BunkerWeb

BunkerWeb is an open-source NGINX-based web server and web application firewall that protects services as a reverse proxy. It is best suited to teams comfortable operating their own infrastructure who want configurable defenses without an open-source license fee. Its breadth of protections and deployment integrations is appealing, but it is not a hands-off security service.

Overview

BunkerWeb sits in front of web services, combining reverse-proxy operation with a web application firewall. Its security toolkit spans HTTPS with automated Let's Encrypt certificates, HTTP security headers, TLS hardening, ModSecurity with the OWASP Core Rule Set, and automatic bans for suspicious behavior. Rate limiting, managed rule sets, API protection, and bot management add useful layers for operators seeking to consolidate controls at the proxy.

The open-source edition is licensed under AGPLv3 and costs nothing. That makes it accessible for self-managed deployments, but teams still need the skills and capacity to configure, maintain, and monitor the service. BunkerWeb is maintained by Bunkerity, a French cybersecurity company.

Key features

Traffic and bot defenses

Bot challenges can rely on cookies, JavaScript, CAPTCHA, hCaptcha, reCAPTCHA, or Turnstile. That range gives operators options for how to challenge suspicious traffic, while external blacklists and DNS-based blackhole lists can block known malicious IPs. These controls are a strong fit for teams that want adjustable defenses, though they also leave policy choices and operation in the administrator's hands.

Deployment and management

Official integrations cover Docker, Docker autoconf, Swarm, Kubernetes, and Linux. This range gives infrastructure teams several ways to incorporate BunkerWeb into environments they already operate. An optional web UI manages instances and configurations, but it is supported only with Docker and Linux integrations, so Kubernetes and Swarm users should not assume the same UI workflow.

The API can be secured with an IP whitelist and optionally an API token; restricting access is especially important for a management surface. Kubernetes Gateway API mode is beta, which makes it a less settled choice for production deployments than the other stated integrations.

Pricing

BunkerWeb open-source

The open-source plan costs nothing and uses an AGPLv3 license. It is the natural fit for teams that can run and support the software themselves and want to avoid license charges. Free community support is available through Discord, GitHub Discussions, Reddit, Server Fault, and Super User, but it is not a substitute for dedicated technical support.

BunkerWeb PRO

PRO uses custom pricing based on the number of services protected. Standard includes no technical support; Enterprise includes dedicated technical support, making it the more relevant tier for organizations that require a direct support channel. PRO has a 30-day free trial through the BunkerWeb Panel. Licenses are tied to a specific deployment environment, and the PRO plugin needs outbound HTTPS access to api.bunkerweb.io for license checks and premium plugin downloads. Those conditions matter for isolated or tightly restricted environments.

Professional support and consulting are also offered. No seat or request quotas are stated for these plans.

Platforms

BunkerWeb supports API, Linux, self-hosted, and web platforms, with a hybrid deployment model. Its named integrations are Docker, Docker autoconf, Swarm, Kubernetes, and Linux. The optional UI's narrower Docker and Linux support is an important distinction for teams choosing an integration.

Who it's for

BunkerWeb is a good fit for infrastructure and security teams that want to operate a configurable WAF and reverse proxy within their own deployment, especially when they value a free AGPLv3 edition and multiple integration options. It is less suitable for teams seeking a managed, low-operations security layer, a supported UI across every integration, or a stable Kubernetes Gateway API mode today.

Pros and cons

• Pros: The free AGPLv3 edition bundles proxy operation with a wide set of protections, including TLS hardening, ModSecurity with the OWASP Core Rule Set, rate limiting, and automatic bans.
• Pros: Docker, Swarm, Kubernetes, and Linux integrations provide options for different self-managed environments.
• Pros: Multiple bot-challenge methods and external malicious-IP sources give administrators flexibility in shaping defenses.
• Cons: The optional UI supports only Docker and Linux integrations, limiting its usefulness for teams deploying through other integrations.
• Cons: Kubernetes Gateway API mode remains beta, making it a less mature path for production use.
• Cons: PRO licensing depends on a specific deployment environment and outbound HTTPS access, which may conflict with restricted deployments.
• Cons: The open-source offering relies on community support; Standard PRO has no technical support.

Alternatives

For a standalone open-source WAF engine that runs as a module inside a web server, consider ModSecurity; it is narrower than BunkerWeb's combined reverse-proxy and firewall approach. OWASP Coraza WAF is another free, self-hosted open-source WAF option, with Apache-2.0 connectors.

Teams comparing broader web application firewall choices can browse Web Application Firewall Software, while teams focused on proxy products can consult Reverse Proxy Software. Cloudflare WAF is a freemium web option; its Free plan includes one rate-limiting rule and up to 24 hours of standard log retention, while Pro costs $20 a month billed annually and includes up to 30 days of standard log retention.

Wallarm API Security may suit readers focused on API security: its free tier covers up to 500,000 requests per month and three users per company, excluding vulnerability assessment and API Abuse Prevention. Gcore WAAP offers a Free plan for one domain and 0.5M requests, with default rules, no IP Firewall rules, and €2/1M quota overage. For image-request optimization rather than a WAF, Fastly Image Optimizer has a free plan covering 100,000 image requests per month.

F5 BIG-IP APM is another alternative for readers comparing security products. Oracle Cloud Infrastructure Secret Management addresses secret management rather than reverse-proxy WAF protection.

Verdict

Choose BunkerWeb if your team can operate its own infrastructure and wants a free, configurable reverse-proxy WAF with broad defenses and several deployment integrations. Look elsewhere if you need managed operation, an optional UI that works across integrations, or a production-ready Kubernetes Gateway API mode; PRO support also comes with deployment-specific licensing and network requirements.