What Is a Web Server?

Learn what a web server is, how browsers use HTTP and HTTPS to request content, and how servers handle static files, applications, security, hosting, and scaling.

A web server is the software and infrastructure that accepts web requests and returns web resources or application responses. The term can describe the physical or virtual machine providing the service, the operating system and network environment around it, or the server software running there.

Web servers deliver websites, web applications, APIs, images, downloads, and redirects. A simple server may return an HTML file directly. A larger deployment may receive HTTPS traffic, serve static assets, forward application requests, and distribute traffic across several backend systems.

The Client-Server Model

The client is a browser, mobile app, command-line program, or another HTTP client that requests a resource. The web server is the system that listens for incoming connections, interprets requests, performs configured actions, and sends responses.

The client creates a request for a resource or operation.
The request travels across a network to the server.
The server examines the method, hostname, path, headers, and optional body.
The server returns a response containing a status, headers, and usually content.

For example, when a browser requests an image, the web server may find the image in its document root and return it. When the browser submits a login form, the server may forward the request to application code, which checks credentials and creates a response.

How a Browser Reaches a Web Server

A URL identifies a web resource. It can include a scheme such as https, a hostname such as www.example.test, an optional port, a path, a query string, and a fragment. The fragment is handled by the browser and is normally not sent to the server.

The browser parses the URL to determine the protocol, hostname, port, and path.
DNS looks up the hostname and returns an IP address. DNS maps names to network addresses; it does not deliver the page itself.
The client opens a network connection to the destination IP address and port. HTTP normally uses port 80; HTTPS normally uses port 443.
For HTTPS, the client and server perform a TLS handshake. The server presents a TLS certificate, and the connection is encrypted after the handshake succeeds.
The browser sends an HTTP request containing the hostname and requested path.
The server returns an HTTP response. The browser may then request additional CSS, JavaScript, images, fonts, and API data.

HTTP is the application-layer protocol used for web requests and responses. HTTPS is HTTP protected by TLS encryption and server authentication. Network routing and IP addressing determine how traffic reaches the host; HTTP determines how the client and server communicate once connected. See HTTP fundamentals for more protocol detail.

HTTP Requests and Responses

An HTTP request commonly contains a method, path, headers, and an optional body. The Host header identifies the hostname the client wants, which is important when one server hosts multiple sites.

GET /images/logo.png HTTP/1.1
Host: www.example.test
Accept: image/avif,image/webp,image/*

GET asks for a resource and usually has no body. POST submits data, such as a login form or JSON API payload. Other methods include PUT, PATCH, and DELETE.

A response contains a numeric status code, response headers, and an optional body:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 1250

<!doctype html> ...

Status code	Category	Typical meaning	Common example
200	Success	Request completed	HTML page returned
301 or 308	Redirection	Use a different permanent URL	HTTP redirected to HTTPS
302 or 307	Redirection	Use a temporary URL	Temporary maintenance route
400	Client error	Request is malformed or invalid	Invalid API input
401	Client error	Authentication is required or failed	Protected API endpoint
403	Client error	Server understood but refuses access	File or directory permission rule
404	Client error	Requested resource was not found	Missing page or image
500	Server error	Server-side code or configuration failed	Unhandled application error
502	Server error	Proxy received an invalid backend response	Stopped application process
503	Server error	Service is temporarily unavailable	Overloaded or maintenance state
504	Server error	Backend did not respond in time	Slow or unreachable application

Static and Dynamic Content

Characteristic	Static content	Dynamic content
How it is produced	Stored as files and returned largely as-is	Generated or assembled when requested
Examples	HTML, CSS, JavaScript, images, fonts, downloads	Personalized pages, search results, API responses
Typical processing path	Web server reads from the document root	Web server forwards to application code or an application server
Caching potential	Often straightforward to cache	Depends on user data, freshness, and response rules
Backend dependencies	Usually storage and network access	May require runtimes, services, and a database

The document root is the directory from which a web server publishes static files. A request for /index.html might map to /var/www/site/index.html. Dynamic requests such as /login or /api/orders are commonly passed to application code, which may read or write data in a database.

Web Server Software

Common web-server implementations include Apache HTTP Server, Nginx, Microsoft IIS, Caddy, and built-in development servers. They overlap in capability, but their defaults, configuration styles, operating-system integration, and team workflows differ.

Software	Typical strengths or use cases	Supported deployment environments	Notable role
Apache HTTP Server	Flexible modules, mature configuration, broad hosting support	Linux, Windows, and other platforms	Static hosting, virtual hosts, and proxying
Nginx	Efficient event-driven handling and reverse proxying	Linux, Windows, containers, and cloud systems	Front layer, static delivery, and load distribution
Microsoft IIS	Integration with Windows and Microsoft application platforms	Windows Server	Managed Windows web hosting
Caddy	Simple configuration and convenient HTTPS automation	Linux, Windows, macOS, containers, and cloud systems	Web serving and reverse proxying
Development servers	Quick local testing with minimal setup	Language runtimes and framework environments	Development only; often unsuitable for production

Shared capabilities commonly include virtual hosting, routing rules, TLS handling, access and error logging, compression, caching, access control, request limits, and reverse proxying. No implementation is universally best: selection depends on the platform, workload, performance requirements, operational skills, and preferred configuration style. For Apache configuration concepts, see Apache configuration files.

Machines, Hosting, and Deployment Environments

A web server does not need to be one dedicated physical computer. It may run on dedicated hardware, a virtual machine, a container, a cloud instance, or infrastructure managed by a hosting provider. Static content may also be delivered by serverless or edge services without a continuously running server that the site owner manages directly.

Dedicated hardware: one physical system reserved for the workload.
Virtual machine: an isolated software-defined computer running on shared hardware.
Container: a packaged process with its dependencies, sharing the host operating system kernel.
Cloud instance: an on-demand virtual server with configurable resources.
Managed hosting: a provider operates much of the server, updates, and platform.
Serverless or edge delivery: provider infrastructure runs code or serves cached content near users.

At a high level, CPU handles computation, memory holds active processes and data, storage holds files and logs, and network capacity affects connection volume and transfer speed. The correct balance depends on whether the workload is file delivery, application processing, database access, or a combination.

Ports, Hostnames, and Virtual Hosts

A port is a numbered endpoint on a host. HTTP commonly listens on port 80 and HTTPS on port 443, although administrators can configure other ports for development or internal services.

A virtual host lets one machine or IP address serve multiple domains. DNS can map site-a.example and site-b.example to the same address. The client includes the desired hostname in the HTTP Host header, allowing the server to select the matching site configuration. During an HTTPS handshake, TLS Server Name Indication also communicates the requested hostname so the server can select the appropriate certificate before encrypted HTTP is exchanged.

server {
    listen 80;
    server_name example.test;
    root /var/www/example.test;
    index index.html;
}

This is a conceptual Nginx server block. Exact file locations, site-enabling steps, permissions, and reload commands vary by operating system and installation.

HTTPS, TLS, and Certificates

HTTPS encrypts traffic between the client and the TLS endpoint, helping prevent others on the network from reading or modifying it. It also helps the client authenticate the intended site. A TLS certificate is a digital credential containing a domain name and a public key. A certificate authority verifies identity according to its validation process and signs the certificate.

Certificates expire and must be renewed. The server must present the correct certificate chain and associate it with the correct hostname. TLS may terminate at the web server, a reverse proxy, or a load balancer. If it terminates before the application, the internal connection still needs suitable protection when the network or trust boundary requires it.

Reverse Proxies and Application Servers

A reverse proxy is a front-facing server that receives public traffic and forwards selected requests to backend services. It may terminate TLS, serve static files, cache responses, route paths, balance traffic, enforce limits, and shield application processes from direct public exposure.

location /api/ {
    proxy_pass http://127.0.0.1:3000/;
}

In this example, requests under /api/ are forwarded to an application listening on a local port. A production configuration also needs suitable forwarding headers, TLS settings, timeouts, authentication boundaries, and security controls.

An application server or runtime executes application code, such as code for authentication, business rules, or database access. A web server specializes in HTTP handling and efficient file delivery, but the categories are not mutually exclusive. Some frameworks include a basic HTTP server, while production deployments commonly place a dedicated web server or reverse proxy in front of the application runtime.

A Typical Web Application Deployment

Consider a site using a reverse proxy in front of an application:

A browser resolves the domain and opens an HTTPS connection to the front-facing server.
The web server or reverse proxy selects the certificate and site configuration.
Requests for CSS, JavaScript, and images are served directly from the static document root.
Requests such as /api and /login are forwarded to an application process.
The application validates input, applies business rules, and communicates with a database server.
The application response travels back through the proxy to the browser.

A database server stores and queries structured application data. It normally should not be exposed directly to public browsers. See What is MySQL? for an example of a database system.

Performance and Availability

Web servers must handle concurrent connections: multiple clients being served at the same time. They may use worker processes, worker threads, or event-driven handling. Keep-alive connections reuse a connection for multiple requests, reducing connection setup overhead.

Compression: reduces transferred size for suitable text and other compressible content.
Caching: reuses a response instead of regenerating or rereading it for every request.
CDN: a geographically distributed network that caches or delivers content closer to users.
Load balancing: distributes requests among multiple servers.
Horizontal scaling: adds more server instances rather than only making one instance larger.
Monitoring: tracks availability, latency, errors, resource use, and traffic patterns.

Access logs show incoming requests and response details. Error logs record warnings, failures, and diagnostic information. Together with metrics and alerts, they help operators identify slow responses, failed backends, unexpected traffic, and capacity problems.

Security Responsibilities

Keep the web-server software, operating system, libraries, and application dependencies updated.
Use least-privilege file ownership and permissions so the service account can access only what it needs.
Use firewall rules and cloud security groups to expose only required ports.
Use current, correctly configured TLS settings and renew certificates before they expire.
Set request-size, header, connection, and timeout limits appropriate to the application.
Do not expose administrative interfaces, debug endpoints, configuration files, or secrets unnecessarily.
Disable unintended directory listing and verify redirect behavior, especially redirects from HTTP to HTTPS.
Review logs and plan for denial-of-service pressure, rate limiting, and upstream protection.

Web-server security and application security are related but distinct. A secure server can still host vulnerable application code, and secure application code can be exposed by incorrect permissions or unsafe server configuration.

Basic Local Setup and Verification

Create a directory containing an index.html file:

<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><title>Test site</title></head>
<body><h1>It works</h1></body>
</html>

Run the following command from that directory:

python -m http.server 8000

Open http://localhost:8000/ in a browser. localhost refers to the local computer, and port 8000 is a development port. The Python process reads the document root and returns the HTML file. The browser may then request any additional assets referenced by that page.

Inspect response headers with:

curl -I https://example.com/

Use curl -v when you need connection and request details. In a managed or packaged installation, configuration files are commonly stored under an operating-system-specific configuration directory. The document root contains published files; access logs contain request records; error logs contain failures and diagnostics. Exact paths differ between Apache, Nginx, IIS, Caddy, containers, and hosting providers.

Web Server and Related Components

Component	Primary role	Example interaction with a web server
Browser/client	Requests and displays resources	Sends `GET /` and renders the response
DNS resolver or DNS server	Maps names to IP addresses and records	Resolves a site hostname before connection
Web server	Accepts HTTP requests and returns or routes responses	Serves an HTML file or proxies `/api`
Application server/runtime	Executes application logic	Processes login data and returns a response
Database server	Stores and queries application data	Returns user or product records to the application
Reverse proxy	Fronts and forwards requests to backends	Terminates TLS and routes by path
Load balancer	Distributes traffic across instances	Sends requests to a healthy application server
CDN	Delivers cached content from distributed locations	Returns an image from a nearby edge location
Web hosting provider	Supplies managed infrastructure and connectivity	Runs the server and provides storage, networking, or deployment tools

Web Server Versus Similar Terms

Website: the collection of pages and resources users access; it is not the machine serving them.
Web host: a provider or service that supplies infrastructure for websites.
Domain registrar: a company through which a domain name is registered; it is not necessarily the web host.
DNS server: answers name-resolution queries; it does not normally return website pages.
Browser: a client that requests, interprets, and displays web resources.
Database server: stores data for applications and usually serves database protocols rather than browser requests.
Application server: runs application logic; it may sit behind a web server.
Proxy server: makes requests or forwards traffic on behalf of clients or services. A reverse proxy specifically represents backend servers to public clients.
CDN: distributes cached or generated content across edge locations.

Publishing a website often involves a registrar for the domain, DNS records pointing the domain toward hosting infrastructure, a CDN or load balancer at the edge, a web server for HTTP and static files, an application runtime for dynamic behavior, and a database for persistent data.

Troubleshooting Common Problems

DNS or site-not-found errors

Check the spelling, inspect the domain records, and compare the resolved IP address with the intended server address. Missing, incorrect, or recently changed DNS records and an unreachable DNS resolver are common causes.

Connection refused or timeout

Check whether the server process is running and listening on the expected interface and port. Test locally on the host, then inspect firewalls, cloud security groups, network policies, service status, and logs. A refused connection often means no process is accepting the connection; a timeout can indicate filtering or an unreachable host.

404 Not Found

Verify the requested path, file placement, document root, virtual-host match, and application route. Access and error logs can show which configuration handled the request and what resource it attempted to find.

403 Forbidden

Review file ownership, permissions, server access rules, and index-file settings. A directory without an index file may produce 403 when directory listing is disabled.

HTTPS warning

Inspect the certificate's expiration date and hostname names. Also verify the certificate chain, renewal process, TLS configuration, and the virtual host selected for the request.

502 or 504 from a proxy

Request the backend directly from the proxy host, confirm the application process and listening port, and check that the upstream address is correct. Review both proxy and application logs, then investigate backend overload, network blocks, and timeout settings.

Exam- and Interview-Relevant Notes

Port 80 is the conventional default for HTTP; port 443 is the conventional default for HTTPS.
DNS resolves names to addresses, while the web server handles HTTP requests after network connectivity is established.
A 404 usually means the requested resource or route was not found; a 403 means access was refused.
A reverse proxy is in front of backend services from the client's perspective; a forward proxy is in front of clients.
Static content is usually served from files, while dynamic content is generated by application code.
A virtual host allows multiple domains or sites to share one server or IP address.
HTTPS provides encrypted transport and certificate-based server authentication, but it does not automatically make application code secure.

For connected networking foundations, review computer networks, TCP and UDP ports, and what a router does.