BunkerWeb
An open-source, next-generation Web Application Firewall (WAF) that integrates as a reverse proxy to make web services secure by default.
What is BunkerWeb?
BunkerWeb is an open-source, next-generation Web Application Firewall (WAF) and web server based on NGINX. It protects web services by acting as a reverse proxy, integrating seamlessly into existing environments like Docker, Kubernetes, and Linux. It aims to simplify cybersecurity by providing robust, configurable security features out of the box, adhering to a 'security by default' philosophy.
System administrators, DevOps engineers, and security professionals who need to secure web applications in containerized, cloud, or traditional server environments. It is particularly suited for teams managing multiple web services across diverse deployment platforms.
Developers choose BunkerWeb for its seamless integration into existing infrastructures without requiring major architectural changes, its comprehensive 'security by default' feature set including ModSecurity WAF and Let's Encrypt automation, and its flexibility through a plugin system and optional web UI for management without CLI dependency.
Overview
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
Use Cases
Best For
- Securing multiple web applications (multisite mode) with a single reverse proxy instance in Docker or Kubernetes environments.
- Implementing a WAF with OWASP Core Rule Set and bot protection (e.g., captcha challenges) for web services without extensive configuration.
- Automating HTTPS setup with Let's Encrypt for web applications across various deployment platforms like Linux, Swarm, or Azure.
- Extending security features via plugins for specific needs such as antivirus scanning with ClamAV or notifications via Discord/Slack webhooks.
- Managing WAF configurations through a graphical web interface instead of command-line tools for teams preferring UI-based administration.
- Protecting web services in hybrid or multi-cloud environments with supported integrations for Docker, Kubernetes, Swarm, and Microsoft Azure.
Not Ideal For
- Projects using fully managed hosting platforms (e.g., Vercel, Netlify) where built-in security eliminates the need for a self-managed reverse proxy
- Teams with extensive, custom NGINX configurations who prefer fine-grained, manual WAF rule management over opinionated defaults
- Organizations requiring enterprise-grade support SLAs and vendor-backed compliance certifications without self-hosting complexity
- Lightweight applications where a minimal, single-binary WAF suffices and the overhead of a full web server stack is undesirable
Pros & Cons
Pros
Officially supports deployment across Linux, Docker, Kubernetes, Swarm, and Azure via documented integrations, allowing protection of diverse environments without architectural overhauls.
Includes ModSecurity WAF with OWASP Core Rule Set, automatic Let's Encrypt HTTPS, and bot challenges out of the box, ensuring immediate protection with minimal setup.
Offers official plugins for antivirus scanning (ClamAV), alternative WAF engines (Coraza), and notifications (Discord/Slack), enabling tailored security enhancements beyond core features.
Provides an optional graphical interface to manage settings, view logs, and monitor attacks, reducing CLI dependency for teams preferring visual configuration tools.
Cons
Requires managing a scheduler service and backend database (SQLite, MariaDB, etc.) for configuration state, adding operational complexity compared to simpler, standalone WAFs.
Enhanced security and monitoring capabilities are gated behind the PRO version, as noted by crown icons in docs, pushing users toward paid upgrades for advanced needs.
In multisite mode, settings must be prefixed with server names (e.g., www.example.com_USE_ANTIBOT), making configuration cumbersome for environments with many services.
Frequently Asked Questions
Related Projects
traefikThe Cloud Native Application Proxy
Kong🦍 The API and AI Gateway
Nginx Proxy ManagerDocker container for managing Nginx proxy hosts with a simple, powerful interface
EnvoyCloud-native high-performance edge/middle/service proxy
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.