Download websites that use Microsoft HTTPAPI

About Microsoft HTTPAPI

Almost nobody sets out to deploy Microsoft HTTPAPI. The component is the kernel level HTTP listener that ships inside Windows, and a server announces it in a response header whenever a request is answered by the operating system stack itself rather than by a full application server sitting above it. Detection here is therefore not a statement about what a site was built with. Detection is a statement about the machine underneath, which for a researcher is often the more durable fact.

Microsoft introduced the interface in 2003 as part of its server line, and it has been written against ever since by C# services that need to accept HTTP without carrying a separate web server of their own. IIS sits on top of it. Self hosted service endpoints, management consoles, remote APIs, licensing daemons and appliance firmware built on Windows sit on top of it as well, and the header survives all of them. That is why Microsoft HTTPAPI turns up on hosts that were never meant to serve a public web page at all.

As of October 2026 we detect Microsoft HTTPAPI on 153,388 sites. Version reporting is unusually flat, with only 2 distinct strings across that whole population and 2.0 appearing throughout it. A protocol level component moves with the operating system rather than with the application above it, so the version string says far less about patch level than a framework version would. What the version string does carry is era, and era is enough to separate a maintained estate from one that has been left alone.

Geography follows the enterprise market for the platform. 41,801 of the sites we see are served from United States, and the .com suffix is heavily represented across the rest of the file. Corporate infrastructure sells into corporate markets, so the distribution is close to what anyone would predict, and the distribution is not the reason to download the list.

The reason is that a list like this is a Windows census taken from the outside. Anyone selling Windows tooling, dotnet consulting, migration work or endpoint hardening needs to know which estates still run on that stack, and no registry or public filing records it anywhere. A per domain lookup answers whether one host you already suspected is running Windows underneath. A downloadable population answers the inverse question, which is which hosts to suspect in the first place, and it lets you cut that population by country, suffix and version before anyone spends an hour on research.

The honest caveat is that this signal is a header, and headers can be suppressed, rewritten by a proxy or hidden behind a CDN. A Windows fleet sitting behind a reverse proxy will not report itself, so our count is a floor rather than a measurement of the Windows web as a whole. What we can say about every row in the file is that the header was present when we looked, and the October 2026 stamp tells you exactly when that was.