june 2022 web server survey

June 2022 Web Server Survey

Web server market share for domains
In the June2022study we got actionsfrom 1,146,976,964 websites
throughout 273,010,403 one-of-a-kind domain names and also 12,224,786 web-facing computer systems. This mirrors a loss of 8.75 million websites and also 583,000 domain names, yet a gain of 155,000 computer systems. Cloudflare experienced solid

developmentthis month,
getting 2.99 million websites and also 85,000 domain names, standing for

a 4.64%development in its variety of websites. Cloudflare experienced a substantial failure on 21June, influencing around fifty percent ofthe overall demands made to its network. The

failure lasted around a fifty percent and also a hr as well as impacted a considerable variety of prominent websites. 20.2%of the million most seen websites rely upon Cloudflare (up 1,400 websites given that last month). The 3 biggest suppliers by the million most checked out websites statistics– Apache, nginx, as well as Cloudflare– all have comparable market share, though just Cloudflare got market share this month. Apache saw the biggest loss, going down 2,190 websites(-0.96% ), while nginx shed 280 websites( -0.13%). LiteSpeed got a considerable number of websites with an enhancement of 2.96 million(+5.89% ), and also got 171,000( +2.21%)domain names-the 2nd biggest boost this month. The variety of web-facing computer systems making use of LiteSpeed additionally revealed solid development, boosting by 4,460(+3.44 %)to an overall of 134,000. nginx and also Apache stay both

biggest web server suppliers, though both saw comparable losses of 6.52 million(-1.84%)and also 6.18 million(-2.33 %)websites this month. In spite of this, nginx got 795,000(+1.06%)domain names and also saw ongoing development in the variety of web-facing computer systems with 158,000(+3.44 %)computer systems. Alternatively, Apache shed 1.07 million domain names( -1.71%) as well as 25,700(-0.74%)web-facing computer systems. Supplier information Apache httpd 2.4.54 was launched on 8 June 2022. This launch settles numerous protection concerns, consisting of numerous that influence mod_lua. nginx 1.23.0 was launched on 21 June 2022. This is the initial launch in the 1.23.x mainline branch which will certainly consist of recently created attributes as well as insect repairs. Comparative, the 1.22.x steady branch launched last month will just get significant insect solutions from the 1.23 mainline launch. The upgrade consists of a number of modifications that impact headers along with numerous insect solutions. njs 0.7.5 was additionally launched on 21 June along with nginx 1.23.0. njs is nginx’s JavaScript-based scripting language, and also this upgrade consists of a number of tiny adjustments influencing headers along with insect repairs. Lighttpd 1.4.65 was launched

  • on 7 June 2022, bringing with it an execution of WebSockets over HTTP/2. The launch likewise consists of a news of future arranged behavior modifications that
  • consist of making use of solid, modern-day TLS cipher collections by default. Apple revealed assistance for Private Access Tokens in upcoming launches of iphone and also macOS. This becomes part of the Privacy Pass basic, a partnership in between Apple, Google, as well as Cloudflare that can change CAPTCHAs throughout the internet by supplying a safe and secure method for the gadget to prove that it is a genuine gadget. Google Cloud lately included 5 brand-new local information facilities, taking the overall variety of readily available GCP areas to 34. The brand-new areas included remained in Columbus, OH, Madrid, Dallas, TX, Milan, and also Paris. Developer May 2022 Percent June 2022 Percent Modification nginx 354,871,628 30.71 %348,349,326 30.37% -0.33 Apache 265,688,420 22.99%259,509,062 22.63%-0.36 OpenResty 92,848,366 8.03% 92,789,967 8.09%0.06 Cloudflare 64,369,545 5.57%67,355,920 5.87%0.30

    LiteSpeed got a considerable number of websites with an enhancement of 2.96 million (+5.89%), and also got 171,000 (+2.21%) domain names – the 2nd biggest rise this month. Apache saw the biggest loss, going down 2,190 websites(-0.96% ), while nginx shed 280 websites( -0.13%). LiteSpeed obtained a considerable number of websites with an enhancement of 2.96 million(+5.89% ), as well as obtained 171,000( +2.21%)domain names-the 2nd biggest rise this month. Regardless of this, nginx acquired 795,000(+1.06%)domain names as well as saw ongoing development in the number of web-facing computer systems with 158,000(+3.44 %)computer systems. On the other hand, Apache shed 1.07 million domain names( -1.71%) and also 25,700(-0.74%)web-facing computer systems.

    Read More »
    may 2022 web server survey

    May 2022 Web Server Survey

    In the May 2022 survey we received responses from 1,155,729,496 sites across 273,593,762 unique domains and 12,069,814 web-facing computers. This reflects a loss of 5.23 million sites but a gain of 1.63 million domains and 95,200 computers.

    nginx gained the largest number of domains (+1.24 million) and also a hefty amount of web-facing computers (+21,500), further securing its lead in both metrics. The total number of domains powered by nginx is now 75.0 million (+1.68%) and its market share has increased to 27.4% (+0.29). In terms of web-facing computers, nginx now has a total of 4.60 million; and although its leading market share fell slightly to 38.1%, Apache’s fell slightly further, extending the gap between the two to 9.54 percentage points.

    nginx also continues to lead with a 30.7% share of all sites, despite losing the largest amount this month (-6.57 million). Apache follows with a share of 23.0%, but also lost a large number of sites (-2.32 million). The largest gain in this metric was seen by Google, which added 2.96 million sites to its total and increased its market share to 4.14%. LiteSpeed made the second largest gain of 1.26 million sites, and stays slightly ahead of Google with a share of 4.35%.

    Google and LiteSpeed also made the only significant gains in the active sites metric, with Google gaining 977,000 and LiteSpeed gaining 151,000. Google has a greater lead in this metric, with a market share of 9.49% versus LiteSpeed’s 4.60%.

    Cloudflare is continuing to edge its way up towards the leaders in the top million websites. This month it gained an additional 1,822 sites and now accounts for more than 20% of the top million sites for the first time. Meanwhile, both Apache and nginx lost more than a thousand sites each in the top million, making it look ever more likely that Cloudflare could gain places by the end of the year. Apache, nginx and Cloudflare currently have top-million site shares of 22.8%, 21.7% and 20.0% respectively.

    One surprise this month was that the largest computer growth was seen not by nginx, but by the awselb (Amazon Web Services Elastic Load Balancing) web server, which gained 26,200 computers to reach a total of 378,000. These computers are likely to form only a small fraction of the AWS infrastructure used by the 1.86 million sites that are served from these computers, as AWS ELB achieves fault tolerance and scalability by automatically distributing incoming application traffic across multiple targets, and can also spread traffic across multiple AWS Availability Zones.

    Vendor news

    • nginx 1.22.0 was released on 24 May 2022. This is the first release in the 1.22.x stable branch and incorporates new features and bug fixes from the 1.21.x mainline branch. Some of the notable new features include support for OpenSSL 3.0 and the PCRE2 library, as well as some security improvements such as hardening against potential request smuggling and cross-protocol attacks.
    • njs 0.7.4 was also released on 24 May 2022. This version of nginx’s JavaScript-based scripting language includes several bug fixes and adds extended directives for configuring the Fetch API.
    • Apache Tomcat 9.0.63, 10.0.21 and 10.1.0-M15 (alpha) were released on 16 May 2022. Tomcat 8.5.79 was later released on 23 May. Amongst other changes, all of these versions include a new error message that is shown when the Linux kernel duplicate accept bug is detected. This change follows the identification of the root cause of the bug along with the kernel version that includes the fix.
    • OpenResty was released on 18 May 2022. This web platform now uses nginx 1.21.4 mainline as its core and incorporates many other new features, including support for BoringSSL.
    • On 3 May 2022, Microsoft announced the general availability of its next-generation WAF (web application firewall) engine on Azure Application Gateway. This makes use of Open Web Application Security Project (OWASP) Core Rule Set 3.2 (CRS 3.2), which is intended to provide increased coverage for web vulnerabilities, reduce false positives, and protect against specific vulnerabilities like Log4J and SpringShell.
    • Microsoft has also expanded its Azure Migration and Modernization Program (AMMP) to encourage more customers to move their web applications to Azure. Azure also offers free Extended Security Updates for SQL Server 2012 and Windows Server 2012, giving more time to modernize older applications for three additional years beyond the 10 years granted by Microsoft Support.
    • Cloudflare made several new features available during the month of May, including:
    Total number of websites
    Web server market share
    DeveloperApril 2022PercentMay 2022PercentChange
    Read More »
    april 2022 web server survey

    April 2022 Web Server Survey

    In the April 2022 survey we received responses from 1,160,964,134 sites across 271,960,629 unique domains and 11,974,636 web-facing computers. This reflects a loss of 8.66 million sites and 217,000 domains, but a gain of 97,400 computers.

    Amongst the top ten vendors, nginx gained the largest number of domains and computers this month, maintaining its lead in both of these metrics. Its net growth of 537,000 domains has taken its total up to 73.8 million domains and increased its market share in this metric to 27.1%. Coupled with a net loss of 573,000 domains powered by Apache, this has culminated in nginx’s market share lead over Apache being extended from 3.63 percentage points to 4.04.

    The number of web-facing computers running nginx grew by 80,200 (+1.78%), pushing its market share up to 38.3% while Apache’s fell to 29.0%. nginx also continues to have the largest market share of sites (31.1%), despite losing more than half a million this month.

    Within the top million websites, Cloudflare made the largest gain of 3,350 sites as it continues to edge its way up towards the leaders. Apache is currently still in the lead with 229,000 sites in the top million, but lost 1,700 this month; and nginx is in second place with 218,000 sites after losing 2,250. Cloudflare now has 199,000 sites and looks set to overtake both nginx and Apache by the end of the year if it maintains this pace of growth. Amongst all websites, Cloudflare lost 38,400 sites but gained 115,000 domains.

    OpenResty was the major vendor that gained most sites this month, increasing its total by 1.47 million to 93.0 million (+1.61%), and it also gained 6,890 web-facing computers.

    While most of the top vendors lost active sites this month, Pepyaka made a significant gain of 1.22 million active sites (+27.6%). This server is predominantly used by the Wix web development platform, which switched from using nginx in 2018. It is currently the 8th most commonly used web server by active sites, and 11th by sites. Similarities in the version numbering since 2018 suggest Pepyaka is likely based on mainline releases of nginx.

    Further down the field, GHS gained 1.08 million (+36.7%) sites and 554,000 (+35.5%) domains. GHS (Google Host Server) is one of Google’s proprietary web servers, which can be used by sites registered through Google Domains. It is also still used to redirect traffic from googlepages.com sites that were created with Google Page Creator. When this website creation service shut down in 2009, existing pages were migrated to Google Sites, which hosts user content in subdirectories under the sites.google.com hostname.

    Vendor news

    • Apache Tomcat 8.5.78, 9.0.62, 10.0.20 and 10.1.0-M14 (alpha) were released on 1 April 2022. Amongst other changes, all of these releases include a mitigation for a Spring Framework vulnerability (CVE-2022-22965) that could make some Tomcat servers vulnerable to remote code execution attacks.
    • Tomcat Native 1.2.32 was released on 22 March 2022. This is an optional component for use with Apache Tomcat that can provide better performance and compatibility by allowing Tomcat to use certain native resources.
    • njs 0.7.3 was released on 12 April 2022. This is the JavaScript-based scripting language that can be used to extend the functionality of nginx, and the latest version now allows the host environment to control how imported modules are loaded.
    • OpenResty RC3 was released on 18 April 20202. This includes some bugfixes and uses a newer version of the LuaJIT 2 compiler.
    • Microsoft Azure now offers a bring your own IP address (BYOIP) feature with Custom IP Prefix that lets customers bring their own public IPv4 address ranges to Azure in all public regions. These ranges can then be associated with Azure resources, interact with private addresses and VNETs within Azure’s networks, and reach external destinations via Microsoft’s Wide Area Network.
    • Cloudflare’s Magic Transit DDoS mitigation solution now offers a new mode (On Demand + Flow-based Monitoring) that integrates Kentik Protect to automatically detect attacks.
    • Finally, have you noticed fewer CAPTCHAs on the web? Cloudflare has reduced the number of CAPTCHAs it serves by 91% over the past year, and now plans to stop using them altogether.
    Total number of websites
    Web server market share
    DeveloperMarch 2022PercentApril 2022PercentChange
    Read More »
    march 2022 web server survey

    March 2022 Web Server Survey

    In the March 2022 survey we received responses from 1,169,621,187 sites across 272,177,331 unique domains and 11,877,217 web-facing computers. This reflects a loss of 4.00 million sites, but a gain of 977,000 domains and 103,000 web facing computers.

    Cloudflare gained the largest number of sites, with 1.32 million more than in the February survey. Its growth was also consistent across other metrics, having gained +176,000 domains (+0.77%) and +256,000 active sites (+1.24%), with an extra 0.12pp share of the top one million sites.

    nginx, the current leader by most metrics, had a particularly strong growth in terms of domains, having gained 978,000 domains (+1.35%) this month—the largest gain of any vendor in this metric. Though it lost 2.98 million sites, it appears to be serving more interesting content overall, as measured by a 158,000 increase in its number active sites. It also gained the most additional web-facing computers out of all vendors this month, with 39,300 more than the previous month. OpenResty, which uses nginx, is serving 62,300 more active sites and now counts towards an additional 441 of the top one million sites. OpenResty was also counted on 6,640 more computers (+5.04%) than last month.

    Apache has the greatest number of active sites and, by a narrow 1.03pp margin over nginx, the greatest share of the top one million sites. However, it shrunk in both of these metrics, losing 583,000 active sites and 2,130 of the top one million. Apache lost out in most other metrics too, with 756,000 fewer domains and just over 5 million fewer sites. It did, however, gain a few more computers over last month, but nginx’s large growth meant that Apache still lost market share in this measurement.

    Microsoft saw declines in all metrics this month, losing 3.22 million sites (-7.13%), 156,000 domains (-1.75%), 118,000 active sites (-1.88%), and 7,620 computers (-0.57%). Microsoft also lost 1,000 sites from its share of the top million.

    Although one of the smaller web servers on the market, LiteSpeed has frequently shown strong and consistent growth, with this month being no exception. It had the largest sites and active sites growth of all web servers in the March 2022 survey, gaining 1.92 million sites and 277,000 active sites.

    Vendor news

    • Apache released version 2.4.53 of their httpd web server. This version contains security fixes for four different CVEs. The release also brings a number of general bug fixes. Apache also released bug patches for several versions of Tomcat.

    • OpenSSL released versions 3.0.2 and 1.1.1n of their cryptography library in order to patch against a high severity denial of service vulnerability. OpenSSL is used by both Apache and nginx, which together account for a majority of all sites, domains, and web-facing computers.

    • Microsoft Azure has expanded to a new region in the North of China. Microsoft’s share of the web server software market is much larger in China compared to the rest of the world, with 16.5% of active sites, 20.1% of domains, 13.4% of sites, and 15.0% of web-facing computers.

    Total number of websites
    Web server market share
    DeveloperFebruary 2022PercentMarch 2022PercentChange
    Read More »
    february 2022 web server survey

    February 2022 Web Server Survey

    In the February 2022 survey we received responses from 1,173,621,471 sites across 271,199,972 unique domains and 11,774,714 web-facing computers. This reflects a gain of 5.91 million sites, 1.36 million domains and 73,800 computers.

    OpenResty experienced the strongest growth this month, both in overall sites and domains, with increases of 10.4 million sites and 546,000 domains. This represents a large 13.0% increase in its number of sites, but a more modest 1.4% increase in domains. Its market share in the domains metric now stands at 15.1%, an increase of 0.13 percentage points since January.

    nginx closely followed OpenResty with a growth of 538,000 domains, helping it to maintain its leading 26.7% market share. nginx also saw strong growth in web-facing computers, which increased by 53,500. In contrast to its gains in these metrics, nginx lost 12.1 million sites this month (-3.2%), however it retains its position as the most commonly used web server with 31.1% of all sites using it.

    Cloudflare continues to make strong gains amongst the million busiest websites, where it saw the only notable increases, with an additional 3,200 sites helping to bring its market share up to 19.4%. Apache, Microsoft and nginx all experienced losses in this metric; however, Apache and nginx still hold the top two positions with market shares of 23.3% and 22.1%.

    Vendor news

    • Apache Tomcat 9.0.59, 10.0.17 and 10.1.0-M11 (alpha) were released on 28 February 2022. Some of the notable changes are common between all three versions, including resolving a regression in a fix for a race condition, and improving the detection of the Linux duplicate accept bug.
    • nginx 1.21.6 mainline was released on 25 January 2022. This version contains three bugfixes and no new features.
    • njs 0.7.2 was also released with several core bugfixes on 25 January 2022. njs is the subset of the JavaScript language that can be used to extend nginx functionality.
    • Cloudflare has agreed to acquire Area 1 Security with the intention of integrating Area 1’s technology into its global network to protect customers from email-based security threats.
    • Lighttpd 1.4.64 was released on 19 January 2022. This includes numerous changes, including a security fix for a buffer overflow vulnerability that would have been unlikely to affect most configurations.
    Total number of websites
    Web server market share
    DeveloperJanuary 2022PercentFebruary 2022PercentChange
    Read More »
    january 2022 web server survey

    January 2022 Web Server Survey

    In the January 2022 survey we received responses from 1,167,715,133 sites across 269,835,071 unique domains and 11,700,892 web-facing computers. This reflects a loss of 1.15 million sites, but a gain of 1.51 million domains and 31,100 computers.

    nginx lost 7.33 million sites this month (-1.91%) but continues to be the most commonly used web server with 32.3% of all sites using it. Although nginx’s share has fallen, Apache is still more than eight percentage points behind after losing 3.70 million sites (-1.31%), which has taken its own market share down to 23.9%.

    nginx also leads in the domains metric, where it has a share of 26.6% compared with Apache’s 23.9%. This reflects a small reduction in nginx’s share – despite a modest gain of 25,400 domains – while Apache suffered the largest loss of 287,000 domains.

    The largest site and domain growth was seen by Pepyaka, which is a web server that has primarily been used by the Wix web development platform since it switched from using nginx in 2018. The number of sites using Pepyaka grew by 4.02 million to 7.30 million this month, while its domain count went up by 1.80 million to 3.30 million.

    The next largest domain growth was seen by OpenResty, which gained 686,000 domains this month, and 1.34 million sites in total. The second largest site growth was seen by Microsoft, which gained 2.46 million sites and now accounts for 4.86% of all sites and 5.00% of all domains.

    Constraining the view to active sites, Apache is still the most commonly used web server, but its market share has fallen slightly to 23.4% after losing more than half a million active sites this month. Meanwhile, nginx gained 230,000 active sites and has increased its share to 20.2%.

    Apache also maintains a slight lead in the top million websites, where it is used by 235,000 sites compared with 222,000 for nginx. However, Cloudflare has increased its presence by a further 4,959 sites and is now not too far behind with a total of 191,000. If this trend continues, Cloudflare could soon overtake both nginx and Apache to become the most commonly used top-million web server.

    Looking at web-facing computers, nginx’s strong growth continues unabated. This month it is being used by an additional 32,700 web-facing computers and its market share has increased to 37.7%. Its lead over Apache was further extended by Apache’s loss of 29,100 computers, which sent Apache’s share down to 29.9%.

    Vendor news

    • Apache 2.4.52 was released on 20 December 2021. This is the latest release from the 2.4.x stable branch and includes two security fixes amongst a host of other changes.
    • Apache Tomcat 9.0.56, 10.0.14 and 10.1.0-M8 (alpha) were released on 8 December 2021. Each of these versions include a fix for a known operating system bug that could cause incoming connections to be reported more than once.
    • nginx 1.21.5 was released on 28 December 2021. This is the latest release in the mainline branch of nginx and is now built with the PCRE2 library by default.
    • njs 0.7.1 was also released on 28 December 2021. This release includes several bugfixes and some other changes to ensure that njs scripts use the same regular expression library as nginx.
    • Microsoft has mitigated an insecure default behaviour in the Azure App Service that inadvertently exposed hundreds of source code repositories. The team that found the vulnerability noted that it had existed since September 2017 and has probably been exploited in the wild. The problem could have impacted PHP, Node, Ruby, Python and Java applications that serve static content, as well as some Azure App Service Linux applications that were deployed using Local Git after files were created or modified in the content root.
    • Cloudflare has introduced a new product called Bulk Redirects, which lets website administrators upload and enable large numbers of URL redirects. These were typically implemented with Page Rules before, which are limited to a maximum of 125 redirects.
    • OpenResty RC1 was released on 16 December 2021. This version is based on nginx 1.21.4 and adds several new features including support for BoringSSL.
    Total number of websites
    Web server market share
    DeveloperDecember 2021PercentJanuary 2022PercentChange
    Read More »
    december 2021 web server survey

    December 2021 Web Server Survey

    In the December 2021 survey we received responses from 1,168,864,866 sites across 268,328,184 unique domains and 11,669,818 web-facing computers. This represents a loss of 6.53 million sites, but a gain of 1.30 million domains and 144,000 computers.

    nginx lost a significant number of sites (-23.88 million) and domains (-8.54 million) this month, though it continues to hold the highest market share in both categories with 32.9% of sites and 26.7% of domains. nginx’s domain market share lead over Apache dropped significantly, falling from a 5.6 percentage point lead to a 2.6 percentage point lead. nginx also gained 81,100 web-facing computers this month, giving it 37.5% of market share in this category.

    Apache also lost sites (-3.09 million) and domains (-446,000) this month, though it gained 5,700 web-facing computers. Apache continues to hold second place across all three key metrics.

    The largest increase in both domains and hostnames was seen for “awselb”, used by Amazon’s Elastic Load Balancing service, and accounts for the majority of the loss experienced by nginx. The change was as a result of GoDaddy’s URL redirector service, which allows domains registered with GoDaddy to be pointed at arbitrary URLs, being moved from their own hosting facilities to Amazon’s ELB service.

    Many other web servers also saw reasonable growth in the number of sites this month, with OpenResty and Microsoft gaining 2.42 million and 2.15 million respectively, followed by LiteSpeed and Cloudflare with 1.76 million and 1.28 million. Fewer servers gained domains this month, though OpenResty gained a respectable 850,500 (+2.19%).

    Cloudflare gained 2,431 sites in the million most popular sites, increasing its market share by 0.24 percentage points to 18.6%. Apache continues to maintain a slim lead over nginx, though both lost sites this month. Microsoft’s market share dropped, as it lost 4,119 sites this month taking it to 6.15% of the total and down from 6.89% at the start of the year.

    Log4Shell impact on web servers

    A critical vulnerability dubbed “Log4Shell” was identified in the Java log4j logging library, and was publicly disclosed on 9th December. The vulnerability has impacted a broad range of organizations as the log4j library is widely used, and the flaw can be easily exploited to break into systems, steal data, and infect networks with malicious software.

    Many widely-used web servers such as Tomcat and Jetty are written in Java but do not use the log4j library by default so are not directly affected by the issue. However, they can be configured to do so, and it is also possible that sites that use popular web servers written in other languages – Apache and nginx are written in C, for instance – may still use the vulnerable library at some level in their technology stack.

    Several less well-known servers integrate the log4j library directly, such as IBM WebSphere. Several WebSphere components such as the Admin Console use the library and so are vulnerable to the issue, while applications served using WebSphere may be vulnerable if they use the library. IBM WebSphere is not widely used: this month Netcraft identified 3,778 sites using the server, which were hosted on 830 IP addresses. Amongst these, Netcraft found government and banking websites, though it is unknown whether these sites are vulnerable.

    Vendor news

    • Apache 2.4.52 was released on 20 December. This release fixes several security issues, including a possible buffer overflow in mod_lua and server-side request forgery vulnerability in forward proxy configurations.
    • nginx unit 1.26.1 was made available on 2 December and fixes several bugs introduced in the 1.26.0 release.
    • Lighttpd 1.4.62 and 1.4.63 were released in quick succession at the start of December and include many minor changes and bugfixes.
    • Apache Tomcat 9.0.56, 10.0.14, and 10.1.0-M8 (alpha) were released on 2 December.
    Total number of websites
    Web server market share
    DeveloperNovember 2021PercentDecember 2021PercentChange
    Read More »