BunkerWeb

Next-gen Web Application Firewall (WAF) that will protect your web services.

Website Source code Live demo

GitHub stars: 11,063
License: AGPL-3.0
Latest release: v1.6.16-rc4
6 October 2026
Last commit: 21 September 2026
Runs on: Debian packages, Docker, Kubernetes, Python

Commits per month, last 12 months

1,931 commits

Replaces

Paid products BunkerWeb can stand in for.

Cloudflare WAFWeb application firewall in front of your site.

How to self-host BunkerWeb

BunkerWeb runs on Debian packages, Docker, Kubernetes and Python. The project's own install guide is the place to start; most people put it on a small server with Docker and a reverse proxy for HTTPS.

Get a server: a home server, a VPS, or a managed app host.
Install it the way the project's docs describe, usually with Docker Compose.
Put it behind HTTPS and set up backups before you add real data.
Update it regularly. Watch the project's releases.

New to self-hosting? Start with the beginner's guide.

Similar apps

Caddy
Powerful, enterprise-ready, open source web server with automatic HTTPS.
77.9k stars
Traefik
HTTP reverse proxy and load balancer that makes deploying microservices easy.
65.2k stars
Nginx Proxy Manager
Docker container for managing Nginx proxy hosts with a simple, powerful interface.
34.4k stars
NGINX
HTTP and reverse proxy server, mail proxy server, and generic TCP/UDP proxy server.
31.9k stars
Pangolin
Identity-aware tunneled reverse proxy with dashboard UI, access control, and WireGuard-based tunnels (alternative to Cloudflare Tunnel, Tailscale).
23.1k stars
SafeLine
Web application firewall / reverse proxy to protect your web apps from attacks and exploits.
22.7k stars

Questions

Is BunkerWeb free?

Yes. BunkerWeb is open source under the AGPL-3.0 license, so you can use it without paying for a license. You pay only for the server it runs on.

Can I self-host BunkerWeb?

Yes. BunkerWeb runs on Debian packages, Docker, Kubernetes and Python. Follow the install guide in the project's documentation, or use a host that installs it for you.

What does BunkerWeb replace?

People use BunkerWeb instead of Cloudflare WAF.

Is BunkerWeb still maintained?

The last change to BunkerWeb's code was on 21 September 2026, with 1931 commits in the last 12 months.

Topics

App data from awesome-selfhosted (CC BY-SA 3.0), stars and activity from GitHub.