Repolode
Submit
bunkerity

bunkerity/bunkerweb

Open-source, cloud-native Web Application Firewall built on NGINX that acts as a reverse proxy in front of your web services.

Open-source alternative to:Cloudflare WAFAWS WAF

View on GitHubWebsite
Stars
11,093
Forks
655
Open issues
165
Last commit
9 hours ago

What is it?

BunkerWeb is a web application firewall that runs as a reverse proxy in front of your web applications, built on NGINX. It is meant to protect services by default, with security settings enabled out of the box and adjustable through configuration variables or an optional web UI.

The core includes HTTPS with automatic Let's Encrypt certificates, HTTP security headers, TLS hardening, an integrated ModSecurity WAF with the OWASP Core Rule Set, automatic banning of suspicious clients based on status codes, connection and request limits, bot challenges (cookie, JavaScript, captcha, hCaptcha, reCAPTCHA), and blocking of known bad IPs through external blacklists and DNSBL. A plugin system allows additional features to be added.

BunkerWeb can be deployed on Linux, Docker, Docker autoconf, Swarm, Kubernetes, and Microsoft Azure. It stores its configuration in SQLite, MariaDB, MySQL, or PostgreSQL, and supports multisite mode to protect several applications from one instance.

Key features

  • 01Reverse proxy built on NGINX with automatic Let's Encrypt HTTPS
  • 02Integrated ModSecurity WAF with the OWASP Core Rule Set
  • 03Bot challenges using cookie, JavaScript, captcha, hCaptcha, or reCAPTCHA
  • 04Automatic banning of suspicious clients and blocking of known bad IPs via DNSBL
  • 05Web UI and plugin system for managing settings and extending features

Use cases

  • Protecting self-hosted web applications behind a single hardened entry point
  • Securing containerized services in Docker, Swarm, or Kubernetes clusters
  • Running one WAF instance in front of multiple applications using multisite mode

Topics

#waf#web-security#nginx#reverse-proxy#modsecurity#kubernetes#docker#letsencrypt#antibot#cybersecurity

FAQ

What is bunkerweb?
Open-source, cloud-native Web Application Firewall built on NGINX that acts as a reverse proxy in front of your web services. BunkerWeb is a web application firewall that runs as a reverse proxy in front of your web applications, built on NGINX. It is meant to protect services by default, with security settings enabled out of the box and adjustable through configuration variables or an optional web UI.
Is bunkerweb free to use? What license does it have?
bunkerweb is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is bunkerweb still maintained?
Actively maintained. The last commit to bunkerweb was on Oct 21, 2026.
What can I use bunkerweb for?
Protecting self-hosted web applications behind a single hardened entry point Securing containerized services in Docker, Swarm, or Kubernetes clusters Running one WAF instance in front of multiple applications using multisite mode
Where can I get bunkerweb?
The source code and installation instructions are on GitHub: https://github.com/bunkerity/bunkerweb

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects