A web system comprising: a first web server configured to hold content; a second web server configured to hold the same content as the content held in the first web server; and a server switching apparatus configured to switch a web server providing the content to a user when a predetermined server switching condition is met, wherein the server switching apparatus includes: an attack detection means configured to detect whether or not the web server, of the first web server and the second web server, that is not active in order to provide the content to the user, has been attacked in the past; a switching means configured to switch from the web server that is active to the web server that is not active in case the predetermined server switching condition is met, wherein the predetermined server switching condition includes a condition that the web server that is not active has not been attacked in the past; and a transfer means configured to, when a request is received from the user, transfer the request to the web server, of the first web server and the second web server, that has been activated by the switching means, and wherein the web server, of the first web server and the second web server, that has been activated by the switching means, is further configured to send content requested by the request to the user. a first web server configured to hold content; a second web server configured to hold the same content as the content held in the first web server; and a server switching apparatus configured to switch a web server providing the content to a user when a predetermined server switching condition is met, wherein the server switching apparatus includes: an attack detection means configured to detect whether or not the web server, of the first web server and the second web server, that is not active in order to provide the content to the user, has been attacked in the past; a switching means configured to switch from the web server that is active to the web server that is not active in case the predetermined server switching condition is met, wherein the predetermined server switching condition includes a condition that the web server that is not active has not been attacked in the past; and a transfer means configured to, when a request is received from the user, transfer the request to the web server, of the first web server and the second web server, that has been activated by the switching means, and an attack detection means configured to detect whether or not the web server, of the first web server and the second web server, that is not active in order to provide the content to the user, has been attacked in the past; a switching means configured to switch from the web server that is active to the web server that is not active in case the predetermined server switching condition is met, wherein the predetermined server switching condition includes a condition that the web server that is not active has not been attacked in the past; and a transfer means configured to, when a request is received from the user, transfer the request to the web server, of the first web server and the second web server, that has been activated by the switching means, and wherein the web server, of the first web server and the second web server, that has been activated by the switching means, is further configured to send content requested by the request to the user.