Download websites that use Hiawatha

About Hiawatha

Hiawatha exists because its author wanted a web server that refuses traffic as readily as it serves it. Request filtering sits in the server rather than in front of it, so malformed and hostile requests are throttled or dropped before an application ever parses them, and an operator who installs it has usually formed an opinion about attack surface before opening the configuration file.

Written in C and distributed as GPL v2 software, with our record beginning in 2002, it favours a compact and readable configuration file that one administrator can hold in mind. Running it means somebody read the manual, packaged or compiled the binary, and accepted that answers to their configuration questions would be harder to find than for the mainstream alternatives.

As of October 2026 we detect Hiawatha on 96 sites. The population is small by design, and the small size is the point for a researcher rather than a disappointment. A niche server acts as a proxy for an operator profile, self hosted infrastructure, an administrator with opinions about attack surface, and frequently a hardening or privacy motive sitting behind the deployment. Nobody arrives at this software through a one click installer.

Version data adds a second dimension to that profile. We record 21 distinct version strings across the installations we can see, 12.2 among them. A spread that wide across a user base this size says that deployments are maintained individually rather than pushed out by a distribution package or a hosting control panel. Some machines track releases closely, others were configured once and left running for years. For vulnerability research the distribution of versions across a population is the number that decides everything, because it determines how much of the installed base a given advisory would actually reach, and whether a fix that shipped long ago has been adopted at all.

Server identification carries a weakness that is worth stating out loud. Recognition rests on what the server chooses to reveal, in response headers and in the markup of its own error pages, and an administrator hardening a machine may well strip precisely those signals. On security minded software, the operators most careful about disclosure are the ones we are least able to identify, so the undercount correlates with the audience the project attracts. Our figure describes hosts that identify themselves, not every host that runs the code.

The limitation does not make the list less useful, it makes it a different kind of list. What we publish is a sample of a self selected community, drawn consistently by the same crawler with the same rules, which means changes between rebuilds are meaningful even where the absolute total is not complete. A per domain check answers whether one host runs Hiawatha. The download answers who runs it, where those hosts sit, which builds they are pinned to, and whether the community around a small server is growing, holding or slowly winding down. For software with a user base this specific, the population view is the only view that supports a conclusion at all.