About

Introduction

Hiawatha is an open source webserver with a focus on security. I started Hiawatha in January 2002. Before that time, I had used several webservers, but I didn't like them. They had unlogical, almost cryptic configuration syntax and none of them gave me a good feeling about their security and robustness. So, I decided it was time to write my own webserver. I never thought that my webserver would become what it is today, but I enjoyed working on it and liked to have my own open source project. In the years that followed, Hiawatha became a fully functional webserver.

Version history

Like every new project, Hiawatha started very small. All the nice features Hiawatha has today, weren't available in the beginning. To give you an idea about how Hiawatha grew up, here is an overview of the most important Hiawatha releases and their biggest new feature.

1.0: September 2002, a basic but functional webserver.
2.0: March 2004, use of multithreading instead of forking.
3.0: September 2004, SSL support.
4.0: December 2005, a CGI-wrapper for improved security was included.
5.0: October 2006, FastCGI support for improved CGI speed.
5.12: August 2007. URL rewriting support.
6.0: October 2007, IPv6 support.
6.6: April 2008. XSLT support.
7.0: February 2010, the Hiawatha Monitor for remote webserver monitoring.
8.0: January 2012, Autoconf replaced with CMake and OpenSSL replaced with PolarSSL.

Project goals

Because of my great interest in IT security, I paid extra attention to security while I was working on Hiawatha. Beside all the default security measures you can expect from a modern webserver, there are a lot of security features in Hiawatha you won't find in any other webserver. Many of them started as an experiment, but in the meantime, most of them have proven to be very usefull.

A second thing I wanted my webserver to be is easy-to-use. This resulted in a readable configuration syntax and not having to be a HTTP or CGI expert in order to get Hiawatha running.

Support

Hiawatha started as a webserver for my own Debian Linux server, but in the meantime it has become available on many operating systems. Compile and run tests of Hiawatha have successfully been done (by myself and others) on Debian, Ubuntu, Gentoo, Fedora, Slackware, FreeBSD, OpenBSD, NetBSD, MacOS X, Solaris and Cygwin. Because of the use of autoconf, it's very likely that Hiawatha will compile and run on other Unix-clones as well.

A package / port is available for the following operating systems: ArchLinux, Debian, Fedora, FreeBSD, Gentoo, MacOS X, OpenBSD, OpenWRT, SUSE and Windows.

Opinions

What other people say about Hiawatha:

could there be a more secure, efficient, high-performance, and easy-to-use web server that seems born to run on embedded systems?

Rodney, Much Ado About Something weblog
We decided that we could do better than our previous webserver and set about benchmarking everything out there. After comprehensive testing (and I do mean comprehensive - we optimised and tested them all!), we found Hiawatha to be superior in terms of configurability, speed, stability (no memory leaks! No crashes!), support and security. It now forms an integral part of our and our client's infrastructure and is serving pages at around 150% of the capacity of our previous webserver on the same hardware.

IT Services, Telecoms and Utility Management
I started using it at my work place yesterday and today I'm already getting too much attention from colleagues. They've all attested to the speed with which they download; it's cool to note that its memory consumption and footprint are small.

A software developer at the International Institute of Tropical Agriculture
Apache's security approach is terrible (ha.ckers.org/blog/20090617/slowloris-http-dos), so I started to search for an alternative. Wikipedia pointed me to Hiawatha. I was testing it for months, and currently it serves all our customer websites. The support is very professional, questions on the forum are answered within minutes! Configuration is a breeze, with unique security options. You just have to try it, to realize that setting up a secure webserver must not be a rocket science.

Jan Harustiak, system administrator at Solexperts AG
I came across Hiawatha from the Puppy linux community. After much testing, I found that Hiawatha is a rock solid, secure, fast and lightweight server. I have been a fan of Hiawatha ever since. We were having huge bandwidth usage on Puppylinux.ca. Recently, we even crossed 1000 GB of bandwidth usage a day. There were lot of abusers and robots that were causing this spike. We switched our server to Hiawatha and we are having only around 40GB bandwidth usage a day which is way below the past usage. The ban options in Hiawatha have helped us immensely. I also find Hiawatha very easy to setup and configure. This is my server of choice. To add on to all this, Hugo who created Hiawatha has been very helpful in answering any questions we had. He continues to improve Hiawatha with every version. Thanks a lot for this great web server. Please keep developing this.

Prithish Mathews, puppylinux.ca administrator and developer of Macpup and Pritlog
In January 2002, Hugo decided to develop his own webserver. This led to Hiawatha, which, in contrast to competitors, has several interesting security features. With its excellent performance and limited size of 600kb[1], it's ideal for low-end and embedded machines.

Tim Schürmann, German author and editor
The difference between an Apache and a Hiawatha configuration file is like the difference between Sendmail's freebsd.cf and Postfix's main.cf.
...I certainly appreciate its ease of installation and configuration.

Dru Lavigne, Canadian network and systems administrator, IT instructor, author and international speaker

[1] Hiawatha's binary was about 130kb in size at that time. It looks like Tim forgot to strip the binary.

Websites powered by Hiawatha

The following websites are powered by the Hiawatha webserver.