In the February 2017 survey we received responses from 1,792,104,054 sites and 6,236,791 web-facing computers, reflecting a loss of 7.9 million sites and 91,200 computers.
nginx gains sites and computers
nginx had the largest growth of both sites and web-facing computers amongst the major vendors this month, enjoying a gain of 31 million sites and 13,400 computers, while hefty losses by Microsoft and Apache led to the overall losses seen in this month’s survey. Microsoft lost 48 million sites and 9,900 computers, while Apache lost 13 million sites and 85,700 computers.
Much of the loss of web-facing computers using Apache is the result of declining numbers of Western Digital My Cloud personal storage devices being found in Netcraft's survey. These devices allowed consumers to access their files remotely using public hostnames under the wd2go.com domain. This disappearing act might have been influenced by the three My Cloud firmware updates that were released in December – the first of these changed how files are accessed from the My Cloud web and mobile apps, and the other two resolved a security vulnerability related to remote access.
Despite suffering the largest loss, Microsoft web servers power 43.2% of all sites on the internet, more than twice Apache's share. Meanwhile, nginx's growth has increased its own count to 348 million, bringing it to within striking distance of Apache. This highlights a dramatic change in fortunes for Apache, which was comfortably in first place a year ago, but is now under threat of falling into third place.
In terms of web-facing computers, Apache continues to fare well. While its 3% decline is significant in the space of a month, Apache's 2.7 million computers still give it the lion's share of the market (44.1%). This is followed by Microsoft's 1.5 million computers (24.7%), and nginx's 1.2 million (19.2%).
nginx was also the only major vendor to make a gain within the top million busiest sites. Its share grew slightly to 28.34%, while Apache suffered the largest loss of 0.21 percentage points, taking its share down to 41.41%, though Apache maintained its first-place position with a lead of 13.1 percentage points over nginx.
Apache still strong in active sites
Despite its losses elsewhere, Apache gained 887,000 active sites this month. nginx made the second largest gain, with an increase of 757,000 active sites. The active sites metric is more appropriate for some applications, as it counts websites but excludes those that contain automatically generated content such as domain holding pages.
Apache also has the largest share of this market (45.8%), with its total number of active sites now reaching almost 80 million – comfortably ahead of nginx, which takes up second place with 34 million active sites.
LiteSpeed 5.1.13 addresses DDoS vulnerability
February saw some new releases of the LiteSpeed web server. Most notably, version 5.1.13 was released on 17 February, after some LiteSpeed Enterprise customers reported service disruptions. These were caused by a surge of distributed denial of service (DDoS) attacks that specifically targeted a bug in LiteSpeed servers earlier that day. Rather impressively, it took LiteSpeed less than two hours to identify the heap buffer overflow that was responsible for the problem, push a bug fix build of 5.1.12, and release 5.1.13.
Looking ahead, it is likely that the first release in the 5.2 branch of LiteSpeed will support HTTP/2 Server Push, which could speed up some websites by allowing the server to send resources to clients before the browser has requested them. This feature has already been implemented in the second release candidate (5.2RC2), which was made available on 13 February.
LiteSpeed gained 42 million sites this month as a large number of sites under the .science gTLD reappeared. This did not have a positive impact on its computer count, however, which fell by 666 to 23,240.
Other new releases from web server vendors
Apache 2.2.32 was released on 13 January. This is the latest version in the 2.2 legacy branch, which now enforces a stricter HTTP request grammar, corresponding to RFC 7230 for request lines and request headers. This addresses a security vulnerability (CVE-2016-8743) that might have allowed malicious clients or downstream proxies to carry out response splitting and cache pollution attacks. This release also mitigates the "httpoxy" (CVE-2016-5387) issues that were already addressed in the 2.4 stable branch.
New stable and mainline versions of nginx were also released in the past month. nginx 1.10.3 stable was released on 31 January, followed by nginx 1.11.10 mainline on Valentine's Day. Both versions include several bugfixes, while the mainline release also introduces a few new features.
Meanwhile, documentation for the Microsoft IIS Administration API is now available. This REST API allows IIS instances to be configured with any HTTP client, using tools such as the one available at manage.iis.net. The rationale for providing the API is to have an open and standard interface that can be used from any platform, unlike AppCmd.exe, which can only be run on Windows.
| Developer | January 2017 | Percent | February 2017 | Percent | Change |
|---|---|---|---|---|---|
| Microsoft | 821,905,283 | 45.66% | 773,552,454 | 43.16% | -2.50 |
| Apache | 387,211,503 | 21.51% | 374,297,080 | 20.89% | -0.63 |
| nginx | 317,398,317 | 17.63% | 348,025,788 | 19.42% | 1.79 |
| 17,933,762 | 1.00% | 18,438,702 | 1.03% | 0.03 |
| Developer | January 2017 | Percent | February 2017 | Percent | Change |
|---|---|---|---|---|---|
| Apache | 78,707,037 | 45.67% | 79,593,938 | 45.78% | 0.11 |
| nginx | 33,331,358 | 19.34% | 34,088,228 | 19.60% | 0.27 |
| Microsoft | 16,601,302 | 9.63% | 16,031,854 | 9.22% | -0.41 |
| 11,372,796 | 6.60% | 11,656,739 | 6.70% | 0.11 |
For more information see Active Sites
| Developer | January 2017 | Percent | February 2017 | Percent | Change |
|---|---|---|---|---|---|
| Apache | 416,257 | 41.63% | 414,118 | 41.41% | -0.21 |
| nginx | 282,986 | 28.30% | 283,409 | 28.34% | 0.04 |
| Microsoft | 102,660 | 10.27% | 101,909 | 10.19% | -0.08 |
| 17,702 | 1.77% | 17,648 | 1.76% | -0.01 |
| Developer | January 2017 | Percent | February 2017 | Percent | Change |
|---|---|---|---|---|---|
| Apache | 2,832,979 | 44.77% | 2,747,316 | 44.05% | -0.72 |
| Microsoft | 1,548,491 | 24.47% | 1,538,553 | 24.67% | 0.20 |
| nginx | 1,181,290 | 18.67% | 1,194,644 | 19.15% | 0.49 |