I've stuck with Apache given it is what I know, having used it for over 15 years. Despite its flaws, it does the job pretty well. I'm also more confident that Apache's code is more battle tested. On top of that I disable all the modules I don't need so my attack surface is pretty small. I run a static site so I basically run Apache with only a few of its core modules. I've tried others (especially Caddy) and while I appreciate some of the enhancements, they don't really add any significant improvements for my use cases.