Hiawatha (web server)

Hiawatha is a free and open source cross-platform web server developed by Hugo Leisink.^[4]

Hiawatha development began in January 2002 as a web server. Leisink, a computer science student at the time, initially created it to support internet servers based in student houses in South Holland and the Netherlands, with security as its focus.

The January 2009 edition of Linux Magazine included an article on the Hiawatha web server, describing it as "a light web server with good performance and some innovative security functions."^[5] In 2015 Hiawatha was cited as a lightweight alternative to Apache, as it prioritized the installation experience and reduced storage over adding other features.^[6][7][8]

In February 2019, Hugo Leisink announced the end of major development for Hiawatha.^[9] Subsequent releases had focused on bug fixes and keeping components up to date.^[10] The project was then placed on hiatus in December 2023, receiving only basic bugfix support. However, as of February 2026, Leisink has resumed active development.^[11]

• 1.0: September 2002. A basic but functional web server.
• 2.0: March 2004. Use of multithreading instead of forking.
• 3.0: September 2004. SSL support.
• 4.0: December 2005. A CGI-wrapper^[12] for improved security was included.
• 5.0: October 2006. FastCGI support for improved CGI speed.
• 5.2: November 2006. First-time integration to the FreeBSD Ports system at version 5.2 in December 2006,^[13] to the OpenBSDports tree at version 5.7 in March 2007.^[14]
• 5.12: August 2007. URL rewriting support.
• 6.0: October 2007. IPv6 support.
• 6.6: April 2008. XSLT support.
• 6.10: October 2008. Prevent cross-site request forgery added.
• 7.0: February 2010. Remote monitoring support.
• 8.0: January 2012. Autoconf replaced with CMake, OpenSSL replaced with MbedTLS.
• 9.0: March 2013. Clients handled via thread pool instead of creating threads on the fly.
• 10.0: November 2015. Streamlined handling of Directory sections in server configuration.
• 11.0: July 2021. mbed TLS library updated to v3.0.0.
• 12.0: February 2026. mbed TLS library updated to v4.0.0.
• 12.1: April 2026. HTTP/2 support added.

The Hiawatha web server featured:

• CGI and load balancingFastCGI support
• Reverse proxy functionality
• Chroot support
• URL toolkit which supports URL rewriting
• SSL and TLS support
• Basic and digest HTTP authentication
• Upload speed control by traffic shaping
• Internal file caching
• IPv6 support
• HTTP compression using gzip
• Virtual hosting
• Support for WebDAV applications
• Support for Server Name Indication (added in v8.6)
• HTTP/2 protocol support (added in 12.1)

Hiawatha aimed to prevent SQL-injection, cross-site scripting (XSS), Cross-site request forgery (CSRF), and denial-of-service attacks. It allowed banning of potential hackers and had an option to limit the runtime of CGI applications.^[15]RFC3546 support was included with version 8.6, which was developed with PolarSSLv1.2.

In 2012, a performance test was carried out by an independent researcher (SaltwaterC). They found that Hiawatha was faster than ten other servers with Drupal static content, but performed comparably to the rest in other metrics.^[16]

Hiawatha has supported load-balanced FastCGI and the PHP project's FastCGI Process Manager (PHP-FPM).^[17]

• Comparison of web server software

• Official website
• Lavigne, Dru (December 29, 2006). "Hiawatha Web Server". IT Toolbox. Archived from the original on July 18, 2014. Retrieved June 29, 2010. (Unix blog)
• Schürmann, Tim (January 2009). "Der sichere Webserver Hiawatha"[The secure Web server Hiawatha]. Linux (in German). Admin Magazine. Archived from the original on 2016-03-04. Retrieved 2014-06-27.