BunkerWeb - The open-source Web Application Firewall (WAF) | WarmIndex

BunkerWeb is the open-source, next-generation Web Application Firewall (WAF) that acts as a secure reverse proxy to protect web services from OWASP Top 10 threats, bots, DDoS, and more.

🚀 Overview

BunkerWeb is a full-featured web server powered by NGINX, serving as a next-generation Web Application Firewall (WAF) and reverse proxy. It integrates seamlessly into existing infrastructures like Docker, Kubernetes, or Linux servers, placing a security layer in front of web applications to block attacks while handling traffic routing, HTTPS, and more.

This project solves the challenge of making web services secure by default without complex setups. It automatically enforces security headers, manages certificates, detects bots, rate-limits requests, and applies WAF rules—saving time for developers and admins who don't want to stitch together multiple tools. It's built for hobbyists, self-hosters, developers, and organizations seeking transparent, auditable security.

BunkerWeb was developed by Bunkerity, a French cybersecurity company, to champion open-source transparency and auditability. Tired of opaque proprietary WAFs, the team created a customizable, sovereign solution that's easy to deploy and extend via plugins.

✨ Key Features

Integrated ModSecurity WAF with OWASP Core Rule Set (detects and blocks exploits like SQLi, XSS)
Automatic HTTPS with Let's Encrypt and TLS hardening
Bot mitigation via challenges (cookie, JS, captcha, hCaptcha, reCAPTCHA)
Rate limiting, connection throttling, automatic IP banning, DNSBL blacklists
Multisite support, custom NGINX/ModSecurity configs, extensible plugin system (100+ plugins)
User-friendly Web UI for config, logs, monitoring; CLI option too

Optional: BunkerWeb PRO unlocks advanced monitoring (Grafana), custom services, dedicated support

🛠 Tech Stack

Frontend: HTML, CSS, JavaScript
Backend: NGINX, ModSecurity (Lua), Python, FastAPI
Database: SQLite, PostgreSQL, MySQL/MariaDB
Auth: Built-in for Web UI
Hosting: Self-hosted (Docker, Kubernetes Helm, Linux), BunkerWeb Cloud (managed SaaS)