BunkerWeb

BunkerWeb is an open-source Web Application Firewall that operates as a full-featured reverse proxy web server based on NGINX. It is designed to protect web services by default, integrating into existing environments such as Linux, Docker, Swarm, and Kubernetes. Configuration can be managed through a command-line interface or an optional web UI, and the software is extensible through a plugin system. BunkerWeb is licensed under AGPLv3 and maintained by Bunkerity.

Core security features include HTTPS support with automated Let's Encrypt integration, HTTP security headers, TLS hardening, and an integrated ModSecurity WAF using the OWASP Core Rule Set. Additional capabilities cover automatic banning of suspicious behavior based on HTTP status codes, connection and request limits, bot blocking through challenge-based verification, and blocking of known malicious IPs via external blacklists and DNSBL. The platform supports multisite mode, per-site security settings, and configurable security modes for detection or active blocking. Integrations include CrowdSec, Redis, Prometheus, and gRPC, with an API for programmatic control.

BunkerWeb is intended for teams and administrators managing web services across containerized or traditional infrastructure. The open-source version is available under AGPLv3, while BunkerWeb PRO adds features such as ACME, anti-DDoS, load balancing, OpenID Connect, SAML, and monitoring, with a 30-day free trial available. A fully managed SaaS option, BunkerWeb Cloud, is also offered, along with professional services including consulting, support, and custom development.