What the Web Server Surveys Reveal

ApacheWeek has often reported on the success of the Apache Web Server as shown by the E-Soft Web Server and Netcraft surveys, and how they have consistently shown Apache to be the most popular and more widely deployed server than all the others combined.

In this 200th issue of ApacheWeek, we look behind the headline figures of those surveys with an in-depth analysis of which Apache versions are being used and how long it takes the Apache community to adopt new releases.

Although both surveys show the total number of sites using Apache, the E-Soft survey figures also reveal some interesting facts about which versions of Apache are in use, and that take up of newer releases is not immediate. Plotting the number of sites using 1.3.x versions month for month from release date indicates migration from older versions is slow. As a percentage of Apache powered sites, in the case of almost all versions, their use continues to remain constant for a few months even after a new release. Take into account the number of sites using Apache is increasing every month; and the actual number of sites using older releases continues to rise for anything up to three months after a new release becomes available.

Graph 1: Individual release take up

It wasn't until April this year, with Apache 1.3.9 released 9 months earlier, that the use of a single 1.3 version exceeded that of older 1.1 and 1.2 versions. Even today, only 6% of sites are using the most recent release, 1.3.12, and over 25% of sites are still powered by older Apache versions from the 1.0, 1.1, and 1.2 generations.

Graph 2: Apache releases in use, May 2000

One of the most interesting findings from the survey is to see how new releases may influence the take-up of Apache as a server. Looking at the monthly increase in the number of sites powered by the server, some of the largest rises follow particular release dates.

The month following the release of Apache 1.3.3 (released on October 9 1998) saw one of the highest monthly increases in use. Apache 1.3.3 was a minor upgrade to Apache 1.3.2, but fixed one quite important problem; various error responses, such as "404 Not Found" displayed the full path to the missing file. Other problem fixes included the spelling module - which in 1.3.2 did not return the list of possible matches when more than one file is similar to the requested URL - and a problem where missing .htaccess files could result in a "Forbidden" response. Some platform specific bug fixes - including the Windows zombie processes problem - were also fixed.

Graph 3: Monthly increase in sites powered by Apache

Apache 1.3.12, the most current version, has also seen a huge increase in use in the month following its release. This addressed security issues raised by a CERT advisory on cross-site scripting which wasn't specific to Apache and had wide reaching consequences for anyone who uses or writes scripts for web servers. Patches were quickly made available for the previous version (1.3.11) followed shortly afterwards with the release of 1.3.12 at the end of February. Once again, it was shown that the contributors to open source projects can respond as efficiently as commercial developers to major security issues.

The surveys can't tell us whether the increases are attributable to upgraders or new adopters, and it is purely speculative as to whether the rapid provision of a security fix to a problem contributed to the migration from other servers to Apache. However, the E-Soft Survey shows there was an increase of 76,000 sites using Apache in March 2000, and 36,000 sites using 1.3.12.

What can not be disputed is the phenomenal success of the Apache web server, now with a share of the server software market that commercial vendors only dream of. Whichever version is in use, it's all part of the ever-growing Apache community which Apache Week will continue to support.