BunkerWeb is a next-generation, open-source Web Application Firewall (WAF).
Being a full-featured web server (based on NGINX under the hood), it will protect your web services to make them "secure by default." BunkerWeb integrates seamlessly into your existing environments (Linux, Docker, Swarm, Kubernetes, …) as a reverse proxy and is fully configurable (don't panic, there is an awesome web UI if you don't like the CLI) to meet your own use cases. In other words, cybersecurity is no longer a hassle.
BunkerWeb contains primary security features as part of the core but can be easily extended with additional ones thanks to a plugin system.
Easy integration into existing environments: Seamlessly integrate BunkerWeb into various environments such as Linux, Docker, Swarm, Kubernetes, and more. Enjoy a smooth transition and hassle-free implementation.
Highly customizable: Tailor BunkerWeb to your specific requirements with ease. Enable, disable, and configure features effortlessly, allowing you to customize the security settings according to your unique use case.
Secure by default: BunkerWeb provides out-of-the-box, hassle-free minimal security for your web services. Experience peace of mind and enhanced protection right from the start.
Awesome web UI: Take control of BunkerWeb more efficiently with the exceptional web user interface (UI). Navigate settings and configurations effortlessly through a user-friendly graphical interface, eliminating the need for the command-line interface (CLI).
Plugin system: Extend the capabilities of BunkerWeb to meet your own use cases. Seamlessly integrate additional security measures and customize the functionality of BunkerWeb according to your specific requirements.
Free as in "freedom": BunkerWeb is licensed under the free AGPLv3 license, embracing the principles of freedom and openness. Enjoy the freedom to use, modify, and distribute the software, backed by a supportive community.
Professional services: Get technical support, tailored consulting, and custom development directly from the maintainers of BunkerWeb. Visit the Bunker Panel for more information.
Security features
A non-exhaustive list of security features:
HTTPS support with transparent Let's Encrypt automation
BunkerWeb offers an optional user interface to manage your instances and their configurations. An online read-only demo is available at demo-ui.bunkerweb.io, feel free to test it yourself.
BunkerWeb Cloud
Don't want to self-host and manage your own BunkerWeb instance(s)? You might be interested in BunkerWeb Cloud, our fully managed SaaS offering for BunkerWeb.
A fully managed BunkerWeb instance hosted in our cloud
All BunkerWeb features, including PRO ones
A monitoring platform with dashboards and alerts
Technical support to assist you with configuration
If you are interested in the BunkerWeb Cloud offering, don't hesitate to contact us so we can discuss your needs.
PRO version
Want to quickly test BunkerWeb PRO for one month? Use the code freetrial when placing your order on the BunkerWeb panel or by clicking here to directly to apply the promo code (will be effective at checkout).
When using BunkerWeb, you have the choice of the version you want to use: open-source or PRO.
Whether it's enhanced security, an enriched user experience, or technical monitoring, the BunkerWeb PRO version allows you to fully benefit from BunkerWeb and meet your professional needs.
In the documentation or the user interface, PRO features are annotated with a crown to distinguish them from those integrated into the open-source version.
You can upgrade from the open-source version to the PRO one easily and at any time. The process is straightforward:
Do not hesitate to visit the BunkerWeb panel or contact us if you have any questions regarding the PRO version.
Professional services
Get the most out of BunkerWeb by getting professional services directly from the maintainers of the project. From technical support to tailored consulting and development, we are here to assist you in the security of your web services.
You will find more information by visiting the BunkerWeb Panel, our dedicated platform for professional services.
Don't hesitate to contact us if you have any questions; we will be more than happy to respond to your needs.
Ecosystem, community, and resources
Official websites, tools, and resources about BunkerWeb:
Website: get more information, news, and articles about BunkerWeb
Panel: dedicated platform to order and manage professional services (e.g., technical support) around BunkerWeb
Documentation: technical documentation of the BunkerWeb solution
Demo: demonstration website of BunkerWeb, don't hesitate to attempt attacks to test the robustness of the solution
Web UI: online read-only demo of the web UI of BunkerWeb
Threatmap: live cyber attack blocked by BunkerWeb instances all around the world
You will find more information about the key concepts of BunkerWeb in the documentation.
Integrations
The first concept is the integration of BunkerWeb into the target environment. We prefer to use the word "integration" instead of "installation" because one of the goals of BunkerWeb is to integrate seamlessly into existing environments.
The following integrations are officially supported:
Once BunkerWeb is integrated into your environment, you will need to configure it to serve and protect your web applications.
The configuration of BunkerWeb is done by using what we call the "settings" or "variables." Each setting is identified by a name such as AUTO_LETS_ENCRYPT or USE_ANTIBOT. You can assign values to the settings to configure BunkerWeb.
Here is a dummy example of a BunkerWeb configuration:
The multisite mode is a crucial concept to understand when using BunkerWeb. Because the goal is to protect web applications, we intrinsically inherit the concept of "virtual host" or "vhost" (more info here) which makes it possible to serve multiple web applications from a single (or a cluster of) instance.
By default, the multisite mode of BunkerWeb is disabled, which means that only one web application will be served and all the settings will be applied to it. The typical use case is when you have a single application to protect: you don't have to worry about the multisite, and the default behavior should be the right one for you.
When multisite mode is enabled, BunkerWeb will serve and protect multiple web applications. Each web application is identified by a unique server name and has its own set of settings. The typical use case is when you have multiple applications to protect and you want to use a single (or a cluster depending on the integration) instance of BunkerWeb.
Custom configurations
Because meeting all the use cases only using the settings is not an option (even with external plugins), you can use custom configurations to solve your specific challenges.
Under the hood, BunkerWeb uses the notorious NGINX web server, that's why you can leverage its configuration system for your specific needs. Custom NGINX configurations can be included in different contexts like HTTP or server (all servers and/or specific server block).
Another core component of BunkerWeb is the ModSecurity Web Application Firewall: you can also use custom configurations to fix some false positives or add custom rules, for example.
Database
The state of the current configuration of BunkerWeb is stored in a backend database which contains the following data:
Settings defined for all the services
Custom configurations
BunkerWeb instances
Metadata about job execution
Cached files
The following backend databases are supported: SQLite, MariaDB, MySQL, and PostgreSQL.
Scheduler
To make things automagically work together, a dedicated service called the scheduler is in charge of:
Storing the settings and custom configurations inside the database
Executing various tasks (called jobs)
Generating a configuration which is understood by BunkerWeb
Being the intermediary for other services (like web UI or autoconf)
In other words, the scheduler is the brain of BunkerWeb.
Setup
Linux
List of supported Linux distros:
Debian 12 "Bookworm"
Debian 13 "Trixie"
Ubuntu 22.04 "Jammy"
Ubuntu 24.04 "Noble"
Ubuntu 26.04 "Resolute Raccoon"
Fedora 43
Fedora 44
RHEL, CentOS, Rocky Linux and AlmaLinux 8, 9 and 10
You will find more information in the Linux section of the documentation.
Docker
We provide ready-to-use prebuilt images for x64, x86, armv7, and arm64 platforms on Docker Hub.
Docker integration key concepts are:
Environment variables to configure BunkerWeb
Scheduler container to store configuration and execute jobs
Networks to expose ports for clients and connect to upstream web services
The downside of using environment variables is that the container needs to be recreated each time there is an update, which is not very convenient. To counter that issue, you can use another image called autoconf which will listen for Docker events and automatically reconfigure BunkerWeb in real-time without recreating the container.
Instead of defining environment variables for the BunkerWeb container, you simply add labels to your web applications containers and the autoconf will "automagically" take care of the rest.
to distinguish them from those integrated into the open-source version.
BunkerWeb 是一款开源的新一代 Web 应用防火墙（WAF），基于 NGINX 构建，是一个功能完整的 Web 服务器。它以“默认安全”的方式保护你的 Web 应用和 API，同时可以作为反向代理接入你现有的环境。