Download websites that use lighttpd

About lighttpd

A web server with 82 distinct versions still answering requests is telling you something about its users before you look at anything else. lighttpd is small, fast and old, released in 2003 and written in C, and the reason so many builds survive in the field is that a large share of them are not websites at all.

Lighttpd ended up inside things. Routers, cameras, storage boxes, printers, industrial controllers and set-top boxes ship it as the server behind an administration panel, because it fits in very little memory and needs almost no configuration to serve a few pages. Firmware gets written once and updated rarely, so the release we record most often, 1.4.45, persists not because an administrator chose it but because it was compiled into a device long ago and the device is still plugged in.

The practical consequence is that this population splits in two and the split is not labelled. One part is deliberate hosting: static file servers, media and asset delivery, small virtual machines where somebody wanted something lighter than Apache. The other part is device management interfaces that were never meant to face the public internet. Both answer with the same banner. Telling them apart takes the surrounding evidence, which is what the rest of the dataset provides: what the page title says, whether the address resolves into a residential or carrier network, whether anything else in the stack looks like a content management system.

Russia accounts for 110,459 of the 155,139 sites we detect as of September 2026, and .ru leads the domain breakdown. Concentrations of that size in a server population usually reflect a hosting provider's default image or a national carrier shipping the same customer equipment to every subscriber. Either explanation points at the same conclusion: the country column here describes where the machines physically sit, not where anybody made a decision about web infrastructure.

The server is community maintained under the BSD license with no company behind it, which removes the commercial angle a proprietary product would have and replaces it with a security one. An unpatched, widespread, unattended server is a research target and an exposure to be sized, and the version spread in the Web servers data is what makes that work tractable, because narrowing the population down to the builds affected by a specific advisory becomes a query rather than a project.

Detection rests on the server banner. Anything behind a CDN or a reverse proxy reports the front end instead, and administrators who suppress the banner drop out of the count entirely, so the figure is a floor. A per-domain lookup confirms one host and nothing more. The downloadable list is what lets you count an affected estate, watch a version cohort shrink after a patch lands, and find the networks where old firmware is concentrated.