BunkerWeb

Judgement

What it is

Complete system

What it does

A web application firewall built on nginx and ModSecurity that sits in front of your sites as a reverse proxy, with bot protection, DNS blocklists and a web admin panel.

Adopt it when

You self-host web apps on Docker or Kubernetes and want a WAF with sensible security defaults instead of hand-tuning ModSecurity.

Watch out

It is AGPL-licensed and some features are in the paid PRO edition.

Ready for

Usable

Runs as

Self-hosted server

Built with

Python, nginx, ModSecurity and Lua

How established

Established: started 7 years ago, latest release v1.6.17.

What the license allows

Use inside your business is unrestricted. If you change it and let customers use it over the internet, you must publish your changes.

Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.

Compare BunkerWeb

Built from

Follow it down: BunkerWeb → CPython → GCC → LLVM project → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to BunkerWeb

1. 1
   Caddy caddyserver

   Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

   Building block Production-ready You want to serve sites or proxy apps over HTTPS with almost no configuration and no separate certificate tooling.

   ★ 79k Apache-2.0 Go Active, pushed today
   
2. 2
   Traefik traefik

   The Cloud Native Application Proxy

   Building block Production-ready Your services run in Docker or Kubernetes and you want routes created automatically as containers start and stop.

   ★ 65k MIT Go Active, pushed today
   
3. 3
   Kong Gateway Kong

   🦍 The API and AI Gateway

   Building block Production-ready You expose many APIs and want a gateway with a large plugin ecosystem, run yourself or through Kong's cloud.

   ★ 44k Apache-2.0 Lua Active, pushed 17 days ago
4. 4
   Nginx nginx

   The official NGINX Open Source repository.

   Building block Production-ready You need a fast, proven web server or reverse proxy in front of your applications.

   ★ 32k BSD-2-Clause C Active, pushed today
   
5. 5
   Nginx-proxy nginx-proxy

   Automated Nginx Reverse Proxy for Docker

   Building block Production-ready You host several web containers on one Docker host and want them proxied by hostname without editing nginx config.

   ★ 20k MIT Python Active, pushed 3 days ago
6. 6
   Apache APISIX apache

   The Cloud-Native API Gateway and AI Gateway

   Building block Production-ready You want a fully open-source API gateway whose routes and plugins change at runtime without reloads.

   ★ 17k Apache-2.0 Lua Active, pushed today
7. 7
   cloudflared cloudflare

   Cloudflare Tunnel client

   Integration Production-ready You want to publish an internal or home-hosted service through Cloudflare without a public IP or firewall changes.

   ★ 16k Apache-2.0 Go Active, pushed yesterday
8. 8
   Tengine alibaba

   A high-performance web server and reverse proxy, 100% compatible with nginx.

   Building block Production-ready You need nginx with built-in active health checks or Chinese national cryptography and are comfortable tracking a fork.

   ★ 13k BSD-2-Clause C Active, pushed 2 months ago