Download websites that use thttpd

Web servers rarely die. They get shipped inside something and forgotten. thttpd is a small HTTP daemon written in C whose earliest year on our record is 1995, and as of October 2026 we still find it answering on 297 sites. A server of that age surviving on the public web is not usually a story about people choosing it today.

The design explains the survival. thttpd was built to be small, to serve static files quickly, to run in very little memory and to throttle bandwidth, which is exactly the profile a device manufacturer wants for an embedded management interface. Routers, cameras, printers, storage boxes, industrial controllers and cheap appliances all need a web interface that fits in flash and never asks for attention. A BSD licence makes the code free to embed and modify with almost no obligation attached, so it goes into firmware and stays there for the life of the hardware.

The version data supports that reading. We record 12 distinct versions across the detected population, with 2.29 carrying the bulk of them, which is a wide spread for a small install base and the signature of software frozen at build time rather than updated in place. Firmware moves when a vendor issues an image and an owner applies it, and neither of those events happens often.

So the population matters to people with no particular interest in web servers. An exposed daemon of this kind is usually a device management interface reachable from the internet, which is an asset inventory problem for the organisation that owns it and a research subject for anyone studying the exposure of embedded systems. Attack surface teams use the same kind of list defensively, to find the devices in their own address space that nobody ever registered as a web server.

Detection here is more direct than for most entries in the catalogue. A server that identifies itself in a response header can be counted without inference, which makes the figure comparatively trustworthy, with the standard caveat that headers can be rewritten or stripped by anything sitting in front of the device. A daemon behind a CDN or a reverse proxy will normally be counted as the front-end server instead, so the number is a floor rather than a census.

A per-domain lookup answers whether one host runs it. The extract answers where the whole visible population sits, which is the only practical way to study a technology whose users did not choose it and mostly do not know it is there. Sorting that population by country, by TLD and by the technologies detected alongside it is where the patterns show up, because the clusters follow hardware vendors and hosting providers rather than editorial preference.