BunkerWeb

BunkerWeb is an open-source NGINX-based web application firewall for teams that want to run a reverse proxy inside infrastructure they control. It suits security-conscious operators able to manage deployment and tuning themselves, rather than buyers seeking a fully managed gateway.

Overview

BunkerWeb places web services behind a reverse proxy that also enforces application and transport security. HTTPS certificates can be automated through Let's Encrypt, while HTTP security headers, TLS hardening, ModSecurity with the OWASP Core Rule Set, and automatic bans address common attack and abuse patterns. Rate limiting, managed rule sets, API protection, and bot management make it a broad edge-security layer rather than only a basic proxy.

Its hybrid deployment model is practical for infrastructure teams with mixed environments. Official integrations cover Docker, Docker autoconf, Swarm, Kubernetes, and Linux. The optional web UI manages instances and configurations, but that interface is currently supported only with Docker and Linux integrations.

Key features

Layered traffic controls

Bot challenges can use cookies, JavaScript, CAPTCHA, hCaptcha, reCAPTCHA, or Turnstile. That range lets operators choose between relatively light challenges and stronger user verification. External blacklists and DNS-based blackhole lists can block known malicious IP addresses before they consume application resources.

Operations and API security

The API enables programmatic management, but the documentation recommends restricting access with an IP whitelist and optionally an API token. That is sensible for administrative control, though it means secure network design remains part of the deployment job. Kubernetes Gateway API mode is beta, so teams depending on that integration should treat it as an evolving capability rather than a finished foundation.

Pricing

BunkerWeb open-source

The open-source plan costs free and is released under the AGPLv3 license. It is the clear fit for individuals, companies, and platform teams willing to operate their own WAF and accept community-led support. The zero license price does not eliminate infrastructure, maintenance, configuration, or incident-response work.

BunkerWeb PRO

PRO uses custom pricing based on the number of services protected. Standard licensing has no technical support; Enterprise adds dedicated technical support, making Enterprise the more appropriate choice when response from the maker is a requirement. A 30-day PRO free trial is available through the BunkerWeb Panel.

PRO licenses are tied to a specific deployment environment. The PRO plugin also requires outbound HTTPS access to api.bunkerweb.io for license checks and premium-plugin downloads, a material constraint for isolated networks. Community support for the free edition is available through Discord, GitHub Discussions, Reddit, Server Fault, and Super User; professional support and consulting are also offered.

Platforms

BunkerWeb supports API, Linux, self-hosted, and web access. Deployment integrations span Docker, Docker autoconf, Swarm, Kubernetes, and Linux, giving self-managed teams flexibility in where the proxy runs. The web UI's narrower Docker-and-Linux support is an important distinction for Kubernetes-first operations.

Who it's for

Choose BunkerWeb if you need an open-source WAF and reverse proxy that can be embedded in Docker, Kubernetes, Swarm, or Linux infrastructure, and you have staff to secure the API, maintain the deployment, and tune defenses. It is especially well suited to organizations that want ModSecurity and OWASP rules, automated certificate handling, bot challenges, and IP reputation controls without a per-service open-source license fee.

Look elsewhere if you need a managed service, turnkey operations, or a mature Kubernetes Gateway API workflow today. PRO's environment-bound licensing and required outbound connectivity can also conflict with tightly isolated production networks.

Pros and cons

Pro: The AGPLv3 edition costs nothing, removing license cost for self-managed deployments.

Pro: HTTPS automation, TLS hardening, ModSecurity with the OWASP Core Rule Set, rate limiting, API protection, and bot controls provide layered coverage at one proxy.

Pro: Docker, Swarm, Kubernetes, and Linux integrations accommodate varied infrastructure.

Con: Operation, tuning, and secure API exposure remain the customer's responsibility, so it is not a hands-off service.

Con: The optional UI does not currently support Kubernetes integrations, and Gateway API mode is beta.

Con: PRO pricing is custom, licenses are tied to a deployment environment, and premium licensing requires outbound HTTPS.

Alternatives

For a broader category view, see Web Application Firewall Software and Reverse Proxy Software.

Cloudbric is a paid, multi-platform option with a free plan and trial when hosted VPN-style access is more relevant than self-hosting.

BitNinja suits administrators who want freemium VPS plans, including a free tier capped at two vCPUs, 2 GB RAM, and 10 hosted users.

F5 BIG-IP APM is the alternative for buyers considering perpetual licensing across virtual, hardware, or hybrid BIG-IP environments.

Fastly Image Optimizer is focused on image-request optimization rather than a general self-hosted WAF.

SafeLine is another freemium Linux and self-hosted web-security option.

Security Ninja fits self-hosted users seeking a forever-free tier with firewall rules and security scanners.

Gcore WAAP is a managed-style freemium choice with domain, request, and IP-firewall quotas.

Haltdos offers a free community WAF tier and paid professional plans for teams comparing commercial support models.

Verdict

BunkerWeb is a strong choice for technically capable teams that want extensive reverse-proxy and WAF controls, flexible self-hosted deployment, and no open-source license fee. Choose it for control and breadth; choose another product when managed operations, guaranteed support, or a production-ready Kubernetes Gateway API path matters more than that flexibility.