webs.com/1.0”, has vanished this month after the website builder began using the Cloudflare CDN service. Cloudflare uses a customised version of nginx (cloudflare-nginx), that powered over 3.6 million active sites in the December survey.

Looking back over 2016, the total number of sites seen in the survey has grown significantly, from 900 million in January to 1.7 billion in December. Much of this growth can be attributed to Microsoft, which has gained more than 520 million hostnames and risen from 28.95% market share to 45.07%. However, the more stable active sites metric shows nginx grew the most this year, having increased by 4.8 million active sites and 2.85 percentage points of market share over the course of 2016.

The year also saw the notable rise of OpenResty: in January, OpenResty was being used by 760,000 sites, 200,000 active sites, and just 3,100 web-facing computers; but in September, tumblr.com switched from using nginx to OpenResty for millions of Tumblr blogs. The number of sites using OpenResty in December is now nearly 15 million, the number of active sites is 5.8 million, and the number of web-facing computers seen running OpenResty has increased to nearly 8,000. The server is now the 9th most popular by number of web-facing computers.

Microsoft’s newest web server software, IIS 10.0, was released this year although it is yet to make a significant impact in the number of sites. Windows Server 2016, the primary operating system for running IIS 10.0 was only fully released in October after months of preview releases; the December 2016 survey finds the operating system being used on 5,800 web-facing computers to host 18,250 sites.

Another notable arrival during 2016 were the hundreds of thousands of Western Digital My Cloud personal storage devices. These Network Attached Storage (NAS) devices run an Apache web server and each has a hostname on the wd2go.com domain. The fact that these devices are placed in end-users' homes, using less-stable home Internet connections, and more commonly powered off than a typical web server has increased the volatility of the Apache web-facing computer data. The December 2016 survey found 680,000 sites for these devices.

In the November 2016 survey we received responses from 1,436,724,046 sites and 6,225,374 web-facing computers, reflecting a gain of 7 million sites and 81,000 computers.

nginx was the only major vendor to gain hostnames this month, increasing its site count by 6.1 million, while Apache and Microsoft lost 16.6 million and 12.4 million.

Outweighing the existing major vendors, LiteSpeed demonstrated the largest hostname growth after it gained more than 40 million sites – a remarkable 740% increase. LiteSpeed's growth included 38 million existing sites that were hosted by OVH, and previously using Taobao's Tengine web server, which consequently suffered the largest loss of sites this month. The sites involved in this movement—nearly all of which make use of the .science TLD—are now hosted by Amazon Web Services. As a result of these changes, LiteSpeed's market share of sites has leapt from 0.39% to 3.29%, taking it from 10th to 4th place – while Tengine has been displaced to 5th.

Using the less-volatile web-facing computers metric, Apache showed the largest growth this month with an increase of 39,900 computers, while nginx was not too far behind with net growth of 32,881. Despite LiteSpeed's large hostname growth, it gained only a modest sum of 312 computers (+3.4%), making it the 7th largest vendor by this metric.

OpenResty gained significant traction in September after millions of Tumblr blogs switched from using nginx. This month, OpenResty gained a further 560 web-facing computers (+7.8%), taking its total up to 7,700. It also gained half a million more sites, but not all of the new sites are used by Tumblr blogs this time, which indicates growing interest amongst other users. More than a tenth of the new sites found using OpenResty in November are being used to serve PHPWind forum installations hosted by Raksmart in China, and thousands more new OpenResty sites are found at the likes of Fastly, DigitalOcean and Amazon Web Services.

Microsoft's latest server software, IIS 10.0, has yet to make significant inroads on the web, with the total number of sites using it still floating around 10,000; however, its primary platform—Windows Server 2016—has only been available since October. Preview releases have been available for several months, though, and so the number of web-facing computers using Windows Server 2016 has gradually been creeping up. Netcraft found a total of 4,347 Windows Server 2016 computers in the November survey.

In the October 2016 survey we received responses from 1,429,331,486 sites and 6,144,093 web-facing computers. This reflects a large increase of 144 million sites, and a more modest increase of 25,300 computers.

Microsoft once again saw the largest increase of web sites this month, gaining 95 million. Apache and nginx made up the majority of the remainder of web site growth, gaining 25 million and 11 million. Despite Microsoft’s large gain of web sites, it lost both web-facing computers (-17,700) and active sites (-1.2 million).

Apache saw the largest increase of active sites this month, gaining 1.8 million, while nginx gained 400,000, the second largest growth. These gains, coupled with Microsoft’s loss of 1.2 million active sites, led to Microsoft’s share of active sites dropping to 9.27%, the first time that it has fallen below 10%. Apache increased its market share by 0.19 percentage points and continues to dominate, now with 46.30% of the active sites.

The largest increase of web-facing computers was made by nginx, gaining 20,000. Despite now having more than twice as many active sites as Microsoft, nginx remains in third place by number of web-facing computers with 17.41% of the market, compared to Microsoft’s 24.91%. Apache leads, running on 45.97% of all web-facing computers, however, both Apache and Microsoft are gradually losing market share to nginx.

Within the million busiest sites, the long-term trend is the ascent of nginx, at the expense of both Apache and Microsoft. This month continues that trend, with Apache losing 0.13 percentage points, Microsoft losing 0.14, and nginx gaining 0.20. However, Apache still leads by a significant margin over second-placed nginx, with 146,000 more of the million busiest sites using Apache.