🛡️ 𝗕𝘂𝗻𝗸𝗲𝗿𝗪𝗲𝗯 — 𝗪𝗲𝗯 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹
Secure your web apps by default
• Built on NGINX (acts as reverse proxy WAF)
• Integrated ModSecurity OWASP CRS
• HTTPS Let’s Encrypt automation
• Blocks bots, bad IPs, brute-force attempts
• Rate limiting request filtering
• Anti-bot challenges (captcha, JS, cookie)
• Plugin system (ClamAV, VirusTotal, Slack alerts)
• Web UI for easy management
• Works with Docker, Kubernetes, Linux
“Secure by default” web protection
github.com/bunkerity/bunkerw…#WAF#WebSecurity#CyberSecurity
BunkerWeb
Security-focused web server based on NGINX that applies automated security rules to protect against common web attacks and simplify server hardening for self-hosted deployments
⭐ Stars: ~10.0k
🧾 License: AGPL-3.0
🔔 Discover Open Source. Every Day
A new AI review! bunkerity/bunkerweb ⭐4.0/5.0
BunkerWeb is a mature, feature-rich open-source Web Application Firewall and “secure-by-default” reverse proxy built on NGINX, with a strong operational focus: Docker/Swarm/Kubernetes/Linux ...
gitrated.com/bunkerity/bunke…
🛡️ Just tried out BunkerWeb WAF — a next-gen open-source Web Application Firewall that slips in as a reverse proxy and makes your attack surface way smaller by default
It's not just a WAF — it's a full web server based on NGINX under the hood, so you can drop it in front of your apps and block OWASP Top-10 threats, bots, weird payloads, bad IPs & more before they hit your stack
Out-of-the-box HTTPS with auto Let's Encrypt, strict HTTP headers, TLS hardening, rate limits, and automatic banning of odd traffic patterns make reducing your attack surface almost effortless
The integrated ModSecurity engine OWASP core ruleset gives you smart signature-based filtering — and you can inject your own rules when you need deep tuning
Plugin system Web UI = extendable defense and easy ops. Want automatic Docker label-driven config updates? There's support for that too via autoconf
Some tips for BunkerWeb:
- tune rate limits and challenge bots (JS/cookie/captcha) before adding custom ModSecurity rules. That cuts noise and reduces false positives significantly
- use multisite mode templated NGINX snippets to standardize security headers & edge filtering across services. Saves time and avoids misconfig drift.
Compared to older open WAFs, BunkerWeb bundles reverse-proxy WAF certs bot challenges in one, so you don't have to stitch NGINX ModSecurity cert managers yourself.
It's not an ISP-scale DDoS shield — large-volume attacks still need edge networks or CDNs — but for app layer protection it's a solid self-hosted choice
And see the nice demo (in the comments), how BunkerWeb works, thanks @bunkerity#waf#cybersecurity#letsencrypt#docker#nginx#kubernetes#security#devops