Defaults.Exposed › Stats › Web servers & hosting

Web servers & hosting

1 statistic · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition

What the web runs on, and how much of it announces that to anyone who asks.

65.7% of HTTP (Hypertext Transfer Protocol) responses in the census, 219,961,440 in all, volunteer a Server header naming the software behind them, frequently with a version number attached. The most common value is cloudflare at 22.09% of responses that disclose anything, ahead of nginx at 17.18%.

The census does not grade disclosure as a vulnerability. What disclosure changes is how cheaply a host can be found. An attacker scanning for hosts affected by a newly published advisory does not need to probe carefully if the hosts announce their version in every response; the population can be enumerated from response headers alone, in bulk, without touching anything that would look like an attack. Turning the header off removes a server from the cheapest possible target list.

The counter-argument, that version disclosure is harmless because attackers will probe anyway, holds only for a determined attacker choosing a specific target. Most large-scale exploitation is the other shape: pick a vulnerability, enumerate everything that admits to running it, work through the list. Being unlisted in that enumeration is worth more than its cost, which is one configuration line.

The concentration figure matters for a different reason. When a handful of server products and hosting platforms account for most of the web, their defaults decide the security settings most sites end up with. That is how HTTPS (Hypertext Transfer Protocol Secure) adoption was won, and it is why the header numbers in the neighbouring section stay so low: no major platform has yet decided to send them by default.

Server is not the only header that volunteers information. X-Powered-By names application frameworks and their versions, and a surprising number of responses carry both. Between them they describe a stack precisely enough to match against a vulnerability database without a single probe that a monitoring system would notice. Removing them changes nothing a visitor experiences.

The honest counterweight is that suppression is not a patch. A host running an unpatched version is vulnerable whether or not it admits to it. The argument for turning the header off is economic rather than protective: it moves you out of the bulk-enumerated population and into the group an attacker has to spend real effort on.

Suppressing a version string takes one line. The scan reports what your own responses are currently advertising.

← All sections · how we grade · data & downloads