Skip to content
Knowledge Hub/Article
Article

What Is a Web Server? NGINX, Apache and IIS Explained

We explain how a web server answers an HTTP request, how it differs from an application server, NGINX, Apache and IIS, TTFB and key security settings.

Oğuzhan Gerçek··9 min read
What Is a Web Server? NGINX, Apache and IIS Explained

Short answer: A web server is software that accepts HTTP requests from clients such as browsers and sends back responses; the machine that runs that software is also called a web server. It serves static files itself and passes requests for dynamic pages to an application written in PHP, Java or .NET. Common examples include NGINX, Apache HTTP Server and, on Windows, IIS; some of them, NGINX among them, also work as a reverse proxy and load balancer. TTFB measures how long it takes the user to receive the first byte. Security depends on up-to-date software, disabling unneeded modules and a sound TLS configuration.

What is a web server?

RFC 9110 (June 2022), which defines the core semantics of HTTP, describes an HTTP server as a program that accepts connections in order to service HTTP requests by sending HTTP responses. A client is a program that establishes a connection to a server to send requests; according to the RFC, these terms refer only to the roles that programs play for a particular connection. A server that can originate authoritative responses for a given resource is called an origin server.

The term web server covers both the software and the machine it runs on; we unpack that distinction in our server article. Our glossary has a short definition of getting web server configuration and maintenance as a service.

How does a request reach a web server?

When you type an address into a browser, this happens in order:

  1. The browser finds the IP address for the domain name through DNS.
  2. It opens a TCP connection to the server (RFC 9293); HTTP/3 instead uses QUIC, which runs over UDP.
  3. With HTTPS, the connection is encrypted with TLS (SSL and TLS article). According to RFC 9110, the default port is 80 for HTTP and 443 for HTTPS.
  4. The browser sends the request. Because one machine can run several websites, the server uses the Host header to tell which site the request is for; according to the NGINX documentation, if the header matches no site, the request goes to the default server for that port.
  5. The server responds with a status code. In the IANA registry, 2xx means success, 3xx redirection, 4xx a client error and 5xx a server error; 200 OK, 301 Moved Permanently and 404 Not Found are well-known examples.

Static and dynamic content

According to the NGINX documentation, an important web server task is serving out files such as images or static HTML pages. Static content is the same for everyone: the server reads the file and sends it, which also makes it easy to cache. Dynamic content is generated at request time; search results or a signed-in user's shopping cart are examples. According to the Apache documentation, CGI defines a way for a web server to interact with external content-generating programs. NGINX can also route requests to FastCGI servers that run applications written in languages such as PHP. We cover delivering static content from servers close to users in our CDN article.

Web servers, application servers and reverse proxies

An application server runs business logic. Apache Tomcat, for example, is an open-source implementation of Java specifications such as Jakarta Servlet and Jakarta Pages. For ASP.NET Core, Microsoft provides a web server called Kestrel; according to Microsoft, Kestrel can face the internet on its own or sit behind a reverse proxy such as IIS, NGINX or Apache.

In a common setup, the web server sits in front: it serves static files itself and forwards everything else to the application behind it. We cover the benefits of a reverse proxy in our proxy article and spreading traffic across several servers in our load balancer article. In this arrangement, 502 Bad Gateway means a server acting as a gateway or proxy received an invalid response from the upstream server, and 504 Gateway Timeout means it did not get a response in time. Both errors tell you to look for the problem in the layer behind the web server.

NGINX, Apache and IIS

  • NGINX: According to nginx.org, it is an HTTP web server, reverse proxy, content cache, load balancer, TCP/UDP proxy server and mail proxy server, originally written by Igor Sysoev. It runs one master and several worker processes: the master reads and evaluates the configuration, and the workers process requests using an event-based model.
  • Apache HTTP Server: A project of the Apache Software Foundation; according to its history, its first official public release came out in April 1995. A Multi-Processing Module (MPM) binds to network ports, accepts requests and dispatches children to handle them; on modern systems the default is almost always event. .htaccess files allow per-directory configuration, but the documentation says settings belong in the main server configuration when you have access to it.
  • IIS (Internet Information Services): The Windows web server. According to Microsoft, requests are picked up by HTTP.sys, which runs in kernel mode, and application pools separate applications by process boundaries. As a component of Windows, IIS follows the same lifecycle: support for IIS 10 on Windows Server 2016 ends in January 2027.

According to W3Techs data from October 13, 2026, among websites whose web server is known, NGINX has a 30.6% share, Apache 21.7%, LiteSpeed 14.1% and IIS 3.0%. Cloudflare Server tops the list at 31.8%; in Cloudflare's own description, its network sits in front of websites as a reverse proxy.

Performance and TTFB

According to web.dev, TTFB (Time to First Byte) measures the time between starting to navigate to a page and when the first byte of the response begins to arrive. It also covers steps such as redirects, the DNS lookup, and connection and TLS setup, so it measures the whole path, not just the server. web.dev suggests that most sites aim for a TTFB of 0.8 seconds or less. TTFB is not a Core Web Vitals metric, but because it precedes user-centric metrics such as FCP and LCP, it delays them too.

According to the optimization guide, hosting is the first thing to look at, followed by a CDN, caching and removing unnecessary redirects. The Server-Timing header helps measure individual backend processes. In Apache, allowing .htaccess files also adds file lookups to every request. There is a short definition in our glossary.

Web server security

According to NIST's SP 800-44 Version 2 (September 2007), web servers are often the most targeted and attacked hosts on an organization's network. The core measures:

  • Keep it updated: A path normalization flaw in Apache 2.4.49 (CVE-2021-41773) was exploited in the wild. According to Apache's security page, the fix in 2.4.50, released on October 4, 2021, was insufficient, and 2.4.51 had to follow on October 7. The Apache documentation points out that most compromises come not from the HTTP server code but from add-on code, CGI scripts or the underlying operating system, so updates have to cover all the software (patch management article).
  • Remove unneeded modules: According to Microsoft, installing only the modules you need eliminates the security risks of unused functionality and shrinks the attack surface; a default IIS installation includes only the modules required to run it as a static server.
  • Limit privileges: NGINX worker processes run under an unprivileged user; Apache is started as root and switches to the user defined by the User directive to serve requests.
  • TLS and WAF: TLS 1.0 and 1.1 were deprecated by RFC 8996 in March 2021. We cover certificate and protocol settings in our SSL article and protection against application-layer attacks in our WAF article.

We cover standardizing these settings in our system hardening service.

Where does a web server run?

Web server software can run on a physical server, a virtual machine or a cloud server; we compare the options in our server and cloud server articles. We explain who manages what on a cloud server in our IaaS article. In containerized applications, the web server can be part of an image; in Kubernetes, Ingress or Gateway API handles incoming traffic (Kubernetes article). We run the web server and application layer in our Application Runtime & Middleware Operations service, and the servers beneath it in our infrastructure management service.

Frequently asked questions

What does a web server do? It accepts HTTP requests from browsers, serves static files, passes dynamic requests to the application and returns the response to the client.

What is NGINX? An open-source HTTP web server that is also used as a reverse proxy, content cache and load balancer.

What is Apache? In the context of web servers, it usually means Apache HTTP Server, an open-source project of the Apache Software Foundation.

What is the difference between NGINX and Apache? Both are open-source web servers. NGINX handles requests in a few worker processes using an event-based model; Apache lets you choose the request-handling model through an MPM and allows per-directory configuration with .htaccess files.

What is TTFB? Time to First Byte: the time from starting to navigate to a page until the first byte of the response arrives. web.dev suggests aiming for 0.8 seconds or less.

Sources