BunkerWeb
Open-source web application firewall from Bunkerity in Agen, France, as a self-hosted reverse proxy or a managed SaaS
Quick Overview
| Company | Bunkerity SAS |
|---|---|
| Category | Web Application Firewall |
| Headquarters | Agen, France |
| Founded | Not stated |
| EU Presence | Yes - France (EU) |
| Data Location | Self-hosted: your servers. BunkerWeb CLOUD: provider and region chosen on request, including SecNumCloud, ISO 27001 or HDS certified infrastructure |
| Open Source | AGPLv3 |
| GDPR Compliant | Yes |
| Self-Hosting | Yes: Linux, Docker and Kubernetes |
| Main Features | Open-source WAF, reverse proxy, OWASP Top 10 protection, bot blocking, DDoS mitigation, HTTPS certificate management, plugins, ModSecurity and Lua rules |
| Pricing | Open Source free; Standard 49 euro/month and Enterprise 149 euro/month (self-hosted); BunkerWeb CLOUD from 639 euro/month; Sentinel on quote |
| Best For | DevOps teams that want an auditable WAF they host themselves, with optional paid support |
| Replaces | F5 BIG-IP Advanced WAF, NGINX App Protect, Cloudflare WAF |
Detailed Review
BunkerWeb is placed as a reverse proxy in front of web services and adds web application firewall functions. The vendor says it defends against the OWASP Top 10, blocks malicious bots and mitigates DDoS, and also manages HTTPS certificates and HTTP policies from one entry point.
The company is Bunkerity SAS, registered in Agen (RCS Agen B 902 545 128, share capital 75,000 euro), and its website states it is hosted by OVH SAS in Roubaix. The core code is published under the AGPLv3 licence, so a third party can audit it.
Open source and paid tiers
The free Open Source edition is self-hosted with community support and no SLA. Standard (Shield) costs 49 euro a month and Enterprise (Fortress) 149 euro a month, both self-hosted, with a 30-day trial. Sentinel is a custom quote with dedicated support.
BunkerWeb CLOUD
The managed edition starts from 639 euro a month and runs BunkerWeb as a service with a monitoring platform. The vendor says it is built on ModSecurity and Lua with HTTP/2, HTTP/3 and TLS 1.3 support, and that provider and region are chosen on request.
Where it fits
It suits teams already running Docker or Kubernetes who prefer to own the configuration. The vendor lists Linux, Docker and Kubernetes as install targets.
Limitations to Consider
The free edition has no SLA and community support only. The cloud price is a fixed starting point that rises with services and resources, and the vendor describes pricing as based on services protected and resources allocated. A small company will not have the global scrubbing capacity of a CDN-based WAF, so large volumetric attacks need a provider in front.
Who Should Use BunkerWeb
Engineering teams that want to inspect and host their own WAF, with the choice to buy support or a managed service later.
Pros and Cons
Pros
- AGPLv3, code can be audited
- Free self-hosted edition
- Runs on Linux, Docker and Kubernetes
- Managed cloud edition available
- French company, hosted on OVH in France
Cons
- Free edition has community support only
- Managed edition starts at 639 euro a month
- No own global scrubbing network
- Small vendor compared with F5
Alternatives to BunkerWeb
Other European web application firewall worth comparing before you decide:
Myra Security
Germany · German security platform with a WAF, DDoS filter and CDN
Airlock
Switzerland · Swiss WAF and API gateway from Ergon Informatik
Link11
Germany · German cloud WAF with AI-based DDoS filtering
Gcore
Luxembourg · Luxembourg edge platform with WAF and DDoS protection
See all European web application firewall or compare them directly against F5 BIG-IP Advanced WAF on our alternatives page.
Frequently Asked Questions
The Open Source edition is free to self-host under AGPLv3, with community support and no SLA. The Standard plan at 49 euro a month adds all PRO features, and Enterprise at 149 euro a month adds priority support from the core maintainers.
The vendor says the cloud provider and region are chosen on request and that it supports infrastructure certified SecNumCloud, ISO 27001 or HDS. The default region is not stated on the pages checked.
It covers the WAF function with OWASP Top 10 rules and bot blocking, as a reverse proxy. It does not replace BIG-IP load balancing hardware or global DNS features.