Defaults.Exposed › Stats › Web servers & hosting

Web servers & hosting

1 statistics · figures as of September 5, 2026 · census snapshot 2026-09-05 · September 2026 edition

What the web runs on, and how much of it announces that to anyone who asks.

Every HTTP response is an opportunity to say nothing, and 66.8% of them take the opposite approach. 211,480,834 responses in the census volunteer a Server header naming the software behind them, frequently with a version number attached. The most common value is cloudflare at 21.03% of responses that disclose anything, ahead of nginx at 17.47%.

Disclosure is not a vulnerability and the census does not grade it as one. It is reconnaissance economics. An attacker scanning for hosts affected by a newly published advisory does not need to probe carefully if the hosts announce their version in every response; the population can be enumerated from response headers alone, in bulk, without touching anything that would look like an attack. Turning the header off does not fix a vulnerable server, it removes it from the cheapest possible target list.

The counter-argument, that version disclosure is harmless because attackers will probe anyway, holds only for a determined attacker choosing a specific target. Most large-scale exploitation is the other shape: pick a vulnerability, enumerate everything that admits to running it, work through the list. Being unlisted in that enumeration is worth more than its cost, which is one configuration line.

The concentration figure matters for a different reason. When a handful of server products and hosting platforms account for most of the web, their defaults are the web’s security posture. That is how HTTPS adoption was won, and it is why the header numbers in the neighbouring section stay so low: no major platform has yet decided to send them by default.

Server is not the only header that volunteers information. X-Powered-By names application frameworks and their versions, and a surprising number of responses carry both. Between them they describe a stack precisely enough to match against a vulnerability database without a single probe that a monitoring system would notice. Removing them changes nothing a visitor experiences and takes the host out of the cheapest enumeration available.

The honest counterweight is that suppression is not a patch. A host running an unpatched version is vulnerable whether or not it admits to it, and quietly vulnerable is still vulnerable. The argument for turning the header off is economic rather than protective: it moves you out of the bulk-enumerated population and into the group an attacker has to spend real effort on. That is worth one configuration line, and it is no substitute for patching.

Suppressing a version string takes one line. The scan reports what your own responses are currently advertising.

← All sections · how we grade · data & downloads