BunkerWeb

BunkerWeb is an open-source NGINX-based web server and web application firewall that protects web services as a reverse proxy. It is a strong fit for teams that want to operate security controls within infrastructure they manage. Its appeal is the breadth of protection in a free edition; the trade-off is the responsibility of running and securing the deployment.

Overview

BunkerWeb places a reverse proxy in front of web services and layers application security into that role. HTTPS with automated Let's Encrypt certificates, HTTP security headers, TLS hardening, ModSecurity with the OWASP Core Rule Set, and automatic bans for suspicious behavior cover several common defenses. Rate limiting, managed rule sets, API protection, and bot management extend that coverage without requiring a separate product for each control.

This is infrastructure software, not a managed security service. Teams must be ready to deploy and maintain it, and to make considered choices about configuration and access. The API documentation recommends an IP whitelist and optionally an API token, a reminder that the management surface needs its own safeguards.

Key features

Layered traffic and bot controls

Operators can challenge bots using cookies, JavaScript, CAPTCHA, hCaptcha, reCAPTCHA, or Turnstile. External blacklists and DNS-based blackhole lists can block known malicious IPs. The range of mechanisms gives teams options to shape defenses, though choosing and operating those controls is part of the job rather than something delegated to a hosted service.

Deployment and management

Official integrations cover Docker, Docker autoconf, Swarm, Kubernetes, and Linux, making BunkerWeb relevant to teams with varied self-managed environments. The optional web UI manages instances and configurations, but is currently supported only with Docker and Linux integrations. Kubernetes Gateway API mode is in beta, so teams seeking a settled deployment path should account for that limitation rather than assume it is production-ready.

BunkerWeb is maintained by Bunkerity, a French cybersecurity company. Free community support is available through Discord, GitHub Discussions, Reddit, Server Fault, and Super User; professional support and consulting are also offered.

Pricing

BunkerWeb open-source

The open-source edition costs nothing and uses the AGPLv3 license. It is the straightforward choice for teams able to host, configure, and support the software themselves. The price removes a license charge, not the operational work of managing a reverse proxy and its protections.

BunkerWeb PRO

BunkerWeb PRO has custom pricing, with options based on the number of services protected. Standard includes no technical support; Enterprise includes dedicated technical support. A 30-day PRO free trial is offered through the BunkerWeb Panel, giving prospective users a defined period to evaluate the paid offering. PRO licenses are tied to a specific deployment environment, and the PRO plugin needs outbound HTTPS access to api.bunkerweb.io for license checks and premium plugin downloads, which matters in restricted or disconnected environments.

Platforms

BunkerWeb supports API, Linux, self-hosted, and web environments. Its hybrid deployment model and official integrations suit operators fitting a proxy into infrastructure they control; the web UI's narrower integration support and beta Kubernetes Gateway API mode are important caveats for specific deployments.

Who it's for

BunkerWeb is best for infrastructure and security teams that want a self-managed reverse proxy with a broad set of web application, bot, and IP protections and can take responsibility for its operation. It is less suitable for organizations that need a fully managed service, want technical support included in the standard PRO tier, or depend on the web UI in a Kubernetes integration.

Pros and cons

Pros

• Broad protection in the free edition: HTTPS automation, TLS hardening, ModSecurity with OWASP Core Rule Set, bot challenges, and IP blocking give self-managed teams several defenses at no license cost.
• Several deployment integrations: Docker, Swarm, Kubernetes, and Linux support can fit different operator-managed environments.
• Multiple support paths: Community channels are available, with professional support and consulting offered separately.

Cons

• Operations stay with the user: The self-managed model requires teams to deploy, configure, secure, and maintain the service.
• Management coverage is uneven: The web UI currently supports Docker and Linux integrations, not the full integration range.
• Two constraints affect advanced use: Kubernetes Gateway API mode remains beta, while PRO licensing requires a specific deployment environment and outbound HTTPS for checks and downloads.
• Standard PRO lacks technical support: Dedicated technical support is reserved for Enterprise.

Alternatives

Fastly Image Optimizer is an alternative for image optimization rather than a like-for-like proxy security choice; its free plan includes 100,000 image requests per month.

Gcore WAAP is worth considering for a managed WAAP option with a free tier covering one domain and 0.5M requests, plus a €2 per 1M quota overage.

ModSecurity is a narrower choice if you want a free open-source WAF engine that runs as a module inside a web server rather than BunkerWeb's integrated reverse-proxy approach.

OWASP Coraza WAF is another free, self-hosted open-source WAF option, with Apache-2.0 connectors.

Wallarm API Security may suit teams looking for an API-security product with a free tier of up to 500,000 requests per month and three users per company, excluding vulnerability assessment and API Abuse Prevention.

Cloudflare WAF is a relevant alternative for teams considering a web-based WAF with a free plan that includes up to 24 hours of standard log retention and one rate-limiting rule.

Oracle Cloud Infrastructure Secret Management is not a direct WAF alternative, but may be relevant when the need is secret management rather than traffic protection.

F5 BIG-IP APM is another alternative to consider.

For broader comparisons, see Web Application Firewall Software and Reverse Proxy Software.

Verdict

Choose BunkerWeb if your team can operate its own infrastructure and wants a free, configurable reverse proxy with substantial built-in web defenses. Its chief advantage is the combination of proxy and security controls in one open-source deployment; look elsewhere if you need a managed service, broad web UI integration, or included technical support on the standard PRO tier.