Twisted Web
Twisted Web (twisted.web) is the HTTP server and client included in Twisted, the open source event-driven networking engine for Python, released under the MIT licence. Sites running it are recognised by the Server: TwistedWeb response header. It runs on the site owner's own infrastructure, loads nothing in the visitor's browser and only sets a session cookie if the application asks for one, so it does not require consent.
What does Twisted Web do?
What is Twisted Web?
Twisted Web is the web component of Twisted, an event-driven networking engine written in Python and developed as an open source project since the early 2000s. Twisted is distributed under the MIT licence and maintained by a community of volunteers at twisted.org. The twisted.web package provides an HTTP/1.1 server (with HTTP/2 support through an optional dependency), an HTTP client, a resource tree for building web applications and a static file server. Frameworks such as Klein are built on top of it, and it is often used to expose dashboards, APIs or small sites from long-running Python services.
How Twisted Web appears on a website
By default the server adds a Server: TwistedWeb/<version> header to its responses, which is what technology scanners detect. Nothing is injected into the HTML page and no third-party domain is contacted. Twisted Web may also sit behind a reverse proxy such as Nginx, in which case the header can be hidden or replaced.
Cookies and personal data
Twisted Web does not set any cookie on its own. If the application code calls request.getSession(), the server creates a session and sends a cookie named TWISTED_SESSION (TWISTED_SECURE_SESSION on HTTPS), suffixed with the site path. It is a browser session cookie holding a random identifier; the session data stays in server memory and expires after 15 minutes of inactivity by default. Like any web server, Twisted Web can write access logs containing IP addresses, requested URLs and user agents, depending on how the site is configured.
GDPR and consent
The server itself does not require consent. Serving pages is strictly necessary to deliver the site the visitor requested, and a session cookie used for login or for keeping a form state falls under the strictly necessary exemption of Article 5(3) of the ePrivacy Directive. Access logs are usually processed on the basis of legitimate interest (security, troubleshooting). Because the software is self-hosted, no data goes to the Twisted project or to any third country unless the site owner chooses a hosting provider outside the EU.
Practical steps
- Check whether your application really calls getSession() and document the session cookie if it does.
- Configure log retention and mention server logs in your privacy notice.
- Serve the site over TLS so that the secure session cookie is used.
- Keep Twisted up to date, as security fixes for twisted.web are published regularly.
- Optionally hide the version in the Server header to reduce information disclosure.
Twisted Web and the GDPR
- Legal basis
- Legitimate interest (Art. 6(1)(f) GDPR) for server logs; optional session cookie exempt from consent as strictly necessary (Art. 5(3) ePrivacy Directive)
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive
Impact assessment (DPIA)
No DPIA is needed for Twisted Web as such: it is a self-hosted web server that only processes technical connection data. Points to watch are the retention of access logs, the security of the session cookie (use HTTPS) and regular updates to fix known vulnerabilities. The applications built on top of it must be assessed separately.
Sample text for your banner
This site runs on a self-hosted web server. If you sign in or use a form, a temporary session cookie keeps your session active; it is deleted when you close your browser and is not used for tracking.
What Twisted Web sets and contacts
- Tracking method
- Python HTTP server, detected through the Server: TwistedWeb/<version> response header. Runs on the website's own server; no script is loaded in the browser.
- Server location
- Self-hosted
Cookies set (1)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| TWISTED_SESSION | necessary | Browser session (server-side session expires after 15 minutes of inactivity by default) | Session identifier created by twisted.web only when the application calls request.getSession(). The cookie name is suffixed with the site path, and becomes TWISTED_SECURE_SESSION on HTTPS requests. |
Frequently asked questions about Twisted Web
Can't find your question? Write to us, we answer fast.
What does the Server: TwistedWeb header mean?
It means the response was produced by twisted.web, the HTTP server of the Python Twisted framework. The header often includes the Twisted version number, for example TwistedWeb/24.11.0.
Does Twisted Web set cookies?
Only if the application asks for a session. In that case it sets a TWISTED_SESSION cookie (TWISTED_SECURE_SESSION on HTTPS) containing a random session identifier, which disappears when the browser is closed.
Is consent required for a site served by Twisted Web?
No, not for the server itself. Delivering the page and keeping a technical session are strictly necessary. Consent depends on the other tools added to the pages, such as analytics or advertising scripts.
Is Twisted Web the same as an analytics tool?
No. Twisted Web is an HTTP server. It does not track visitors across sites and sends no data to a third party; it only writes the logs the site owner configures.
Who maintains Twisted?
Twisted is an open source project maintained by volunteers and published under the MIT licence. Source code and releases are available on GitHub and PyPI, and documentation on docs.twisted.org.
Elementor Cloud
Elementor Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Elementor Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Elementor Cloud ensures optimal performance at scale.
Alibaba Cloud OSS
Alibaba Cloud Object Storage Service is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Alibaba Cloud Object Storage Service provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Alibaba Cloud Object Storage Service ensures optimal.
Hostinger
Hostinger is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Hostinger supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Hostinger enables informed decisions that improve experience and drive results.
MochiWeb
MochiWeb is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. MochiWeb integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, MochiWeb helps organizations maintain robust websites that meet user expectations and technical requirements.
HP iLO
HP iLO is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. HP iLO supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, HP iLO ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
WP Engine
WP Engine is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. WP Engine supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, WP Engine remains a leading web development choice.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.