BunkerWeb review
A free, self-hosted WAF with OWASP rules, API validation, rate limiting, and antibot controls.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
BunkerWeb is an open-source Web Application Firewall based on NGINX, operating as a reverse proxy in front of web services. It is designed for self-hosted teams that want to protect web applications and APIs without adopting a fully managed WAF. The free edition is available under AGPLv3 and includes ModSecurity integration with the OWASP Core Rule Set, request and connection rate limiting, antibot challenges, HTTP security headers, TLS hardening, IP filtering, and a web UI for configuration and monitoring.
Deployment flexibility is a central strength. BunkerWeb supports Linux, Docker, Docker Swarm, Kubernetes, Docker autoconf, and BunkerWeb Cloud. Its plugin-based extensibility also gives teams a way to expand the deployment beyond the built-in controls. Protection features cover reverse proxy operation, OpenAPI request validation, IP blacklisting and whitelisting, DNSBL support, TLS automation, CAPTCHA and JavaScript verification, and monitoring through the web UI. This combination suits teams that want control over where the WAF runs and how it fits into their infrastructure.
The trade-off is operational ownership. A self-hosted WAF requires the team to manage deployment, configuration, updates, and the surrounding infrastructure rather than relying on a managed enterprise service. Bunkerity also offers a separate PRO edition and managed BunkerWeb Cloud with additional features and support options, but the free open-source edition is the clearest fit for teams prioritizing control and no license cost. Choose BunkerWeb when Docker, Kubernetes, Linux, API protection, and open-source deployment matter; choose a managed WAF alternative when minimizing infrastructure responsibility is the priority.
BunkerWeb pros and cons
- Where it wins
- Free AGPLv3 edition with open-source code
- OWASP Core Rule Set, API validation, and rate limiting
- Docker, Kubernetes, Linux, and web UI support
- Where it doesn't
- Self-hosted deployment requires team-managed operations
- PRO and Cloud editions add paid options beyond the free edition
- Feature scope is more deployment-focused than managed enterprise WAFs
BunkerWeb fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update