Download websites that use Nginx

About Nginx

Nginx exists because of a bottleneck that has since stopped being interesting. Servers of its era handled each connection with a process or a thread, and once concurrency climbed past a certain point, the machine spent more effort scheduling than serving. Nginx answered that with an event loop, and the answer turned out to be general enough to outlive the problem.

As of September 2026 we detect it on 70,109,524 sites, which puts it among the pieces of software you can assume is present somewhere in almost any infrastructure conversation. Software at that level of ubiquity repays close reading rather than a headline count.

The interesting structure is underneath. Across those sites we currently see 407 distinct version strings in production, with 1.28.3 the single most common one. Wide version spread is the normal condition for software people install themselves and then stop thinking about, because nothing in the operational loop forces an upgrade until something breaks. A web server that works does not announce that it is three years behind.

That has consequences beyond tidiness. Every published advisory applies to a range of versions, and the population of sites inside that range is not a rounding error at this scale. Anyone doing vulnerability research, insurance underwriting or supply chain assessment needs the distribution rather than the mode, because the risk lives in the tail and the tail is where public summaries stop reporting.

Geography adds a second axis. The largest concentration sits in United States, where we detect it on 23,300,992 sites, and the .com zone carries more of it than any other. Hosting concentration is not a market share statement. Figures of that kind reflect where hosting capacity is dense, which is a useful thing to know precisely because it does not match where the businesses behind those sites are.

The reason to want a list rather than a chart becomes obvious once you try to answer a real question. Which sites in one country run a version below a given threshold. Which of those also run a particular application layer on top. Which appeared since the previous rebuild and were not there before. None of that is a lookup. It is a filter over a population, and it needs the population.

That is what the webatla export is. Every domain we detect running it, with the version string we observed, the hosting country, the TLD and the rest of the stack we fingerprinted on the same site, as one file rebuilt daily. You run the query on your own machine, at whatever cardinality you like, without a rate limit between you and the answer.

There is a further wrinkle that only shows up once you hold the whole population. A version string is self-reported, and a meaningful share of deployments suppress or rewrite it deliberately as a hardening measure. That means the observable distribution is biased toward the less carefully administered end of the estate, which is worth stating plainly rather than quietly correcting for. The sites that hide their version are, on average, the ones you were least worried about.

The same population also lets you answer questions about co-location rather than software. Because the export carries every detection on a domain together, you can ask which sites front one application stack with this server and a different one elsewhere, or which combinations appear almost exclusively inside a single hosting provider's ranges. Those patterns are invisible in any per-technology view and obvious in a full table.

F5 Networks maintains it under the BSD license, and it has been publicly available since 2004. The license matters less than the distribution model: because anyone can install it without registering anywhere, no vendor has a customer list, and the only way to know the population is to go and measure it.