Security scanning ClamAV · VirusTotal · SentinelOne

Web application firewall Coraza · open-appsec

Authentication Authentik

Notifications Discord · Matrix · Slack · WebHook

Edge and network Cloudflare · SysWarden

Plugins

Choose a plugin below. Each link opens its directory; the README there covers prerequisites, setup, settings, and troubleshooting.

Security scanning

Inspect uploaded files and client IPs, and deny what the scanner flags.

Plugin	What it does
ClamAV	Scans multipart file uploads with a ClamAV clamd daemon and denies the request when a file is flagged as infected.
VirusTotal	Checks client IPs and the SHA-256 of uploaded files against the VirusTotal API v3 and denies over-threshold results.
SentinelOne	Checks client IPs and uploaded-file SHA-1 hashes against your SentinelOne Singularity console, denying flagged requests.

Web application firewall

Block malicious requests before they reach the upstream.

Plugin	What it does
Coraza	Runs the Coraza web application firewall with the OWASP Core Rule Set to block malicious requests before they reach the upstream.
open-appsec	Lets BunkerWeb consult open-appsec, Check Point's open-source machine-learning WAF, before a request reaches the upstream.

Authentication

Put a login in front of any site.

Plugin	What it does
Authentik	Forward authentication with Authentik, on top of any existing service configuration.

Notifications

Get an alert each time BunkerWeb denies a request. These plugins send notifications asynchronously; they never block traffic.

Plugin	What it does
Discord	Sends an attack notification to a Discord channel through a webhook.
Matrix	Sends an attack notification to a Matrix room each time BunkerWeb denies a request.
Slack	Posts a Slack message to an incoming webhook each time BunkerWeb denies a request.
WebHook	Posts an attack notification to a custom HTTP endpoint each time BunkerWeb denies a request.

Edge and network

Sit BunkerWeb behind Cloudflare, or pair its bans with the host firewall.

Plugin	What it does
Cloudflare	Makes BunkerWeb a first-class origin behind Cloudflare: real client IP, trusted-peer checks, Authenticated Origin Pulls and Origin CA certificates.
SysWarden	Turns BunkerWeb Layer 7 bans into kernel-level nftables drops with SysWarden, and denies SysWarden's blocklist at Layer 7.

Install

Follow the external plugin installation guide, then follow the selected plugin's README for prerequisites and configuration.

Compatibility and releases

Release 1.14 supports BunkerWeb 1.6.17.

The compatibility declaration applies to all 12 plugins listed above. Historical declarations are preserved in COMPATIBILITY.json; older BunkerWeb versions have not been revalidated for 1.14.

To prepare a release, run bash misc/update_version.sh <version> from the repository root and add the matching version to COMPATIBILITY.json, listing the BunkerWeb versions validated by the integration suite. CI checks that every plugin uses the same version and that its compatibility entry includes the resolved BunkerWeb tag.

After Tests succeeds on main, a maintainer creates and pushes a signed annotated tag matching the plugin version (for example, v1.14). The signing key must be registered with the maintainer's GitHub account so GitHub can verify the signature. CI holds no private signing key.

The tag push triggers the release workflow. It requires the tag to match the version and current main commit, a verified signature targeting that commit, and a successful Tests push run on main for that exact commit. Lightweight, unsigned, and mismatched tags are rejected. An existing release or draft is left alone; otherwise the workflow creates a draft with generated release notes for a maintainer to review and publish.

Support

Professional

Get technical support, tailored consulting, and custom development directly from the BunkerWeb maintainers through the BunkerWeb panel.

The panel also offers:

• BunkerWeb PRO, with a 30-day free trial.
• BunkerWeb Cloud, a fully managed BunkerWeb instance with PRO features, monitoring dashboards and alerts, and technical support.

Community

For free community support, use:

• The #help channel in the BunkerWeb Discord server
• The help category of GitHub discussions
• The /r/BunkerWeb subreddit
• The Server Fault and Super User forums

Use GitHub issues for bug reports, feature requests, and new plugin proposals. Check existing issues first; use the community channels above for help.

License

This project is licensed under the terms of the GNU Affero General Public License (AGPL) version 3.

Contribute

Read the contributing guidelines before submitting a pull request. For non-trivial changes, open an issue first to discuss the approach.

Security policy

Report vulnerabilities privately to security [@] bunkerity.com, following the security policy.