August 2016 web server survey


In the August 2016 survey we received responses from 1,153,659,413 sites and 5,980,524 computers connected to the web. This reflects an increase of 80 million sites, but a loss of 78,000 computers.

While the total number of sites increased this month, that growth was not felt uniformly by every web server vendor: Microsoft won the most sites with an increase of 66 million, while ‘Apache, second, lost 41 million sites. Tengine, the nginx-based web server for Chinese online shopping giant Taobao, has gained 28 million sites.

While there have been significant changes in the total number of sites, these have been accompanied by much more modest changes in active sites – a more stable metric designed to ignore auto-generated bulk content. Apache and Microsoft both saw slight declines in the number of active sites, -0.5% and -0.8% respectively, while Tengine and nginx gained 120,000 (7.3%) and 81,000 (0, 2%).

The majority of the decline in web computers this month were using Apache, with a decrease of just over 107,000 (3.8%) using the open source server. One of the main contributors to this decline was the loss of a large number of consumer NAS devices running Apache. While these devices have been steadily increasing in number since the start of 2016, this month has seen a marked decline. These devices are mostly connected through home internet lines and are therefore likely to come and go from month to month. As a result, Apache’s losses this month are spread across a large number of mainstream ISPs. On the flip side, Apache has continued to grow among web hosting providers.

A gain of 24,000 web computers for nginx, the biggest gain for web computers this month, once again increases its market share to 17.0%. Microsoft also saw a slight increase in market share, despite losing 4,000 web computers, given the large loss of Apache this month.

Windows Server 2016 – which will be the primary platform for Microsoft IIS 10.0 – is approaching its official launch at Microsoft’s Ignite conference in September. In the meantime, developers can try out many new features of IIS 10 by installing the latest version of Windows Server 2016 Technical Preview 5 or installing IIS 10.0 Express standalone on Windows 7 SP1 or later.

Over 11,000 websites already use Microsoft IIS 10.0, with almost all of these sites using a version of Windows Server 2016.

The previous month saw two new releases of the major version of nginx, mainly incorporating bug fixes and feature additions, while Apache version 2.4.23 addressed a security issue that could have allowed customers to Unauthorized access to protected resources if a server was configured to use HTTP / 2.

Several web servers have also been updated following the disclosure of a set of vulnerabilities dubbed httpoxy. These vulnerabilities can affect web applications running in CGI or CGI compatible environments.

The vulnerability stems from a simple namespace conflict where the HTTP provided by the client Proxy the header has been placed in a HTTP_PROXY environment variable as is customary for CGI applications; but where HTTP_PROXY has been approved by the app and used to configure an outbound proxy.

This type of vulnerability was first discovered in libwww-perl over 15 years ago, but in July it was found to be still exploitable in PHP and many other modern languages ​​and libraries. Successful exploitation of these issues could allow a remote attacker to proxy outbound HTTP requests made by a vulnerable web application, which can expose sensitive data.

To mitigate the httpoxy vulnerability, Apache 2.4.24-dev avoids filling out the HTTP_PROXY variable of a Proxy header in CGI httpd environments. Similar mitigation measures have also been implemented in Lighttpd 1.4.41 and LiteSpeed, while nginx and Varnish have published mitigation guidance.

Web server market share

Developer july 2016 Percent August 2016 Percent Switch
Microsoft 378 655 759 35.26% 445 105 755 38.58% 3.32
Apache 340 551 074 31.72% 300 028 832 26.01% -5.71
nginx 170 896 716 15.92% 181 606 297 15.74% -0.17
Google 22 552 901 2.10% 22 111 431 1.92% -0.18
Web server market share for active sites

Developer july 2016 Percent August 2016 Percent Switch
Apache 80 607 096 46.41% 80 179 269 46.34% -0.07
nginx 37 837 339 21.79% 37 918 635 21.92% 0.13
Microsoft 17 054 166 9.82% 16 922 324 9.78% -0.04
Google 14 859 517 8.56% 14 918 494 8.62% 0.07

For more information, see Active sites

Web server market share per million most visited sites

Developer july 2016 Percent August 2016 Percent Switch
Apache 431,809 43.18% 427,900 42.79% -0.39
nginx 279,049 27.90% 281,589 28.16% 0.25
Microsoft 110,202 11.02% 109 221 10.92% -0.10
Google 20 681 2.07% 20,595 2.06% -0.01
Computer Web Server Market Share

Developer july 2016 Percent August 2016 Percent Switch
Apache 2 832 384 46.75% 2,725,129 45.57% -1.18
Microsoft 1,547,443 25.54% 1,543,216 25.80% 0.26
nginx 994,721 16.42% 1,019,109 17.04% 0.62


Comments are closed.