A web server is a system that receives HTTP or HTTPS requests and provides web resources or services in response. The term can refer both to the software responsible for handling web requests and, more broadly, the physical or virtual computer on which that software operates. Common web-server software includes Apache HTTP Server, Nginx and Microsoft Internet Information Services.
A web server listens for network connections, commonly on TCP port 80 for HTTP and TCP port 443 for HTTPS, although other ports can be configured. When a client such as a web browser requests a resource, the web server processes the request and returns an HTTP response containing content, a status code, headers and potentially other information. The content might be a static HTML file, image, stylesheet or JavaScript resource, or the server may invoke application software that dynamically generates a response. Modern web architectures frequently distribute these responsibilities across multiple components rather than placing all functionality in one process.
HTTP, the Hypertext Transfer Protocol, defines the application-layer communication model used by the web. A browser can send an HTTP request containing a method such as GET or POST, a target resource, headers and potentially a request body. The web server returns an HTTP response containing a status code such as 200, 301, 404 or 500, response headers and optional content.
HTTPS is HTTP transported through a TLS-protected connection, providing encryption and authentication for the connection between the client and the HTTPS endpoint. A web server therefore does not inherently mean that all content is dynamic or that a database is involved. A simple server can return static files directly from disk, while a complex web application may use the web server as one layer in a large application stack. The HTTP protocol and the server's request-processing behaviour are what make the system a web server rather than the mere presence of a computer connected to the Internet.
A static web server serves resources that already exist as files or other pre-generated objects. If a browser requests an HTML document, the server can locate the corresponding file, read it and return it with an appropriate content type. Images, CSS, JavaScript, fonts and downloadable files can be handled similarly. Static serving is comparatively simple and can be highly efficient, especially when combined with caching and content-delivery networks. Dynamic web applications introduce additional processing.
A request may be passed to application code written in languages such as PHP, Python, JavaScript, Java, Ruby or another language. The application may authenticate the user, query a database, calculate a result and generate HTML or JSON. The web server can act as the front-facing HTTP component while a separate application server or process performs the application logic. The division between web server and application server varies between architectures and software platforms.
A web server does not necessarily equal a website. A website is a collection of web resources and functionality presented through web protocols, while a web server is the software or system that handles requests for those resources. One web server can host many websites through virtual hosting. The server can inspect the requested hostname, often supplied through the HTTP Host header or related TLS information, and select the appropriate site configuration.
This allows one physical or virtual server to serve multiple domains and applications. Conversely, a single website can use many servers distributed across multiple locations. DNS can direct clients towards load balancers or other front-end systems, which then distribute requests across multiple web servers. Large websites may therefore consist of browsers, DNS infrastructure, CDNs, load balancers, reverse proxies, web servers, application servers, caches and databases.
Web servers commonly perform functions beyond simply returning files. They can enforce access controls, perform URL routing, redirect requests, compress responses, manage caching headers, terminate TLS, record access logs and serve different content based on request characteristics. A reverse proxy can sit in front of application servers and receive Internet-facing requests before forwarding them internally. This architecture can isolate application processes from direct public exposure and provide centralised TLS termination, load balancing and security controls.
Web application firewalls can inspect HTTP requests for patterns associated with attacks such as SQL injection or cross-site scripting, although they do not replace secure application development. Web servers can also implement rate limiting and connection-management policies. The exact functions available depend on the software, modules and surrounding infrastructure.
DNS plays an important role in reaching a web server but is not itself part of the web server. When a user enters a domain name into a browser, DNS can resolve that name to an IP address. The browser then establishes a network connection to the appropriate endpoint, often using TCP for conventional HTTP/HTTPS or newer transports such as QUIC for HTTP/3. For HTTPS, TLS negotiation establishes an encrypted and authenticated session before HTTP messages are exchanged.
The web server's TLS certificate allows the client to verify that the endpoint is associated with the requested domain under the certificate's trust model. After the secure connection is established, the browser sends HTTP requests. This sequence illustrates that a website depends on several distinct technologies: DNS identifies an endpoint, IP provides network addressing, transport protocols provide communication, TLS can secure the connection, and HTTP defines the web request and response semantics.
Web servers must handle concurrency because many clients may request resources simultaneously. A server can use processes, threads, asynchronous event loops or other concurrency mechanisms to handle multiple connections. High-traffic services commonly use multiple web-server instances behind a load balancer. Caching can reduce the number of requests that need to reach application servers or databases. Content-delivery networks can distribute static resources to geographically dispersed edge locations.
Horizontal scaling adds more server instances, while vertical scaling increases the resources of individual machines. Reliability mechanisms can include health checks, automated failover, replicated application infrastructure and redundant network paths. The appropriate architecture depends on traffic volume, latency requirements, state management, application design and availability targets. A single web server can be sufficient for a small site, whereas a large Internet service may involve many layers and thousands of machines.
Security is an important part of web-server operation. Administrators should keep server software and dependencies patched, minimise unnecessary services, configure permissions appropriately, protect private keys, use secure TLS settings and monitor logs for suspicious activity. Web servers themselves can have vulnerabilities, but many attacks occur because of insecure application code or incorrect configuration behind the web server. HTTP security headers can help control browser behaviour, while authentication and authorisation determine who can access protected resources.
A server should also be protected at the network level through firewalls and access controls. Logging can record request methods, paths, status codes, client addresses and other metadata, but logs must be managed carefully because they may contain sensitive information. Secure operation therefore requires considering the web server as one component within a larger application and infrastructure security architecture.
