A web server is the program that hands out websites. It sits on an internet-connected machine, waits for browsers to ask for a page, and sends back the HTML, images, stylesheets and scripts that make up what you see. People also use the term for the machine itself, but the software is what does the work.
What a web server does with each request
A browser connects to the server's address, normally on port 443 for HTTPS or 80 for plain HTTP, and sends a request such as GET /menu.html. The web server decrypts the connection if it uses TLS, works out which site and which file the request is for, and either reads that file from disk or passes the request to an application (PHP, Node.js, Python) that builds the page on the fly. It then returns a status code, like 200 for success or 404 for not found, plus headers and the content.
Along the way it typically compresses responses, sets caching headers, writes access logs, applies redirects and serves many sites from one machine by checking the requested hostname.
Familiar web server software
The best-known options are Nginx, Apache HTTP Server, LiteSpeed, Caddy (which obtains SSL certificates automatically) and Microsoft IIS. Node.js apps often include a small built-in server and sit behind Nginx in production.
Static file server versus application server
Consider a hair salon site. If its pages are prebuilt HTML, the web server just reads and returns files, which is fast and hard to break. If the salon adds a booking system, a request for available slots has to go to application code and a database before the web server can reply. Many setups split those roles: a web server handles files and HTTPS, and forwards dynamic requests to an application server behind it.
Should a business owner care which one?
On managed hosting, you never choose or configure it, and that is fine. It becomes relevant when you read an error page that names the software, when a developer asks to edit redirect rules, or when you run your own server and must keep the software patched.
Where web server setups go wrong
- Directory listing left on. Visitors can browse every file in a folder that has no index page.
- Serving the site on both HTTP and HTTPS without redirecting. This splits search signals and leaves some visitors on an insecure version.
- Exposing version numbers in headers. It tells attackers which known flaws to try.
- No compression or cache headers. Pages download more data than needed on every visit.