February 2023 Web Server Survey

In the February 2023 survey we received responses from 1,127,630,293 sites across 270,727,775 unique domains, and 12,142,793 web-facing computers. This reflects a loss of 4,638,508 sites, 240,148 domains and 13,907 computers.

OpenResty had the largest percentage growth in sites this month: it is now used by 95,176,082 sites, an increase of 2,884,258 (+3.13%) since last month. This brings its share of sites to 8.44%, up from 8.15% (+0.29pp). OpenResty’s market share by domain count remained stable, with a slight 0.01pp increase this month – its small loss of 14,039 domains was counteracted by the greater loss of domains across all vendors this month.

Cloudflare continues to grow, gaining 1,669,867 sites (+1.49%) and 500,432 domains (+1.89%) since our January survey. Following Cloudflare becoming the most commonly used web server vendor within the top million sites last month, it has started to cement its position: gaining 672 sites (+0.31%) of the top million sites this month, giving it a 21.71% market share (+0.07pp).

Meanwhile, Apache lost 626 sites (-0.29%) in the top million sites, bringing its share to 21.34% (-0.06pp). Outside of the top million, Apache saw more significant losses, netting a decrease of 2,593,754 sites (-1.11%) and 434,071 domains (-0.74%).

Similarly to Apache, nginx lost a significant number of domains this month, being down by 483,620 domains since our January survey (-0.66%). However, nginx maintained its overall site count and even gained 219 of the top million busiest sites, giving it a 21.23% share (+0.02pp) within the top million sites.

The largest loss in sites for a major vendor this month comes from Microsoft, which is down 2,866,173 sites (-9.59%) and 74,094 domains (-0.98%). This continues its consistent downwards trend since December 2018.

Vendor News

• Apache 2.4.55 was released on 17th January 2023. This includes a fix for the CVE-2022-36760 vulnerability. This vulnerability affects configurations using mod_proxy_ajp, a proxy server which forwards requests to an application server using the Apache JServ Protocol (AJP). The vulnerability allowed attackers to smuggle requests to the backend AJP server without being correctly processed by the proxy server.
• AWS announced general availability of its Asia Pacific (Melbourne) region, as well as general availability of Local Zones in Perth and Santiago.
• Microsoft released Azure Load Testing, a service that can test a web application’s resilience to high load.

Developer	January 2023	Percent	February 2023	Percent	Change
nginx	295,678,304	26.11%	295,723,793	26.23%	0.11
Apache	233,636,177	20.63%	231,042,423	20.49%	-0.15
Cloudflare	112,159,331	9.91%	113,829,198	10.09%	0.19
OpenResty	92,291,824	8.15%	95,176,082	8.44%	0.29

Developer	January 2023	Percent	February 2023	Percent	Change
Apache	42,130,966	20.76%	41,819,892	20.70%	-0.06
nginx	38,926,019	19.18%	38,997,703	19.30%	0.12
Cloudflare	23,424,225	11.54%	22,557,491	11.17%	-0.38
Google	21,000,053	10.35%	20,549,494	10.17%	-0.18

For more information see Active Sites

Developer	January 2023	Percent	February 2023	Percent	Change
Cloudflare	216,403	21.64%	217,075	21.71%	0.07
Apache	214,022	21.40%	213,396	21.34%	-0.06
nginx	212,049	21.20%	212,268	21.23%	0.02
Microsoft	52,143	5.21%	52,414	5.24%	0.03

Developer	January 2023	Percent	February 2023	Percent	Change
nginx	4,700,609	38.67%	4,701,104	38.72%	0.05
Apache	3,322,386	27.33%	3,302,887	27.20%	-0.13
Microsoft	1,271,547	10.46%	1,242,076	10.23%	-0.23

Developer	January 2023	Percent	February 2023	Percent	Change
nginx	73,433,422	27.10%	72,949,802	26.95%	-0.15
Apache	58,425,670	21.56%	57,991,600	21.42%	-0.14
OpenResty	38,926,332	14.37%	38,912,294	14.37%	0.01
Cloudflare	26,424,629	9.75%	26,925,061	9.95%	0.19