BunkerWeb
BunkerWeb: A free, self-hosted WAF with OWASP rules, API validation, rate limiting, and antibot controls. Ranked #15 of 35 in Web Application Firewall Software by our editors (7.9/10); pricing: Free plan; best for self-hosted teams seeking a free open-source WAF.
At a glance
- Editor score7.9 / 10
- PricingFree plan
- Best forSelf-hosted teams seeking a free open-source WAF
- Free planYes
- Paid fromFree
- Deployment modelHybrid
- Facts checked20 Sep 2026
Where it wins
- Free AGPLv3 edition with open-source code
- OWASP Core Rule Set, API validation, and rate limiting
- Docker, Kubernetes, Linux, and web UI support
Where it doesn't
- Self-hosted deployment requires team-managed operations
- PRO and Cloud editions add paid options beyond the free edition
- Feature scope is more deployment-focused than managed enterprise WAFs
Our verdict on BunkerWeb
BunkerWeb is an open-source Web Application Firewall based on NGINX, operating as a reverse proxy in front of web services. It is designed for self-hosted teams that want to protect web applications and APIs without adopting a fully managed WAF. The free edition is available under AGPLv3 and includes ModSecurity integration with the OWASP Core Rule Set, request and connection rate limiting, antibot challenges, HTTP security headers, TLS hardening, IP filtering, and a web UI for configuration and monitoring.
Deployment flexibility is a central strength. BunkerWeb supports Linux, Docker, Docker Swarm, Kubernetes, Docker autoconf, and BunkerWeb Cloud. Its plugin-based extensibility also gives teams a way to expand the deployment beyond the built-in controls. Protection features cover reverse proxy operation, OpenAPI request validation, IP blacklisting and whitelisting, DNSBL support, TLS automation, CAPTCHA and JavaScript verification, and monitoring through the web UI. This combination suits teams that want control over where the WAF runs and how it fits into their infrastructure.
The trade-off is operational ownership. A self-hosted WAF requires the team to manage deployment, configuration, updates, and the surrounding infrastructure rather than relying on a managed enterprise service. Bunkerity also offers a separate PRO edition and managed BunkerWeb Cloud with additional features and support options, but the free open-source edition is the clearest fit for teams prioritizing control and no license cost. Choose BunkerWeb when Docker, Kubernetes, Linux, API protection, and open-source deployment matter; choose a managed WAF alternative when minimizing infrastructure responsibility is the priority.
Your product? Our editors can test BunkerWeb in depth and publish a review, labelled as paid · from $149/mo →
BunkerWeb pricing
BunkerWeb fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Deployment model | Hybrid |
| Managed rule sets | Yes |
| API protection | Yes |
| Bot management | Yes |
| Rate limiting | Yes |
| Log retention | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Linux |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 6 integrations: Docker, Linux, Docker Swarm, Kubernetes, Docker autoconf, BunkerWeb Cloud See all → |
| Pricing | Free plan |
| Website | bunkerweb.io |
| Facts checked | 20 Sep 2026 |
BunkerWeb integrations
BunkerWeb lists 6 integrations on its own site.
- Docker
- Linux
- Docker Swarm
- Kubernetes
- Docker autoconf
- BunkerWeb Cloud
See all BunkerWeb integrations →
Alternatives to BunkerWeb
- Cloudflare WAFBroad edge WAF coverage with a free plan and Terraform management.9.4
- AWS WAFFlexible AWS-native protection with usage-based pricing that requires careful cost planning.9.2
- Wallarm WAAPA broad WAAP platform with a useful free tier for API-focused security teams.9.1
See all BunkerWeb alternatives →
Also Ranked In
BunkerWeb is ranked in 2 of our directories.
Used BunkerWeb? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used BunkerWeb for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
BunkerWeb is listed in our Web Application Firewall Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/bunkerweb/"><img src="https://www.itechguides.com/best/badge/bunkerweb.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update