How to check which web server is running on a domain

Sometimes we must know what web server is running on a particular domain. Usually web hosts should be able to tell a client this, but if the client is afraid to ask, there is a way to ask the web server directly for this information.

Just to clarify: the web server is the process that serves files (HTML, PHP, ASP, images, etc) from a remote machine to your local web browser. The most likely choices in this day and age (2017) are Apache, NGINX or IIS. The latter is used by Windows servers, and the two former are used by Linux servers. There are other web servers too, such as lighttpd, but they’re used less commonly.

By asking the web server for this information, we can tell exactly who’s serving those files.

How to ask the Web Server

Let’s open a Terminal or Command Line Prompt window and utilise the good old fashioned Telnet protocol. Replace yourserver.com with the actual domain in question:

telnet yourserver.com 80

This has opened a channel to the web server through which we can now send a command – much like a web browser would send a request for a file. Let’s send him this:

head / http/1.0

As a response, we may be getting something like this:

HTTP/1.1 400 Bad Request
Server: nginx
Date: Sat, 08 Apr 2017 15:20:26 GMT
Content-Type: text/html
Content-Length: 166
Connection: close

The response may take a few seconds, especially if this results in a timeout or a bad request like in our example. There may also be other text, perhaps some HTML code. The main info we were after is presented next to the word “Server”, in this case it’s an NGINX web server at work there.

An Apache web server would perhaps give us a response like this:

HTTP/1.1 408 Request Timeout
Date: Sat, 08 Apr 2017 15:30:33 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
Content-Length: 221
Connection: close
Content-Type: text/html; charset=iso-8859-1

In this case we’re even being told which version web server and what operating system it’s running on.

And finally, for completion, an IIS web server may say something like this:

HTTP/1.1 200 OK
Content-Length: 1937
Content-Type: text/html
Content-Location: http://213.107.6.92/index.html
Last-Modified: Fri, 07 Apr 2017 22:15:26 GMT
Accept-Ranges: bytes
ETag: "809e619fdad9c51:7da"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Sat, 08 Apr 2017 15:35:07 GMT
Connection: close

This web server appears to be running Microsoft IIS with ASP. We can assume the operating system to be most likely Windows Server.

Caveat

Note that the information we get back may be misleading though: on Plesk servers for example, BOTH Apache and NGINX can be used to serve a web page. In this scenario, the above test will return NGINX, even though the site is served by Apache first and only distributed by an NGINX proxy.