BunkerWeb

Bunkerity BunkerWeb is an open-source Web Application Firewall (WAF) built on top of NGINX that functions as a full-featured reverse proxy web server. It is designed to protect web services with a "secure by default" approach, meaning security hardening is applied out of the box without requiring extensive manual configuration. BunkerWeb can be deployed across multiple environments and infrastructure types, including Linux, Docker, Docker Swarm, and Kubernetes. It operates as a reverse proxy in front of web applications, inspecting and filtering HTTP/HTTPS traffic to block malicious requests. Core security capabilities include: - OWASP Top 10 protection - HTTP security headers enforcement - Rate limiting and anti-bot measures - IP allowlisting and denylisting - Bad behavior detection and automatic banning - SSL/TLS termination and HTTPS enforcement - ModSecurity integration for rule-based filtering - Country-based access control - Brute force protection BunkerWeb includes a web-based UI for managing configurations without requiring CLI access, making it accessible to users who prefer a graphical interface. Configuration can also be managed via environment variables or configuration files. The tool features a plugin system that allows extending its functionality with additional security modules beyond the built-in core features. Official and community plugins are available to address specific use cases. BunkerWeb is licensed under the AGPLv3 open-source license and is maintained by Bunkerity. A hosted panel and community resources are available alongside the self-hosted open-source version.