IIS vs Apache – If you host a website, chances are good that you are running either Apache or Internet Information Services (IIS). Depending on the data source, they are two of the most common web server platforms, comprising a virtual triumvirate with Nginx for control of the market.
Table of Contents
They each also have their passionate supporters and haters. In fact, IIS vs. Apache flame wars are many times really spillover or proxy tirades of ‘Microsoft vs. Linux’. A compare-and-contrast exercise between the two web servers should be as objective as possible, which is what we’ll try and do here and not get drawn into personal preferences and emotional-laden outbursts.
What is IIS?
IIS (Internet Information Services) is Microsoft’s web server offering, playing second fiddle to market leader Apache. As is expected of a core Microsoft product, it only runs and is bundled on Windows operating systems, but is otherwise free for use. It is a closed software product and supported by solely by Microsoft. Although development is not as open and quick as the open-source user-supported nature of Apache, a behemoth like Microsoft can throw formidable support and development resources at its products, and IIS has fortunately benefitted from this.
Actually it is one of the few Microsoft products that even its detractors (grudgingly) agree can stand toe-to-toe with its open source rival and even trounce it soundly in some areas. There is a lite version called IIS Express that has been installable as a standalone freeware server from Windows XP SP3 onwards. But this version only supports http and https.
Solid feature, performance and security improvements over the years have meant that IIS has steadily improved and gained ground and market share on Apache. Security has been one area of significant gain, making huge leaps from the days of IIS 6.0’s vulnerability to the infamous Code Red worm. All has not been perfect however; for instance IIS historically experienced poor support for PFS (Perfect Forward secrecy) – a property of key cryptography that ensures a long-term key will not be compromised if a single component session key is compromised or broken.
Still, the IIS-Apache security comparison may not be fair to IIS. IIS vulnerability may also be largely blamed on its operating system parent since most malware targets Windows, and Linux (Apache’s main choice of OS) is itself an offshoot of the inherently iron-clad Unix OS.
Like Apache, IIS also utilizes external web extensions to implement some features. For example FTP publishing, application request routing, media services and URL rewriting are all new features introduced in IIS 7.5 via extensions. And IIS offers strong support for the Microsoft products .NET (framework) and ASPX (scripting), so if your website relies heavily on these, IIS is a clear frontrunner as a choice of web server.
And IIS offers in-depth diagnostic tools such as failed request tracing, request monitoring and runtime data, in addition to virtual hosting support. But a major concern is that choosing IIS necessitates also picking Windows, with its attendant high cost and security implications compared to Linux.
IIS is reported as being slightly behind Apache in terms of performance. However, these results are tainted because the underlying operating system environment cannot be equalized in order to set an equal base. IIS is inextricably tied with Windows (for example IIS can easily pass and receive process threads from the Windows OS), and Apache simply cannot perform as well there. But both Apache and IIS are still handily beaten in terms of performance by the Nginx web server.
IIS means Internet Information Services, which runs on the Microsoft .Net platform on the windows OS. While it is possible to run IIS on Linux and Macs using Mono, this is considered as unstable. The internet cannot survive without webservers. Webserver is process of hosting web applications. This allows to process messages that arrive through particular TCP ports.
The two main processes of handling the web requests are : either handle by single thread or to spawn a new thread for each request. The thread per request model of which that IIS uses will grab a thread from a thread pool for each request.
IIS is rich in features. IIS is used to host ASP.Net web applications and static websites. It can also be used as an FTP Server and extended to host web applications built on different platforms.
There are many built in authentication options such as Basic, ASP.Net and windows authentication. One of the key features of IIS is the application pool. An invaluable feature is remote management. IIS can be managed via the CLI using power Shell. IIS works through a various standard languages and protocols. HTML is to create different elements like text, buttons, and image placements, direct interactions and hyperlinks. Developers can create IIS websites with a number of tools, including WebDAV which can create and publish web content.
Cost: Comes with Windows (this means additional cost is involved for licensing)
Advantages:
- It is supported by Microsoft
- Access to .NET framework & ASP scripts is provided
- Microsoft IIS integrates with the other Microsoft services like MS SQL, ASP, Active Directory etc.
Disadvantages:
- With IIS, you cannot customize as much as open-source web servers
What is Apache?
Apache, or to use its full royal title The Apache HTTP web server, is an open source Web server application managed by the Apache Software Foundation. The server software is freely distributed, and the open source license means users can edit the underlying code to tweak performance and contribute to the future development of the program – a major source of its beloved status among its proponents. Support, fixes and development are handled by the loyal user community and coordinated by the Apache Software Foundation.
Although Apache will run on all major operating systems, it is most frequently used in combination with Linux. These two, combined with MySQL database and PHP scripting language, comprise the popular LAMP Web server solution.
Apache used to command a huge lead in the web server market, but this has changed over the years. According to a 2019 Netcraft survey, IIS and Apache are now virtually tied for market share of installations, at 28.4% and 26.1%, respectively. However, that’s not the whole story, as Apache has a big lead on the measure of “active sites,” with 30.99% compared to just 6.21% for IIS, suggesting that many IIS installations are on sites that are not actively used, such as default demo sites set up internally and never used.
Feature-wise, Apache boasts an impressive repertoire. Many features are implemented as compiled modules to extend the core functionality. These can range from server-side programming language support to authentication schemes.
Some common language interfaces support Perl, Python, Tcl, and PHP. Popular authentication modules include mod_access, mod_auth, mod_digest, and mod_auth_digest, the successor to mod_digest. A sample of other features include Secure Sockets Layer and Transport Layer Security support (mod_ssl), a proxy module (mod_proxy), a URL rewriter (mod_rewrite), custom log files (mod_log_config), and filtering support (mod_include and mod_ext_filter). Apache also supports virtual hosting, which enables one machine to host and simultaneously server several different websites, and a number of good, well-developed GUI interfaces. Another notable feature is web page compression to reduce their size over http. This is also achieved by an external module, one called mod_gzip. And security is one of Apache’s noted strengths.
When it comes to performance, conventional wisdom has it that Apache is just OK, a bit better than IIS but quite a bit slower than its main open-source rival Nginx. This has been borne out by objective tests. Though by no means slow for most general tasks, Apache is still held back by two of its main features:
- Feature bloat: Apache is frequently compared to MS Word – an extremely feature-rich application in which 90% of users only use about 10% of the features on a regular basis.
- Apache is a process-based server, unlike many of its rivals that are event-based or asynchronous in nature. In a process-based server, each simultaneous connection requires a separate thread and this incurs significant overhead. An asynchronous server, on the other hand, is event-driven and handles requests in a single or very few threads.
It is an open source of free software which gives powers many websites. Its official name is Apache HTTP Server which is maintained by Apache foundation. Its main job is serving the website owners, the content of the websites. It is very old and reliable web server.
As we call Apache webserver, it is not a physical server but rather software that runs on a server. Its job is to create a connection between the server and the browsers when visitors visit the websites while delivering files back and forth. Apache is customisable software. As it has a module based structure, these allow server administrators to turn additional functionalities on/off. Apache has various modules which include security modules, caching, URL re-writing, password authentication and more.
Some common features in Apache include .htaccess, IPV6, FTP, HTTP/2, perl/Lua, WebDav, Load balancing, URL rewriting, session tracking. An Apache webserver can host multiple websites on the same server without separating the server machine and apache software for each websites. This concept is called as Virtual Host or VHost.
There are two types of Apache Virtual Host:
- Name-Based Virtual – Host
- Address-based virtual – Host
Name based virtual host is used to host multiple virtual sites in one IP address. By setting the IP address on apache requests of desired websites are received. IP or address based virtual hosting we need to set more IP addresses configured on the server. If the server has 10 IP addresses then 10 virtual hosts can be created. Apache webserver is widely used by web hosting companies for the purpose of providing virtual hosting. Apache machine differentiates between different hosts and reside on the same machine.
Cost: Open source, free, no licensing fees
Advantages:
- There is flexibility in selecting various modules
- Enhanced security is offered
- Has strong user-community support
- Runs on UNIX, Windows, Linux, Mac OS
Disadvantages:
- It is a process based server; this means that every simultaneous connection requires a thread that can take significant overhead
The Differences between Apache and IIS are:
- IIS comes as a package with windows and apache is an open software.
- While IIS runs only on the windows, Apache can run on different OS.
- IIS integrates with other Microsoft programs like .Net and ASP scripting language.
- IIS has help desk to handle most of the issues while support for the apache comes from the user community.
- The security features of IIS makes it safer than Apache.
IIS vs Apache
Differences between IIS and Apache include:
- IIS is packaged with Windows while Apache is free and Open Source.
- While IIS only runs on Windows, Apache can run on almost any operating system, including macOS, UNIX and Linux (it’s best suited for Linux).
- IIS integrates with other Microsoft offerings, such as .NET and the ASPX scripting language.
- IIS has a help desk to handle most issues while support for Apache comes from the user community.
- The security features of IIS make it a safer option than Apache.
- IIS’ underlying technology is compatible with standard web interfaces worldwide.
