The Web Server Census 2026: nginx, Apache, Cloudflare and the Invisible Half
Published
The Web Server Census 2026: nginx, Apache, Cloudflare and the Invisible Half
Nearly half the web declines to say what it is running. That is the headline finding from the August 2026 defaults.exposed census, which measured HTTP server headers across 376,928,781 domains. Of those, 171,808,677 (45.6%) returned no Server header at all. The remaining 205,120,104 (54.4%) offered at least a partial declaration. Among those that did speak up, Cloudflare led the field with 43 million entries, followed by nginx and Apache in a tight cluster below.
This article examines what the data shows, what it cannot show, and what both halves of the web reveal about infrastructure choices, privacy posture, and security hygiene in 2026.
The Invisible Half
A 45.6% suppression rate is not an accident. Suppressing the Server header is a deliberate configuration choice, recommended by security guidance including OWASP’s information disclosure guidelines, which flag unnecessary server banners as a low-effort information gain for attackers profiling targets. RFC 7231, which governs HTTP/1.1 semantics, describes the Server header as optional. It always has been.
But “no header” does not mean one thing uniformly. It means at least two quite different things:
CDN and reverse-proxy silencing. When a CDN or edge proxy sits between the client and the origin server, the proxy frequently replaces or strips the upstream Server header before the response leaves. Cloudflare, for instance, replaces origin headers with its own “cloudflare” value in most configurations, though operators can suppress that too. A domain behind a proxy that strips all identifying headers will appear in this dataset as having “no server header,” even though an origin server is running perfectly normally behind the curtain.
Deliberate origin suppression. Apache, nginx, Caddy, and most other web servers support directives that suppress the Server header outright. Hardened production deployments routinely enable these. Privacy-conscious operators, particularly in EU ccTLDs where data minimisation has cultural and regulatory weight, are disproportionately represented in the no-header cohort. The suppression rate is measurably higher across European ccTLDs than across English-speaking markets such as .com and .co.uk.
What server header absence does not mean: it does not mean the domain is offline, using exotic software, or inherently more secure. Suppression is a posture signal, not a capability signal.
The Declared Web Server Landscape
Among the 205 million domains that do return a Server header, the landscape is more concentrated than raw counts suggest.
| Server value | Domains | Share of all measured | Share of declared |
|---|---|---|---|
| cloudflare | 43,008,476 | 11.4% | 21.0% |
| nginx | 30,843,313 | 8.2% | 15.0% |
| apache | 28,539,494 | 7.6% | 13.9% |
| litespeed | 10,914,683 | 2.9% | 5.3% |
| squarespace | 9,275,484 | 2.5% | 4.5% |
| openresty | 8,259,721 | 2.2% | 4.0% |
| pepyaka (Wix) | 7,779,801 | 2.1% | 3.8% |
| hcdn | 6,234,652 | 1.7% | 3.0% |
| namecheap-nginx | 4,977,082 | 1.3% | 2.4% |
| vercel | 3,969,629 | 1.1% | 1.9% |
| kestrel | 3,664,823 | 1.0% | 1.8% |
| microsoft-iis/10.0 | 2,086,666 | 0.6% | 1.0% |
nginx and Apache together account for roughly 60 million domains with a declared header, or about 29% of all measured domains, continuing the two-decade pattern that independent measurement studies have documented across web server surveys. LiteSpeed’s 10.9 million entries, much of it driven by cPanel/WHM hosting stacks, puts it firmly in third place among origin-style servers.
The platform-specific entries are equally telling. Squarespace’s 9.3 million, Wix’s pepyaka at 7.8 million, and Vercel’s 3.9 million are not raw web servers in the traditional sense. They are hosted infrastructure platforms that return a branded Server value, effectively advertising the platform rather than the runtime. That is a distinct choice: these platforms could suppress the header, but have opted for transparency, perhaps for debugging or attribution reasons.
What Cloudflare’s Number Means
Cloudflare’s 43 million entries (21% of all declared servers) deserve careful interpretation. This number does not mean that 43 million sites are hosted on Cloudflare infrastructure in the origin sense. It means that 43 million domains had their HTTP response edge-terminated by Cloudflare’s network at the time of measurement, and that Cloudflare’s default configuration was in place: the “Server: cloudflare” header was present.
This is a proxy count, not an origin count. The actual origin servers behind those 43 million Cloudflare-fronted domains could be running nginx, Apache, IIS, Caddy, or any other software. From an external vantage point, the census cannot see through the CDN layer. This is the correct and honest reading of the data.
Cloudflare’s market reach is genuinely global but is disproportionately concentrated in English-speaking markets. Its density across .com, .net, .io, .co.uk, and Australian and Canadian ccTLDs is higher than in European privacy-forward zones, where a mix of local hosting providers and explicit header suppression reduces the Cloudflare signal. This is consistent with Cloudflare’s growth pattern, which has historically been strongest in US-rooted ecosystems.
The Version Leakage Problem
The most pointed finding in the declared-server data is not which server is most common. It is which servers announce their exact version.
microsoft-iis/10.0 appears across 2,086,666 domains. That trailing /10.0 is not cosmetic. It tells any observer that the server is running IIS version 10.0, which ships with Windows Server 2016 and 2019. Combined with other headers or content signals, this narrows the OS version, the patch surface, and the likely vulnerability window considerably. Microsoft’s own IIS documentation notes that the version token in the Server header can be suppressed via configuration, and most hardening guides recommend doing so.
Apache and nginx are also capable of version disclosure when not explicitly configured otherwise. The Apache ServerTokens Prod directive strips the version number, leaving only “Apache.” The nginx server_tokens off directive does the same. Both are off by default on many distributions and must be set consciously. The presence of a bare “apache” or “nginx” value in this dataset does not indicate whether operators have applied those directives: the census measures what is externally visible, not what was intentionally configured.
Version disclosure is not a vulnerability in itself. It is a reconnaissance accelerant. It reduces the effort required to identify candidate exploit paths for an attacker who has already selected a target.
X-Powered-By: The Noisier Cousin
Separate from the Server header sits X-Powered-By, a non-standard header with no RFC definition and no formal purpose beyond self-identification. This census found it present on 25,628,881 domains (6.8% of all measured).
Where Server header suppression has been normalised in security-conscious deployments, X-Powered-By suppression lags behind. Common values include PHP/8.x.x, ASP.NET, and framework-specific identifiers. These are frequently more specific than the Server header: an X-Powered-By value can expose the scripting language, the framework version, and occasionally the exact runtime build.
OWASP’s information disclosure guidance treats X-Powered-By as equally worth suppressing. Frameworks like Express.js, Laravel, and ASP.NET Core all support disabling the header via configuration. The 6.8% exposure rate suggests the message has not landed as widely as the Server header guidance.
What This Means for Security Scanning
For automated security scanning, server header data has always been a starting signal rather than a verdict. The August 2026 census data makes this more explicit. When 45.6% of measured domains return no Server header, any scanner that uses the header as a primary infrastructure classifier is working with a systematic blind spot covering nearly half the measurable web.
The practical implication for domain security posture assessment: the presence or absence of a Server header is itself a posture signal. Suppression suggests either a hardened origin configuration or CDN fronting, both of which are associated with more security-conscious operators. Disclosure of a versioned value such as microsoft-iis/10.0 is a finding in its own right, flagged under information disclosure categories.
Check your domain’s headers and security posture using the defaults.exposed scanner. Full census methodology and scoring definitions are documented at the State of Domain Security 2026.
Methodology Note
All figures in this article are drawn from the defaults.exposed August 2026 census, measured as of 2026-08-16 against 376,928,781 domains, using methodology v9. Server header values are externally observable declarations. CDN fronting (including Cloudflare) replaces origin server headers; these measurements reflect the externally visible server identity, not necessarily the origin runtime. The Server header is self-declared and unverified: any server can return any value. References: RFC 7231 (HTTP/1.1 Semantics), OWASP Information Disclosure guidelines, Apache ServerTokens documentation, nginx server_tokens documentation.
What This Means
For IT security teams, the 45.6% no-header rate is a useful baseline for your own posture decisions. If your production web servers still announce their software identity — or worse, include a version number — you are giving attackers a free head start in reconnaissance. Suppressing the Server header costs nothing to configure and removes one signal from an attacker’s profiling toolkit. It will not stop a determined adversary, but it removes low-hanging fruit that automated scanners harvest continuously.
The version disclosure finding is the most immediately actionable point in this data. Over 2 million domains running microsoft-iis/10.0 are broadcasting their OS generation alongside their web server. For security teams conducting internal audits or managing a portfolio of properties, checking whether your web servers suppress version tokens — Apache’s ServerTokens Prod, nginx’s server_tokens off, IIS’s removeServerHeader — is a 10-minute review that closes a real information gap.
The X-Powered-By finding is the sleeper issue. At 6.8% exposure across 376 million domains, it is widespread, and suppression guidance is less consistently followed than for the Server header. If your stack includes PHP, ASP.NET, Express, or any framework that emits X-Powered-By by default, check whether you have disabled it. The fix is a single line of configuration in most frameworks, and the information it stops disclosing — your runtime version, your framework choice — is exactly what automated vulnerability scanners use to prioritise targets.
Data to Cite
- “45.6% of 376,928,781 measured domains returned no Server header at all in the August 2026 census.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “Cloudflare leads all declared web server values with 43,008,476 domains — 21% of every domain that declares a server identity.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “nginx and Apache together account for approximately 60 million domains with a declared Server header, roughly 29% of all measured domains.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “X-Powered-By headers — which can expose programming language, framework, and runtime version — were present on 25,628,881 domains, 6.8% of all measured.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “2,086,666 domains return ‘microsoft-iis/10.0’, broadcasting their server software and Windows Server generation to any observer.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “Among domains that declare a server value, Cloudflare (21%), nginx (15%), and Apache (13.9%) account for half of all declared server identities.” — defaults.exposed August 2026 Domain Security Census (432M domains)
FAQ
Why do nearly half of all domains suppress the Server header? Because security guidance — from OWASP, CIS Benchmarks, and most hardening frameworks — recommends it, and CDNs like Cloudflare replace origin headers by default. The 45.6% no-header rate in the August 2026 census reflects both deliberate configuration choices and the widespread use of reverse proxies that strip or replace upstream server identifiers. Suppression is a positive hygiene signal, not a suspicious one.
Is Cloudflare really running 43 million websites?
No. The 43,008,476 Server: cloudflare responses mean Cloudflare terminated those HTTP connections at its edge — it does not mean 43 million sites are hosted on Cloudflare origin infrastructure. The actual origin servers behind Cloudflare could be running anything. This is a proxy count, not a hosting count.
What is the risk of advertising a server version like microsoft-iis/10.0?
Version disclosure narrows an attacker’s target-selection work significantly. Combined with other observable signals, a specific version token can identify the OS generation, likely patch state, and candidate vulnerability window for a given target. Microsoft’s own hardening guidance recommends suppressing the IIS version token. The fix is a configuration change that takes minutes.
How does this compare to July 2026? The August 2026 census is the first full measurement of this population under methodology v9. Direct month-on-month comparisons for this specific header analysis will be available in the September 2026 edition, as the census is structured as a recurring measurement.
What should I do if my domain is exposing X-Powered-By?
Disable it at the framework level. Express.js uses app.disable('x-powered-by'). Laravel removes it via the php.ini expose_php = Off setting. ASP.NET Core removes it with response header middleware. The configuration is minimal and the information benefit to attackers — your runtime stack, your framework version — is immediate.
Check your domain free at defaults.exposed — see exactly what your domain’s HTTP headers are broadcasting to the world, including Server and X-Powered-By values that may be leaking your infrastructure details. Takes 30 seconds. No account needed.
How to cite this report
Press / blog: defaults.exposed (2026). The Web Server Census 2026: nginx, Apache, Cloudflare and the Invisible Half. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/web-server-census-2026-nginx-apache-cloudflare
Academic: defaults.exposed. (2026, August 18). The Web Server Census 2026: nginx, Apache, Cloudflare and the Invisible Half. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/web-server-census-2026-nginx-apache-cloudflare
In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,781)
About the defaults.exposed August 2026 Census
The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.
Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026