Official external plugins for BunkerWeb: add authentication, security scanning, WAF inspection, notifications, and edge integrations. New to BunkerWeb? Start with the documentation.
 Security scanning ClamAV · VirusTotal · SentinelOne |
 Web application firewall Coraza · open-appsec |
 Authentication Authentik |
 Notifications Discord · Matrix · Slack · WebHook |
 Edge and network Cloudflare · SysWarden |
Choose a plugin below. Each link opens its directory; the README there covers prerequisites, setup, settings, and troubleshooting.
Inspect uploaded files and client IPs, and deny what the scanner flags.
| Plugin | What it does |
|---|---|
| ClamAV | Scans multipart file uploads with a ClamAV clamd daemon and denies the request when a file is flagged as infected. |
| VirusTotal | Checks client IPs and the SHA-256 of uploaded files against the VirusTotal API v3 and denies over-threshold results. |
| SentinelOne | Checks client IPs and uploaded-file SHA-1 hashes against your SentinelOne Singularity console, denying flagged requests. |
Block malicious requests before they reach the upstream.
| Plugin | What it does |
|---|---|
| Coraza | Runs the Coraza web application firewall with the OWASP Core Rule Set to block malicious requests before they reach the upstream. |
| open-appsec | Lets BunkerWeb consult open-appsec, Check Point's open-source machine-learning WAF, before a request reaches the upstream. |
Put a login in front of any site.
| Plugin | What it does |
|---|---|
| Authentik | Forward authentication with Authentik, on top of any existing service configuration. |
Get an alert each time BunkerWeb denies a request. These plugins send notifications asynchronously; they never block traffic.
| Plugin | What it does |
|---|---|
| Discord | Sends an attack notification to a Discord channel through a webhook. |
| Matrix | Sends an attack notification to a Matrix room each time BunkerWeb denies a request. |
| Slack | Posts a Slack message to an incoming webhook each time BunkerWeb denies a request. |
| WebHook | Posts an attack notification to a custom HTTP endpoint each time BunkerWeb denies a request. |
Sit BunkerWeb behind Cloudflare, or pair its bans with the host firewall.
| Plugin | What it does |
|---|---|
| Cloudflare | Makes BunkerWeb a first-class origin behind Cloudflare: real client IP, trusted-peer checks, Authenticated Origin Pulls and Origin CA certificates. |
| SysWarden | Turns BunkerWeb Layer 7 bans into kernel-level nftables drops with SysWarden, and denies SysWarden's blocklist at Layer 7. |
Follow the external plugin installation guide, then follow the selected plugin's README for prerequisites and configuration.
Release 1.14 supports BunkerWeb 1.6.17.
The compatibility declaration applies to all 12 plugins listed above. Historical declarations are preserved in COMPATIBILITY.json; older BunkerWeb versions have not been revalidated for 1.14.
To prepare a release, run bash misc/update_version.sh <version> from the repository
root and add the matching version to COMPATIBILITY.json, listing the BunkerWeb
versions validated by the integration suite. CI checks that every plugin uses the
same version and that its compatibility entry includes the resolved BunkerWeb tag.
After Tests succeeds on main, a maintainer creates and pushes a signed annotated
tag matching the plugin version (for example, v1.14). The signing key must be
registered with the maintainer's GitHub account so GitHub can verify the signature.
CI holds no private signing key.
The tag push triggers the release workflow. It requires the tag to match the version
and current main commit, a verified signature targeting that commit, and a successful
Tests push run on main for that exact commit. Lightweight, unsigned, and mismatched
tags are rejected. An existing release or draft is left alone; otherwise the workflow
creates a draft with generated release notes for a maintainer to review and publish.
Get technical support, tailored consulting, and custom development directly from the BunkerWeb maintainers through the BunkerWeb panel.
The panel also offers:
- BunkerWeb PRO, with a 30-day free trial.
- BunkerWeb Cloud, a fully managed BunkerWeb instance with PRO features, monitoring dashboards and alerts, and technical support.
For free community support, use:
- The #help channel in the BunkerWeb Discord server
- The help category of GitHub discussions
- The /r/BunkerWeb subreddit
- The Server Fault and Super User forums
Use GitHub issues for bug reports, feature requests, and new plugin proposals. Check existing issues first; use the community channels above for help.
This project is licensed under the terms of the GNU Affero General Public License (AGPL) version 3.
Read the contributing guidelines before submitting a pull request. For non-trivial changes, open an issue first to discuss the approach.
Report vulnerabilities privately to security [@] bunkerity.com, following the security policy.