Findings · 2026-08-28 · By VSNARY | Emmanuel Orta
The web server that gained and lost 43 million sites
Netcraft counts 66 million sites running OpenResty. W3Techs does not list it at all. Both are measuring honestly, and the gap between them is the lesson.
In June 2026 one web server lost 42.9 million websites. Netcraft recorded OpenResty down 34.8% in a single month, its share falling to 5.40%. Nothing in the physical world moves 43 million sites in thirty days.
Five months earlier the same survey had it as the largest gainer on the web: plus 10.6 million sites in January, plus 8.3 million in February, plus 4.2 million in March. In April 2025 it had shed 27.1 million. In July 2025 its share read 3.15%; one month later, 6.39%.
Same web, two vendors, a factor of fifty
W3Techs publishes a web-server board as well. On 28 August 2026 it read nginx 31.3%, Cloudflare 29.8%, Apache 22.5%, LiteSpeed 14.8%, Node.js 7.0%, Microsoft-IIS 3.1%. OpenResty does not appear on it at all.
Both vendors are competent and neither is wrong. They are not counting the same thing. Netcraft counts every hostname that answers, so one parking operator with four million domains behind a single server contributes four million sites. W3Techs surveys the top ten million sites and counts each once. The first method sees the tail. The second sees the web people actually visit.
A third source settles which is which
BuiltWith reports 66,156,865 live sites running OpenResty, plus 64,055,218 that used to. Its own traffic breakdown, on the same page, says where those live sites are: top 1,000 sites 97, top 10,000 807, top 100,000 6,417, top million 126,279, outside the top million 65,974,038.
99.81% of the detections sit outside the top million. Inside the bands where sites have visitors, OpenResty runs somewhere between six and thirteen per cent: a normal, capable, unremarkable technology. The 66 million is tail, and the tail is mostly parked.
Three tells, all on the vendor page itself
Expired detections number 64.0 million against 66.2 million live. Real infrastructure does not churn at forty-nine per cent. Domain parking does.
The geography is impossible. The same page names OpenResty the most popular framework in Heard Island and McDonald Islands, which has no permanent population, and in the US Minor Outlying Islands, Micronesia and Saint Pierre and Miquelon. Those are .hm, .um, .fm and .pm: registrar territories, not countries with web industries. Cocos Islands shows 339,708 sites, ahead of Switzerland at 330,958.
And it holds the growth award in every window at once, seven, fourteen, thirty, sixty and ninety days. Organic adoption does not sweep all five. A bulk reconfiguration does.
What the vendor does with the number
OpenResty markets the flattering month on its own blog: over 85 million websites, 6.89% of the web, 14.31% of domains, fourth most popular web server in the world. Every figure is quoted accurately from Netcraft. None of it mentions that the same series later shed a third of it. That is the pattern worth naming, and it is not unique to this vendor: a statistic you publish becomes a claim somebody else repeats at whatever moment they happened to read it.
The incentive is worth naming as well. Under the BuiltWith figures sits a Download Lead List button offering 70,073,007 websites with contact details: the survey is the shop window for a sales database, and in that business a larger number is the thing being sold. Netcraft’s survey sits beside a brand-protection and threat-intelligence business. Neither fact makes a number wrong. Both are worth knowing before repeating one.
Why this matters if you own one site
A Server header is a string the server chooses to send. It is a claim, not a measurement, and it is the same category of thing as a request that calls itself GPTBot. The second can be checked, by matching the source address against the ranges the operator publishes. The first mostly cannot, because there is nothing to check it against.
OpenResty is nginx with LuaJIT compiled in. Ranking them as separate products measures header strings rather than software. A number built from unverifiable self-descriptions, counted across a population dominated by domains nobody visits, can be off by a factor of fifty while every party involved reports it correctly.
Our own boundary, declared rather than discovered
Our dataset page reports the platform of every site we have measured. On today read, 366 of 507 are unknown. That is not an oversight. Most sites now answer from behind a CDN and the origin identity is not in the response: all nine of the properties we operate return server: cloudflare and nothing further. Where we cannot see the origin we say unknown. We would rather publish a large unknown than a confident guess.
One last note, collected on the way to writing this. BuiltWith answered a plain server-side request with a bot-verification page at HTTP 200, and the figures above rendered only in a full browser. A company whose product is knowing what the web runs is itself unreadable to anything that is not a headed browser. That is the same finding we publish about other people sites, and it belongs here too.
Every figure above came out of this scanner.
Point it at your own domain and see the same measurements, free.