A web system comprising: a first web server configured to hold content; a second web server configured to hold the same content as the content held in the first web server; and a server switching apparatus configured to switch a web server providing the content to a user when a predetermined server switching condition is met, wherein the server switching apparatus includes: an attack detection means configured to detect whether or not the second web server has been attacked in the past in case where the first web server is active to provide the content to the user and the second web server is not active to provide the content to the user; a switching means configured to switch from the web server that is active to the web server that is not active in the case where a condition that the web server that is not active has not been attacked in the past, serving as one server switching condition, is met, wherein the switching means is configured to switch from the web server that is active to the web server that is not active in order to provide the content in the case where a set period of time has been measured or a predetermined time has been reached, and the attack detection means has not detected an attack; and a transfer means configured to, when a request is received from the user, transfer the request to the web server that has been activated by the switching means, and wherein the web server that has been activated by the switching means, is further configured to send content requested by the request to the user. a first web server configured to hold content; a second web server configured to hold the same content as the content held in the first web server; and a server switching apparatus configured to switch a web server providing the content to a user when a predetermined server switching condition is met, wherein the server switching apparatus includes: an attack detection means configured to detect whether or not the second web server has been attacked in the past in case where the first web server is active to provide the content to the user and the second web server is not active to provide the content to the user; a switching means configured to switch from the web server that is active to the web server that is not active in the case where a condition that the web server that is not active has not been attacked in the past, serving as one server switching condition, is met, wherein the switching means is configured to switch from the web server that is active to the web server that is not active in order to provide the content in the case where a set period of time has been measured or a predetermined time has been reached, and the attack detection means has not detected an attack; and a transfer means configured to, when a request is received from the user, transfer the request to the web server that has been activated by the switching means, and an attack detection means configured to detect whether or not the second web server has been attacked in the past in case where the first web server is active to provide the content to the user and the second web server is not active to provide the content to the user; a switching means configured to switch from the web server that is active to the web server that is not active in the case where a condition that the web server that is not active has not been attacked in the past, serving as one server switching condition, is met, wherein the switching means is configured to switch from the web server that is active to the web server that is not active in order to provide the content in the case where a set period of time has been measured or a predetermined time has been reached, and the attack detection means has not detected an attack; and a transfer means configured to, when a request is received from the user, transfer the request to the web server that has been activated by the switching means, and wherein the web server that has been activated by the switching means, is further configured to send content requested by the request to the user.