Hiawatha 100% CPU - WordPress Image Import

Jack Tester
1 May 2018, 15:38
Hiawatha is using 100% of the CPU whilst importing some images into the WordPress Media library.

I have two PNG files, one is 232kb the other is 75kb.
Both are 2000x167.
When I import the 232kb one Hiawatha uses 100% CPU for 1 minute 10 seconds, before the page refreshes and the image appears.
The 75kb takes about 3 seconds.

Is there anyway to work out what exactly Hiawatha is doing, also is it normal for Hiawatha to use that much CPU?
I would have expected PHP to be using the CPU to convert the image via GD, rather than Hiawatha?
Hugo Leisink
1 May 2018, 21:08
Weird. I have no idea. What do the logfiles say? You very sure it’s Hiawatha, not PHP? Cause I seriously doubt that.
Jack Tester
2 May 2018, 10:33
Yeah I was confused by that, I'm using htop to monitor resource usage, it's reporting Hiawatha at 100% CPU usage. All the mysqld and php-fpm threads are sitting at 0%. It also appears to be any file upload, not just image files.

I had to stop and restart Hiawatha after a few minutes of uploading a 2mb zip file (WordPress Plugin), I suspect it would probably have succeeded but couldn't afford to have the live website down for that long because the whole site becomes unresponsive whilst uploading.

On the local dev site I cleared the access log, initiated an upload and took a couple of screenshots. Everything appears to complete normally except it takes over 1 minute to upload a 232kb png.

External image via

External image via

Bit stumped at the moment. Will try and find time to spin up a fresh Debian VM locally and a blank WordPress install and see if it's the same.
Hugo Leisink
2 May 2018, 10:37
What version of Hiawatha are you using?
Jack Tester
2 May 2018, 11:38
10.8.1 on both live and dev.

Cheers for sorting out the links and embedding the images in previous post, realised after I'd posted it but couldn't edit.
2 May 2018, 15:55

It's a strange problem : I'm hosting two wordpress sites on my server and I don't have this problem.

Did you use the PreventSQLi function (I don't) ? Someone had a similar problem with Wordpress :
Hugo Leisink
3 May 2018, 08:13
Can you show me the Hiawatha configuration you use for the virtual host?
Jack Tester
3 May 2018, 08:51
VirtualHost {
Hostname =,,,
EnforceFirstHostname = yes
RequireTLS = yes
TLScertFile = tls/
WebsiteRoot = /srv/www/vhosts/
StartFile = index.php
TimeForCGI = 121
UseFastCGI = PHP7.1-FPM
CustomHeader = X-Frame-Options: sameorigin
CustomHeader = Vary: Accept-Encoding
UseToolkit = redirect, wordpress
PreventXSS = detect
PreventCSRF = detect
PreventSQLi = detect
AccessLogfile = /var/log/hiawatha/, daily
ErrorLogfile = /var/log/hiawatha/

As Nicolas said, could it be the XSS/CSRF/SQLi detection slowing it down?
They've never caused a problem before.
Hugo Leisink
3 May 2018, 18:11
Yes, could be. Disable them and try again. Enable them one by one to see which one causes the issue.
Jack Tester
4 May 2018, 09:25
Done, I can confirm that Nicolas is correct, it is the SQLi detection that's causing the problem.
Hugo Leisink
6 May 2018, 23:34
Ok, thanks. I will take a look at it.
This topic has been closed.