BunkerWeb

No entries match these filters. Clear filters

1. docs update Oct 22, 2026 · issue 116

   BunkerWeb 1.6.17 adds IP-address TLS certificates, new database timeout settings, bad-behavior report size controls, and a shared-memory zone size knob for dynamic upstreams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ USE IT
   Prevent a stale MySQL connection from hanging the scheduler indefinitely by capping connect and read waits.
   env copy

   DATABASE_CONNECT_TIMEOUT=5s
   DATABASE_READ_TIMEOUT=30s

   Limit how much memory bad-behavior ban reports consume when logging high-volume attack traffic.
   env copy

   BAD_BEHAVIOR_REPORT_MAX_EVENTS=50
   BAD_BEHAVIOR_REPORT_MAX_STRING_SIZE=512

   • Adds BAD_BEHAVIOR_REPORT_MAX_EVENTS config key to cap the number of new events copied as ban evidence into bad-behavior reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds BAD_BEHAVIOR_REPORT_MAX_STRING_SIZE config key to cap the maximum byte length of each URL or method string stored in bad-behavior reports.
   • Adds DATABASE_CONNECT_TIMEOUT config key to set the maximum wait time when opening a connection to a MySQL, MariaDB, or PostgreSQL server; accepts a time suffix (ms, s, m, h, d, w, M, y).
   • Adds DATABASE_READ_TIMEOUT config key to set the maximum wait time for a response from a MySQL or MariaDB server before failing (PostgreSQL uses TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. keepalives instead); accepts a time suffix (ms, s, m, h, d, w, M, y).
   • Adds LOADBALANCER_ZONE_SIZE config key to control the shared memory zone size for upstreams with dynamic resolution.

   +2 more show less

   • Supports Let's Encrypt certificates for public IPv4 addresses: add the IP alongside hostnames in the server name field and BunkerWeb requests a single certificate covering all entries; IP certificates have 160-hour validity and are auto-renewed daily.
   • ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. HTTP-01HTTP-01An ACME protocol challenge type, defined by the IETF, where a CA verifies domain ownership by fetching a token over plain HTTP on port 80. Cyber tools use it to automate TLS certificate issuance. challenge URIs now pass through automatically, bypassing antibot, blacklist, rate limiting, Basic Auth, ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application., and the ban check, so Let's Encrypt validation succeeds even with those protections active.
   • Adds BAD_BEHAVIOR_REPORT_MAX_EVENTS config key to cap the number of new events copied as ban evidence into bad-behavior reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds BAD_BEHAVIOR_REPORT_MAX_STRING_SIZE config key to cap the maximum byte length of each URL or method string stored in bad-behavior reports.
   • Adds DATABASE_CONNECT_TIMEOUT config key to set the maximum wait time when opening a connection to a MySQL, MariaDB, or PostgreSQL server; accepts a time suffix (ms, s, m, h, d, w, M, y).
   • Adds DATABASE_READ_TIMEOUT config key to set the maximum wait time for a response from a MySQL or MariaDB server before failing (PostgreSQL uses TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. keepalives instead); accepts a time suffix (ms, s, m, h, d, w, M, y).
   • Adds LOADBALANCER_ZONE_SIZE config key to control the shared memory zone size for upstreams with dynamic resolution.

   +1 more show less

   • Supports Let's Encrypt certificates for public IPv4 addresses: add the IP alongside hostnames in the server name field and BunkerWeb requests a single certificate covering all entries; IP certificates have 160-hour validity and are auto-renewed daily.

   1 more in Everything

2. docs update Oct 22, 2026 · issue 116

   BunkerWeb: Supports Let's Encrypt certificate profiles, including short-lived (shortlived, 160-hour validity, up to 25 names).

   ⤢ ⤢ ⤢ ⤢
   └──▷ USE IT
   Set database connection and read timeouts so a lost MySQL peer does not hang BunkerWeb indefinitely.
   /etc/bunkerweb/variables.env copy

   DATABASE_CONNECT_TIMEOUT=5s
   DATABASE_READ_TIMEOUT=10s

   Request a Let's Encrypt certificate that covers both a hostname and a public IPv4 address in single-site mode.
   /etc/bunkerweb/variables.env copy

   SERVER_NAME="www.example.com 203.0.113.10"
   MULTISITE=no

   Cap ban-evidence report size to control storage growth when bad-behavior events are frequent.
   /etc/bunkerweb/variables.env copy

   BAD_BEHAVIOR_REPORT_MAX_EVENTS=50
   BAD_BEHAVIOR_REPORT_MAX_STRING_SIZE=512

3. docs update Oct 22, 2026 · issue 116
   ⤢ ⤢ ⤢ ⤢
   └──▷ USE IT
   Set a 5-second connection timeout and a 30-second read timeout for a MariaDB backend so a vanished peer never blocks BunkerWeb indefinitely.
   ini copy

   DATABASE_CONNECT_TIMEOUT=5s
   DATABASE_READ_TIMEOUT=30s

   Cap ban-report evidence to the 20 most recent events, each URL or method stored up to 512 bytes, to control report storage growth.
   ini copy

   BAD_BEHAVIOR_REPORT_MAX_EVENTS=20
   BAD_BEHAVIOR_REPORT_MAX_STRING_SIZE=512

4. v1.6.17 Oct 21, 2026 · issue 116

   BunkerWeb v1.6.17 adds configurable database timeouts and expands the default Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. to block unbounded-element.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.6.17 https://github.com/bunkerity/bunkerweb.git
   # already have the repo? check out this version:
   $ git checkout v1.6.17

   └──▷ USE IT
   Reduce the database connect timeout in a high-availability environment where a dead DB node should be detected and bypassed quickly.
   ini copy

   DATABASE_CONNECT_TIMEOUT=3s
   DATABASE_READ_TIMEOUT=1m

   • Expands the default PERMISSIONS_POLICY header to also deny unbounded-element.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. api-docs-9bb6ac79a8c8 Oct 16, 2026 · issue 110

   BunkerWeb 1.6.16 adds ban removal API supporting CrowdSec decision deletion via remove_crowdsec_decisions and decision_keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Remove a CrowdSec ban and delete the underlying CrowdSec decisions in one API call, preventing re-ban on the next sync.
   copy

   $ curl -X DELETE https://<bunkerweb-api>/bans \
     -H 'Content-Type: application/json' \
     -d '{"kind": "crowdsec_lease", "remove_crowdsec_decisions": true, "confirmed": true, "decision_keys": ["<key1>", "<key2>"]}'

6. docs update Oct 15, 2026 · issue 109

   BunkerWeb adds a plugin system with 12 official plugins (Authentik, ClamAV, Cloudflare, Coraza, open-appsec, SentinelOne, VirusTotal, and more) installable via EXTERNAL_PLUG⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Auto-install all official BunkerWeb plugins at startup by pointing EXTERNAL_PLUGIN_URLS at the versioned release ZIP.
   text copy

   EXTERNAL_PLUGIN_URLS=https://github.com/bunkerity/bunkerweb-plugins/archive/refs/tags/v1.13.zip

   Declare a new plugin with a scheduled hourly job and a custom setting in plugin.json.
   myplugin/plugin.json copy

   {
     "id": "myplugin",
     "name": "My Plugin",
     "description": "Just an example plugin.",
     "version": "1.0",
     "stream": "partial",
     "settings": {
       "DUMMY_SETTING": {
         "context": "multisite",
         "default": "1234",
         "help": "Here is the help of the setting.",
         "id": "dummy-id",
         "label": "Dummy setting",
         "regex": "^.*$",
         "type": "text"
       }
     },
     "jobs": [
       {
         "name": "my-job",
         "file": "my-job.py",
         "every": "hour"
       }
     ]
   }

   Manually deploy plugins on a Linux host so BunkerWeb picks them up on next reload.
   copy

   $ git clone https://github.com/bunkerity/bunkerweb-plugins && \
   cp -rp ./bunkerweb-plugins/* /etc/bunkerweb/plugins && \
   chown -R nginx:nginx /etc/bunkerweb/plugins

   • Adds EXTERNAL_PLUGIN_URLS setting to automatically install one or more plugins from space-separated ZIP archive URLs at startup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces a plugin system supporting custom NGINX configs (confs/), Lua code (plugin.lua), scheduler jobs (jobs/), UI pages (ui/template.html), Flask hooks (ui/hooks.py), Flask blueprints (ui/blueprints/), and custom templates (templates/my-template.json), all declared in plugin.json.
   • Adds bwcli field in plugin.json to map CLI command names to files in the plugin's bwcli/ directory, enabling CLI-accessible plugin commands.
   • Ships 12 official plugins: Authentik (SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. forward-auth), ClamAV (file upload AV scanning), Cloudflare (trusted IPs, Origin CA, IP-list sync), Coraza (WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. alternative), Discord/Slack/Matrix/WebHook (security alert notifications), open-appsec (ML-based WAF via sidecar), SentinelOne (file hash and IP reputation blocking), SysWarden (nftables kernel-level block sync), and VirusTotal (file hash and IP reputation blocking).
   • Supports manual plugin installation into /data/plugins (Docker/Swarm/Kubernetes via volume mount) or /etc/bunkerweb/plugins (Linux integration).

   5 details in Everything

7. docs update Oct 15, 2026 · issue 109

   BunkerWeb 1.6.16 adds keepalived VRRPVRRPA network protocol (RFC 5798) that lets multiple routers share a virtual IP address, electing one as active so hosts keep a working gateway if the primary fails. active/passive HA and a smarter healthcheck that stays ok during config reloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ USE IT
   Configure keepalived on the master worker to use the BunkerWeb healthcheck, so VRRP only holds the VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. while NGINX is healthy — reloads no longer trigger a false failover.
   /etc/keepalived/keepalived.conf copy

   global_defs {
     enable_script_security
     script_user root
   }
   vrrp_script chk_bunkerweb {
     script "/usr/share/bunkerweb/helpers/healthcheck.sh ok"
     interval 2
     fall 2
     rise 2
   }
   vrrp_instance VI_BUNKERWEB {
     state MASTER
     interface eth0
     virtual_router_id 51
     priority 110
     advert_int 1
     authentication {
       auth_type PASS
       auth_pass changeme
     }
     virtual_ipaddress {
       192.168.10.100/24
     }
     track_script {
       chk_bunkerweb
     }
   }

   • Adds healthcheck.sh ok argument to /usr/share/bunkerweb/helpers/healthcheck.sh so the health endpoint returns success during config reloads (when NGINX is still serving the previous config), exiting non-zero only when the instance is still in loading state or NGINX is stopped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds documented keepalived VRRP active/passive HA topology (section 6) using /etc/keepalived/keepalived.conf with vrrp_script chk_bunkerweb calling healthcheck.sh ok, enabling sub-10-second failover between BunkerWeb workers without a load balancer.
   • Documents shared-state guidance for active/passive HA: enable Redis (USE_REDIS) on both workers and set identical fixed values for SESSIONS_SECRET and SESSIONS_NAME via global Manager settings to preserve locks, counters, and sessions across failover.

   3 details in Everything

8. docs update Oct 15, 2026 · issue 109

   BunkerWeb adds TLS-handshake dropping for banned IPs (BANS_TLS_DROP_REASONS), configurable PoW difficulty (ANTIBOT_JAVASCRIPT_DIFFICULTY), and a -confirm flag for bwcli unban.

   • Adds BANS_TLS_DROP_REASONS to close connections at the TLS handshake for chosen ban reasons (bad_behavior, manual, ui, api), saving CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware.; never applies to HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer..
   • Adds ANTIBOT_JAVASCRIPT_DIFFICULTY (16–28 leading zero-bits, default 16) to control JavaScript Proof-of-Work challenge cost.
   • Updated integrationExtends bwcli unban with -confirm to preview CrowdSec decision removal before committing.

   3 details in Everything

9. docs update Oct 15, 2026 · issue 109

   Adds the openappsec external plugin to route requests through the open-appsec machine-learning WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. sidecar agent for blocking.

   • New integration open-appsec ML WAF integration
10. docs update Oct 15, 2026 · issue 109

    BunkerWeb 1.6.16 adds active/passive high-availability via keepalivedkeepalivedA Linux daemon that implements VRRP and health-check-driven load balancing to keep a virtual IP address available even when individual nodes fail, giving cyber tools a reliable, self-healing network endpoint without external orchestration. with VRRPVRRPA network protocol (RFC 5798) that lets multiple routers share a virtual IP address, electing one as active so hosts keep a working gateway if the primary fails.-based VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. failover for multi-worker deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Configure keepalived health-check on the master worker so the VIP is only held when BunkerWeb is fully ready — not during config reload.
    /etc/keepalived/keepalived.conf copy

    vrrp_script chk_bunkerweb {
      script "/usr/share/bunkerweb/helpers/healthcheck.sh ok"
      interval 2
      fall 2
      rise 2
    }
    
    vrrp_instance VI_BUNKERWEB {
      state MASTER
      interface eth0
      virtual_router_id 51
      priority 110
      advert_int 1
      authentication {
        auth_type PASS
        auth_pass changeme
      }
      virtual_ipaddress {
        192.168.10.100/24
      }
      track_script {
        chk_bunkerweb
      }
    }

    Verify BunkerWeb is fully operational (not just loading) before keepalived promotes the worker — use in scripts or manual checks.
    copy

    $ /usr/share/bunkerweb/helpers/healthcheck.sh ok

    • Adds keepalived active/passive HA mode using VRRP virtual IP (VIP) failover as a load-balancer-free alternative to multi-worker deployments, configured via /etc/keepalived/keepalived.conf.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ok argument to /usr/share/bunkerweb/helpers/healthcheck.sh to return exit code 0 only when the instance is fully ready (NGINX running and configuration applied), enabling keepalived to withhold the VIP from instances still in loading state.
    • Supports shared ban/counter state across HA workers by pointing both workers at the same Redis/Valkey instance via the Redis settings.
    • Adds keepalived active/passive HA mode using VRRP virtual IP (VIP) failover as a load-balancer-free alternative to multi-worker deployments, configured via /etc/keepalived/keepalived.conf.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ok argument to /usr/share/bunkerweb/helpers/healthcheck.sh to return exit code 0 only when the instance is fully ready (NGINX running and configuration applied), enabling keepalived to withhold the VIP from instances still in loading state.

    1 more in Everything

11. docs update Oct 15, 2026 · issue 109

    Adds BANS_TLS_DROP_REASONS to terminate banned IPs at TLS handshake, CROWDSEC_BAN_REFRESH for native short-lived CrowdSec bans, ANTIBOT_JAVASCRIPT_DIFFICULTY for PoW tuning, and JSON fragment filters for list sources.

    • Adds BANS_TLS_DROP_REASONS config key to drop banned clients at TLS negotiation (before certificate or key-exchange work) for specified ban reasons (bad_behavior, manual, ui, api, space-separated); default is empty, preserving the 403 page for all bans — saves CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. when banned IPs repeatedly reconnect.
    • Adds ANTIBOT_JAVASCRIPT_DIFFICULTY config key to tune proof-of-work challenge difficulty in bits of leading zeros (range 16–28, default 16); each additional bit doubles average solve time.
    • Adds JSON fragment filter syntax for IP/URL list sources: #key keeps values under a key, #key=value keeps objects whose property equals or contains a value, and & combines terms (e.g. https://ip-ranges.amazonaws.com/ip-ranges.json#service=CLOUDFRONT).
    • Tracks TLS-drop counts per ban reason in metrics, and exposes ban state plus CrowdSec ban state in the bans_meta shared-memory zone (always declared at 10 MiB, memory used only when BANS_TLS_DROP_REASONS or CROWDSEC_BAN_REFRESH is set).
    • Updated integrationExtends bwcli unban with a -confirm flag for CrowdSec ban removal: without -confirm the command lists affected CrowdSec decisions (IP/range, type, origin, scenario) without deleting anything; with -confirm it removes CrowdSec decisions and the BunkerWeb ban together.

    +1 more show less

    • Supports duration suffixes (ms, s, m, h, d, w, M, y) on all time-based config keys including CROWDSEC_BAN_REFRESH, ANTIBOT_JAVASCRIPT_DIFFICULTY timeouts, CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. preflight cache, and UI session retention.

    6 details in Everything

12. docs update Oct 15, 2026 · issue 109

    BunkerWeb adds an open-appsec ML-WAFML-WAFA web application firewall that uses machine learning models to detect and block malicious HTTP traffic, letting cyber tools adapt to novel attack patterns without relying solely on static signature rules. sidecar plugin, installable via EXTERNAL_PLUGIN_URLS pointing to the v1.13 plugin archive.

    • New integration open-appsec ML-WAF integration
13. docs update Oct 15, 2026 · issue 109

    BunkerWeb: Adds floating-IP high availability via keepalivedkeepalivedA Linux daemon that implements VRRP and health-check-driven load balancing to keep a virtual IP address available even when individual nodes fail, giving cyber tools a reliable, self-healing network endpoint without external orchestration. VRRPVRRPA network protocol (RFC 5798) that lets multiple routers share a virtual IP address, electing one as active so hosts keep a working gateway if the primary fails., so workers run active/passive without a load balancer; the VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. fails over in ~4 seconds on container stop.

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Configure keepalived on the master worker so the VIP floats to the backup only when BunkerWeb is genuinely healthy and fully configured.
    /etc/keepalived/keepalived.conf copy

    global_defs {
      enable_script_security
      script_user root
    }
    vrrp_script chk_bunkerweb {
      script "/usr/share/bunkerweb/helpers/healthcheck.sh ok"
      interval 2
      fall 2
      rise 2
    }
    vrrp_instance VI_BUNKERWEB {
      state MASTER
      interface eth0
      virtual_router_id 51
      priority 110
      advert_int 1
      authentication {
        auth_type PASS
        auth_pass changeme
      }
      virtual_ipaddress {
        192.168.10.100/24
      }
      track_script {
        chk_bunkerweb
      }
    }

    • Documents /etc/keepalived/keepalived.conf configuration for BunkerWeb workers, using vrrp_script chk_bunkerweb with interval 2, fall 2, rise 2 to gate VIP ownership on the healthcheck result.

    1 detail in Everything

14. docs update Oct 15, 2026 · issue 109
    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Drop manually banned and bad-behavior IPs at the TLS layer to avoid serving a 403 page to repeat offenders, reducing CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cost on high-volume ban lists.
    env copy

    BANS_TLS_DROP_REASONS=bad_behavior manual

    Convert CrowdSec blocks into 5-minute BunkerWeb bans so repeat offenders are stopped at the ban check rather than triggering a live CrowdSec API lookup on every request.
    env copy

    CROWDSEC_BAN_REFRESH=5m

15. v1.6.16 Oct 14, 2026 · issue 109

    BunkerWeb v1.6.16 adds Redis ClusterRedis ClusterA distributed mode of Redis, the open-source in-memory data store, that automatically shards data across multiple nodes and keeps it available if some nodes fail, giving cyber tools low-latency shared state at scale. support, TLS-drop banning, IPv4 Let's Encrypt certs, and richer IP-list formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.16 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.16

    └──▷ USE IT
    Enable Redis Cluster for BunkerWeb to share state across a multi-node cluster instead of a single Redis instance.
    text copy

    REDIS_CLUSTER_NODES=redis-node1:6379,redis-node2:6379,redis-node3:6379

    Drop TLS connections from banned IPs at the handshake level (for captcha and manual bans) so banned clients never see an HTTP response.
    env copy

    BANS_TLS_DROP_REASONS=captcha,manual

    Increase the JavaScript antibot challenge difficulty to slow down automated solvers without changing the challenge page.
    env copy

    ANTIBOT_JAVASCRIPT_DIFFICULTY=24

    • Adds REDIS_CLUSTER_NODES setting to enable Redis Cluster support for the redis integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds BANS_TLS_DROP_REASONS to close TLS handshakes of banned IPs for specified ban reasons instead of serving a 403 page, including dropping banned clients at the TLS ClientHello behind PROXY protocol when real IP uses proxy_protocol (trusted only from proxies in REAL_IP_FROM).
    • Adds CROWDSEC_BAN_REFRESH to turn CrowdSec blocks into short, renewed bans listed on the Bans page and removed with their decisions on Unban.
    • Adds ANTIBOT_JAVASCRIPT_DIFFICULTY (16 to 28 bits) to raise the JavaScript proof-of-work challenge cost in the antibot plugin.
    • Supports Let's Encrypt certificates for public IPv4 addresses in SERVER_NAME using the shortlived profile and the http challenge.

    +5 more show less

    • Extends IP list URL support in realip, blacklist, whitelist, and greylist to include JSON, JSON lines, CSV, and tab-separated formats, with a #key=value filter.
    • Adds an admin-only Web UI Diagnostics bundle on the Support page (/support/logs), with IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. address and credential anonymization.
    • Redesigns antibot challenge pages to follow browser preferences (theme, reduced motion, contrast, and text size), with a discreet reload link.
    • Adds publickey-credentials-remote-client-data-json denial to the default PERMISSIONS_POLICY header in the headers plugin.
    • Allows a scheduler job to exit with code 3 to request a configuration reload while still being reported as failed.
    • Adds REDIS_CLUSTER_NODES setting to enable Redis Cluster support for the redis integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds BANS_TLS_DROP_REASONS to close TLS handshakes of banned IPs for specified ban reasons instead of serving a 403 page, including dropping banned clients at the TLS ClientHello behind PROXY protocol when real IP uses proxy_protocol (trusted only from proxies in REAL_IP_FROM).
    • Adds CROWDSEC_BAN_REFRESH to turn CrowdSec blocks into short, renewed bans listed on the Bans page and removed with their decisions on Unban.
    • Adds ANTIBOT_JAVASCRIPT_DIFFICULTY (16 to 28 bits) to raise the JavaScript proof-of-work challenge cost in the antibot plugin.
    • Supports Let's Encrypt certificates for public IPv4 addresses in SERVER_NAME using the shortlived profile and the http challenge.

    +2 more show less

    • Adds an admin-only Web UI Diagnostics bundle on the Support page (/support/logs), with IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. address and credential anonymization.
    • Allows a scheduler job to exit with code 3 to request a configuration reload while still being reported as failed.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !METRICS_REDIS_TTL now interprets m as minutes instead of millions; values stored in the database are migrated automatically, but values set through environment variables are not and must be updated manually.
16. docs update Sep 21, 2026 · issue 081

    BunkerWeb gains a guided install-bunkerweb.sh --docker upgrade path with automatic backup, health checks, and rollback for Docker stacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Upgrade while preserving local docker-compose.yml edits but skip pulling images (useful when images are pre-pulled in an air-gapped environment).
    copy

    $ bash install-bunkerweb.sh --docker --compose-dir /opt/bunkerweb -v 1.6.15 --no-pull

    Force-regenerate docker-compose.yml when switching stack topology (e.g. from all-in-one to split manager/worker), accepting the destructive topology change.
    copy

    $ bash install-bunkerweb.sh --docker --compose-dir /opt/bunkerweb -v 1.6.15 --overwrite-compose --force-type-change

    • Adds --compose-dir PATH flag to install-bunkerweb.sh --docker to specify the stack directory instead of defaulting to the current working directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds -v, --version VERSION flag to target a specific BunkerWeb version during upgrade, deriving the image tag automatically.
    • Adds --image-tag TAG flag to supply a Docker image tag directly instead of deriving it from a version string.
    • Adds --backup-dir PATH flag to set a custom destination for the pre-upgrade backup archive.
    • Adds --overwrite-compose flag to force regeneration of docker-compose.yml even when local edits are detected.

    +8 more show less

    • Adds --force-type-change flag to allow switching stack topology (destructive) during an upgrade.
    • Adds --no-pull flag to skip pulling new images before container recreation.
    • Adds --docker-wait-timeout N flag to control how many seconds the script waits for the stack to become healthy (default: 600).
    • Upgrade script now runs bwcli plugin backup save in the Scheduler container and copies the archive to the host before applying any changes, aborting if the backup fails unless overridden.
    • Upgrade script reads the running version from the live container rather than trusting the image tag, enabling reliable detection of rolling tags (latest, testing) and previously interrupted upgrades.
    • Upgrade script rewrites .env with the new image tag while preserving manually added entries, and recreates docker-compose.yml only when it matches the script-generated original — local edits are kept unless --overwrite-compose is passed.
    • Upgrade script performs post-upgrade health verification requiring two healthy observations at least ten seconds apart before reporting success, and exits with status 2 (without rollback) if the stack does not become healthy within the timeout.
    • Adds replay protection for two-factor authentication codes stored in the shared database across Web UI replicas.

    13 details in Everything

17. docs update Sep 21, 2026 · issue 081

    BunkerWeb UI gains Redis-resilient session fallback with UI_USE_REDIS, per-service draft mode in the RAW editor, and scoped role controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ USE IT
    Disable Redis for the BunkerWeb UI session store only, keeping Redis active for inter-instance lock and report sharing.
    ini copy

    UI_USE_REDIS=no

    • Adds UI_USE_REDIS=no config variable to decouple the web UI from Redis independently of the global USE_REDIS setting, so Redis can be disabled for session storage without also disabling lock and report sharing between instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Redis-resilient session storage: when Redis is unavailable or rejects writes due to maxmemory, UI sessions fall back to a local per-host cache, with revocations (including logout and session-ID rotation) recorded in both stores to ensure they take effect regardless of Redis state.
    • Adds draft mode in the RAW editor for services and global settings: prefix a KEY=value line with # to mark it as a draft (value stored but not applied), or press Backspace on a draft line to activate it; draft lines persist across saves until explicitly activated.
    • Adds UI_USE_REDIS=no config variable to decouple the web UI from Redis independently of the global USE_REDIS setting, so Redis can be disabled for session storage without also disabling lock and report sharing between instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds draft mode in the RAW editor for services and global settings: prefix a KEY=value line with # to mark it as a draft (value stored but not applied), or press Backspace on a draft line to activate it; draft lines persist across saves until explicitly activated.

    1 more in Everything

18. docs update Sep 21, 2026 · issue 081

    BunkerWeb adds CrowdSec management APIs, header-based bypass rules, and session revocation memory config across multiple modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ USE IT
    Allow an internal health-check service to bypass the antibot challenge by presenting a shared secret header.
    env copy

    ANTIBOT_IGNORE_HEADER_NAME_1=X-Internal-Token
    ANTIBOT_IGNORE_HEADER_VALUE_1=^my-secret-token$

    Investigate all active CrowdSec decisions for a specific IP across a connection, to confirm whether a block is still in force before escalating a support ticket.
    copy

    $ curl -s -H 'Authorization: Bearer <api_token>' 'https://bunkerweb.example.com/api/crowdsec/<connection_id>/ips/203.0.113.42'

    Remove a mistaken CrowdSec ban on an IP so it propagates to all bouncers at their next stream update.
    copy

    $ curl -s -X DELETE -H 'Authorization: Bearer <api_token>' -H 'Content-Type: application/json' -d '{"scope":"ip","value":"203.0.113.42","decision_type":"ban"}' 'https://bunkerweb.example.com/api/crowdsec/<connection_id>/decisions/<decision_id>'

    • Adds SESSIONS_REVOCATION_MEMORY_SIZE config key to control the in-memory store size for revoked cookie session identifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ANTIBOT_IGNORE_HEADER_NAME and ANTIBOT_IGNORE_HEADER_VALUE config keys (numbered pairs _NAME_1/_VALUE_1) to allow requests matching a named header and optional PCRE regex to bypass the antibot challenge.
    • Adds BLACKLIST_HEADER_NAME and BLACKLIST_HEADER_VALUE config keys (numbered pairs) to blacklist requests carrying a specific header and optional PCRE-matched value.
    • Adds BLACKLIST_IGNORE_HEADER_NAME and BLACKLIST_IGNORE_HEADER_VALUE config keys (numbered pairs) to exempt requests matching a named header from the blacklist, overriding any cached blacklist hit.
    • Adds COUNTRY_IGNORE_HEADER_NAME and COUNTRY_IGNORE_HEADER_VALUE config keys (numbered pairs) to allow requests matching a named header to bypass country-based blocking.

    +10 more show less

    • Adds CROWDSEC_MANAGEMENT_LOGIN and CROWDSEC_MANAGEMENT_PASSWORD config keys to enable CrowdSec decision removal and alert inspection via a dedicated registered machine identity.
    • Adds GET /crowdsec API endpoint to retrieve CrowdSec connection status, sync state, and errors per instance.
    • Adds GET /crowdsec/{connection_id}/decisions API endpoint to list decisions, filterable by origin and scenario, paginated with offset and limit (max 200).
    • Adds GET /crowdsec/{connection_id}/ips/{ip} API endpoint for IP investigation returning up to 200 decisions, 50 alerts, and 50 reports including totals.
    • Adds GET /crowdsec/{connection_id}/alerts/{alert_id} API endpoint to retrieve sanitized alert details.
    • Adds GET /crowdsec/{connection_id}/allowlists API endpoint to list native CrowdSec allowlists with entries, comments, expiry, and management origin, paginated with offset and limit (up to 200 entries per list).
    • Adds GET /crowdsec/{connection_id}/allowlists/check?ip={ip} API endpoint to check whether an IP is on a native CrowdSec allowlist and return the match reason.
    • Adds DELETE /crowdsec/{connection_id}/decisions/{decision_id} API endpoint to remove a CrowdSec decision, requiring scope, value, and decision_type in the JSON request body.
    • Introduces crowdsec_read and crowdsec_delete delegated API permissions under the existing bans resource, scoped to a connection ID or *, distinct from the existing ban_delete permission.
    • Adds a CrowdSec investigation UI under Additional Pages → CrowdSec that consolidates active decisions, alerts, BunkerWeb reports, local bans, and native allowlist status with pre-filled IP lookup links.

    15 details in Everything

19. docs update Sep 21, 2026 · issue 081

    BunkerWeb adds SentinelOne, SysWarden, and VirusTotal integrations plus ClamAV antivirus file scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Install the full v1.12 plugin bundle — including SentinelOne, SysWarden, ClamAV, and VirusTotal — by pointing the scheduler at the tagged archive.
    text copy

    EXTERNAL_PLUGIN_URLS=https://github.com/bunkerity/bunkerweb-plugins/archive/refs/tags/v1.12.zip

    • Adds EXTERNAL_PLUGIN_URLS config key supporting https://github.com/bunkerity/bunkerweb-plugins/archive/refs/tags/v1.12.zip to install the new plugin bundle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds bunkerweb-plugins/sentinelone plugin to check uploaded file hashes and client IPs against the SentinelOne API, blocking requests based on reputation or indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
    • Adds bunkerweb-plugins/syswarden plugin to synchronize BunkerWeb bans to SysWarden for kernel-level nftables blocking and import its block/allow lists.
    • Adds ClamAV antivirus plugin that automatically scans uploaded files and rejects requests when a file is detected as malicious.
    • Adds VirusTotal plugin to check uploaded file hashes and client IPs against the VirusTotal API, blocking requests when configured reputation thresholds are exceeded.

    5 details in Everything

20. docs update Sep 21, 2026 · issue 081

    BunkerWeb: The install script rewrites .env with the new image tag while preserving any manually added entries, and backs up both .env and docker-compose.yml with a .bak.<timestamp> copy before making changes.

    └──▷ TRY IT
    Upgrade a stack that lives outside the current directory to a specific version, with a custom backup destination and an extended health-check timeout for slow first starts.
    copy

    $ bash install-bunkerweb.sh --docker --compose-dir /opt/bunkerweb --version 1.6.15 --backup-dir /mnt/backups --docker-wait-timeout 900

    Force regeneration of a locally modified docker-compose.yml when the local edits are no longer needed and you want the script-generated layout back.
    copy

    $ bash install-bunkerweb.sh --docker --compose-dir /opt/bunkerweb --version 1.6.15 --overwrite-compose

    • The upgrade process runs docker compose pull then docker compose up -d, recreating only containers whose image changed, and requires two healthy observations at least ten seconds apart before declaring success.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Two-factor authentication anti-replay state is now stored in the shared database instead of per-replica memory; during a rolling upgrade, a TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. code already displayed may be rejected for up to 33 seconds — upgrade all web UI replicas simultaneously to minimise the window. TOTP encryption keys must remain available to every replica as before.
21. docs update Sep 21, 2026 · issue 081
    ⤢
    └──▷ USE IT
    Isolate the UI from Redis session storage without disabling Redis-backed bannishments and inter-instance reporting — useful when you want Redis for data sharing but local session handling.
    ini copy

    UI_USE_REDIS=no

    Stage a config change in the RAW editor without applying it yet — useful for preparing a value to activate in a single future save.
    📍# In the BunkerWeb web UI RAW editor: # 1. Open a service or global settings RAW editor. # 2. Place the cursor at the start of a KEY=value line. # 3. Press # to toggle the line into draft state (line becomes highlighted). # 4. Save — the value is stored but the effective config remains unchanged. # 5. Press Backspace on the draft line (or # again) to activate, then save to apply.
22. docs update Sep 21, 2026 · issue 081

    BunkerWeb: Adds a Pages supplémentaires → CrowdSec UI page showing connection status, local API connectivity, decision synchronisation, allowlist entries, and IP investigation with pre-filled addresses from Reports and Bans pages.

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Remove an active CrowdSec ban from the local API without touching BunkerWeb-local bans — useful when a decision was issued in error on a shared engine.
    copy

    $ curl -X DELETE https://bunkerweb.example.com/crowdsec/<connection_id>/decisions/<decision_id> \
      -H 'Authorization: Bearer <api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"scope": "ip", "value": "203.0.113.42", "decision_type": "ban"}'

    Investigate all active CrowdSec decisions for a suspicious IP, including matching alerts and retained BunkerWeb reports, to triage an incident.
    copy

    $ curl -s 'https://bunkerweb.example.com/crowdsec/<connection_id>/ips/203.0.113.42' \
      -H 'Authorization: Bearer <api_token>' | jq .

    Allow internal monitoring probes to skip the antibot challenge by presenting a shared secret header, without opening access to all traffic.
    ini copy

    ANTIBOT_IGNORE_HEADER_NAME_1=X-Internal-Token
    ANTIBOT_IGNORE_HEADER_VALUE_1=^my-secret-rotation-value$

23. docs update Sep 21, 2026 · issue 081

    BunkerWeb: The all-in-one upgrade script auto-detects install type, secrets, host ports, worker list, and Compose project name from .env, preventing accidental credential rotation or port changes on upgrade.

    └──▷ BREAKING ON UPGRADE

    • !Two-factor authentication replay protection is now stored in the shared database and only covers replicas running this version; during a mixed-version migration window an already-displayed TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. code may be rejected for up to 33 seconds.
24. docs update Sep 21, 2026 · issue 081
    ⤢
    └──▷ USE IT
    Isolate the UI's Redis dependency from the rest of BunkerWeb — useful when you want bans and reports shared via Redis but need the UI to run without it.
    env copy

    UI_USE_REDIS=no

    Prepare a config change in the RAW editor without applying it yet — stage it as a draft and activate it in a later save when ready.
    📍In the RAW editor, place the cursor at the start of a KEY=value line and press # to toggle it to draft state. The line is highlighted and the value is stored but not applied. Press Backspace on the drafted line to activate it, then save to apply.
25. docs update Sep 21, 2026 · issue 081
    ⤢ ⤢ ⤢
    └──▷ USE IT
    Allow a trusted internal service to bypass the antibot challenge by presenting a shared-secret header, while anchoring the regex so partial matches are rejected.
    env copy

    ANTIBOT_IGNORE_HEADER_NAME_1=X-Internal-Token
    ANTIBOT_IGNORE_HEADER_VALUE_1=^my-secret-token$

    Programmatically remove a specific CrowdSec ban on an IP address via the public API, useful in an automated remediation workflow.
    copy

    $ curl -s -X DELETE https://bunkerweb.example.com/api/crowdsec/<connection_id>/decisions/<decision_id> \
      -H 'Authorization: Bearer <api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"scope": "ip", "value": "198.51.100.42", "decision_type": "ban"}'

    Investigate a suspicious IP across all CrowdSec decisions, alerts, and retained BunkerWeb reports in one call.
    copy

    $ curl -s 'https://bunkerweb.example.com/api/crowdsec/<connection_id>/ips/198.51.100.42' \
      -H 'Authorization: Bearer <api_token>'

26. docs update Sep 21, 2026 · issue 081

    BunkerWeb 1.6.15 adds per-setting draft mode in the RAW editor, letting you toggle individual settings without losing their inherited defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Temporarily disable a setting in RAW mode without deleting it, so its inherited or default value applies while you keep the line for later activation.
    📍In the RAW mode editor, navigate to the start of a setting line and press # to mark it as draft. The line gains a muted # prefix and the inherited/default value takes effect. Press Backspace at the start of the line to reactivate it, then click Save to persist.
    • Adds per-setting draft mode in RAW mode: press # at the start of a setting line to toggle it to draft state (showing a muted # prefix), and press Backspace at the start to reactivate it; draft settings retain their inherited or default value until activated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Draft settings are preserved when saving in Simple or Advanced mode, keeping editor metadata consistent across UI modes.

    2 details in Everything

27. v1.6.15 Sep 21, 2026 · issue 081

    BunkerWeb 1.6.15 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. to upstreams, per-header allow/block criteria, per-URL client size limits, and a syslog-ngsyslog-ngAn open-source log collector and router that ingests, filters, parses, and forwards log messages from many sources to many destinations, giving cyber tools a flexible, high-throughput pipeline for centralizing event data. UI log collector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.15 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.15

    └──▷ USE IT
    Disable Redis for the Web UI only — keeping global ban and report sharing intact — when the UI workers are hitting Redis connection limits.
    /etc/bunkerweb/variables.env copy

    UI_USE_REDIS=no

    Send ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. concurrent audit log entries to a dedicated path for ingestion by a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., rather than the default log location.
    /etc/bunkerweb/variables.env copy

    MODSECURITY_SEC_AUDIT_LOG=/var/log/bunkerweb/modsec_audit.log

    • Adds UI_USE_REDIS=no to disable Redis exclusively for the Web UI without disabling the global Redis-backed ban and report sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds MODSECURITY_SEC_AUDIT_LOG to configure the ModSecurity audit log path under /var/log/bunkerweb.
    • Adds per-URL REVERSE_PROXY_MAX_CLIENT_SIZE to control both request body size and the ModSecurity body-size limit on a per-location basis.
    • Supports presenting a client certificate to upstreams for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. in the reverseproxy and grpc plugins, with configurable upstream CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live., TLS protocols, and ciphers validated and distributed by the Scheduler.
    • Adds header-based matching to antibot, blacklist, whitelist, greylist, dnsbl, and country plugins — match on a request header name and optional PCRE value regex as an ignore or list criterion; header values are stored as password settings and are never logged or cached.

    +7 more show less

    • Expands the grpc plugin to match reverseproxy configurability, including client response headers, pass/ignore headers, underscores in headers, buffer and body-size controls, auth_request, and upstream TLS verification.
    • Adds CrowdSec IP investigation, allowlist inspection, and decision removal through the Web UI and API, with richer report details and on-page allowlist guidance.
    • Adds opt-in concurrent audit logging for ModSecurity with instance-side storage validation.
    • Adds install-bunkerweb.sh --docker upgrade capability for Docker stacks previously generated by the installer, backing up the database and preserving secrets, ports, and Compose edits while refusing downgrades.
    • Adds logrotate integration for the all-in-one image; mount /etc/logrotate.d/bunkerweb to provide a custom rotation policy.
    • Adds destroyed-session rejection on next use, locally or cluster-wide when Redis is enabled.
    • Allows individual settings to remain as drafts in the RAW editor, with explicit activation and inherited/default effective values.
    • Adds UI_USE_REDIS=no to disable Redis exclusively for the Web UI without disabling the global Redis-backed ban and report sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds MODSECURITY_SEC_AUDIT_LOG to configure the ModSecurity audit log path under /var/log/bunkerweb.
    • Adds per-URL REVERSE_PROXY_MAX_CLIENT_SIZE to control both request body size and the ModSecurity body-size limit on a per-location basis.
    • Supports presenting a client certificate to upstreams for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. in the reverseproxy and grpc plugins, with configurable upstream CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live., TLS protocols, and ciphers validated and distributed by the Scheduler.
    • Adds header-based matching to antibot, blacklist, whitelist, greylist, dnsbl, and country plugins — match on a request header name and optional PCRE value regex as an ignore or list criterion; header values are stored as password settings and are never logged or cached.

    +5 more show less

    • Adds opt-in concurrent audit logging for ModSecurity with instance-side storage validation.
    • Adds install-bunkerweb.sh --docker upgrade capability for Docker stacks previously generated by the installer, backing up the database and preserving secrets, ports, and Compose edits while refusing downgrades.
    • Adds logrotate integration for the all-in-one image; mount /etc/logrotate.d/bunkerweb to provide a custom rotation policy.
    • Adds destroyed-session rejection on next use, locally or cluster-wide when Redis is enabled.
    • Allows individual settings to remain as drafts in the RAW editor, with explicit activation and inherited/default effective values.

    2 more in Everything

28. docs update Aug 22, 2026 · issue 053

    BunkerWeb 1.6.14 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. CA bundle and CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. distribution via scheduler, plus Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. Client Hints controls

    ⤢ ⤢ ⤢
    └──▷ USE IT
    Supply a client CA bundle inline so the scheduler distributes it to all instances without mounting files into each container.
    yaml copy

    MTLS_CA_CERTIFICATE_DATA: "<base64-or-PEM-encoded-CA-bundle>"
    MTLS_CRL_DATA: "<base64-or-PEM-encoded-CRL>"

    Re-allow device-pixel-ratio Client Hints after the new default Permissions-Policy blocks all ch-* directives, so responsive-image pipelines keep working.
    yaml copy

    PERMISSIONS_POLICY: "accelerometer=(), ..., ch-dpr=(self)"

    • Adds MTLS_CA_CERTIFICATE_DATA config key to supply trusted client CA bundle inline as base64 or PEM (e.g. via Web UI), eliminating per-instance file mounts.
    • Adds MTLS_CA_CERTIFICATE_PRIORITY config key to control priority of the client CA bundle source.
    • Adds MTLS_CRL_DATA config key to supply a PEM-encoded certificate revocation list inline as base64 or PEM, enabling revoked-certificate rejection without file mounts.
    • Adds MTLS_CRL_PRIORITY config key to control priority of the client CRL source.
    • Scheduler now validates, caches, and distributes CA bundles and CRLs to every BunkerWeb instance automatically on each job run — no per-instance volume mounts required; reference a PEM file readable by the scheduler or pass data inline.

    +3 more show less

    • Incoming X-SSL-* request headers from clients are now stripped on every site regardless of whether mTLS is enabled, under HTTP/1.1, HTTP/2, and HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer., preventing header spoofing (e.g. X-SSL-Client-Verify: SUCCESS).
    • Default Permissions-Policy now blocks Client Hints (ch-* directives); adjust the policy to re-allow specific ch-* features (e.g. ch-dpr=(self)) for services relying on Accept-CH or Sec-CH-Prefers-Color-Scheme.
    • Blocked-request report retention is documented as a rolling buffer: without Redis the cap is the buffer size multiplied by the number of NGINX workers per instance; with Redis the cap is a single shared limit. Reports are cleared on restart unless Redis is enabled and persistent; forward NGINX logs to a syslog server or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. for long-term retention.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default Permissions-Policy now blocks all ch-* (Client Hints) directives; services relying on Accept-CH or Sec-CH-Prefers-Color-Scheme will lose Client Hints support until the policy is adjusted to re-allow the required ch-* features.
    • !Incoming X-SSL-* headers are stripped before reaching the application on every site; setups behind an upstream proxy that sets these headers must capture the value in a server-http Nginx set directive (e.g. set $trusted_ssl_verify $http_x_ssl_client_verify) and re-inject it via REVERSE_PROXY_HEADERS — using proxy_set_header alone is insufficient because the header is already empty by the time it is evaluated.
    • !When mTLS is enabled and the scheduler cache at /var/cache/bunkerweb is not persistent, mTLS remains disabled after a scheduler restart until the first job run completes and redistributes the CA bundle; a persistent cache volume is required for strict enforcement across restarts.
29. docs update Aug 22, 2026 · issue 053

    BunkerWeb adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.-based 2FA for admin accounts with encrypted key storage and rotation support via TOTP_ENCRYPTION_KEYS.

    ⤢
    └──▷ USE IT
    Supply your own TOTP encryption key so 2FA enrollments survive container recreations even without a persistent volume.
    docker-compose.yml copy

    # TOTP_ENCRYPTION_KEYS must be exactly 43 characters (e.g. output of passlib generate_secret())
    TOTP_ENCRYPTION_KEYS: "aB3dEfGhIjKlMnOpQrStUvWxYz0123456789AbCdE"

    Rotate TOTP encryption keys while keeping existing 2FA enrollments valid by supplying both the old and new key in a JSON map.
    docker-compose.yml copy

    TOTP_ENCRYPTION_KEYS: '{"new": "aB3dEfGhIjKlMnOpQrStUvWxYz0123456789AbCdE", "old": "zY9xWvUtSrQpOnMlKjIhGfEdCbA9876543210ZyXw"}'

    • Adds TOTP-based two-factor authentication for admin and user accounts, with secrets stored encrypted in the database using keys persisted in /var/lib/bunkerweb/.totp_encryption_keys.json.
    • Introduces the TOTP_ENCRYPTION_KEYS environment variable (space-separated keys or JSON map, each key exactly 43 characters) to supply or rotate TOTP encryption keys without relying on auto-generated ones.
    • Supports TOTP encryption key rotation via a JSON map value in TOTP_ENCRYPTION_KEYS: old keys remain alongside the new one so existing 2FA enrollments stay valid.
    • Persisting the /data volume in the BunkerWeb UI container preserves TOTP encryption keys, Biscuit keys, and the Flask secret across container recreations, making TOTP_ENCRYPTION_KEYS optional.
    • At startup the UI resolves TOTP keys from the first available source: /var/lib/bunkerweb/.totp_encryption_keys.json, then TOTP_ENCRYPTION_KEYS; if neither is usable a new random set is generated and all existing 2FA enrollments are invalidated.

    5 details in Everything

30. docs update Aug 22, 2026 · issue 053

    BunkerWeb 1.6.14 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. CA bundle and CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. distribution via Scheduler, client-hint blocking controls, and hardened X-SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.-* header stripping.

    ⤢ ⤢ ⤢
    └──▷ USE IT
    Supply a mTLS client CA bundle and CRL entirely inline to the Scheduler so no volume mounts are needed on BunkerWeb instances.
    env copy

    MTLS_CA_CERTIFICATE_DATA=<base64-or-pem-bundle>
    MTLS_CRL_DATA=<base64-or-pem-crl>

    Re-allow a specific client hint after the new default blocks all ch-* directives, so adaptive-image services continue to receive DPR information.
    text copy

    # In your BunkerWeb service environment or UI, append to Permissions-Policy:
    ch-dpr=(self)

    • Adds MTLS_CA_CERTIFICATE_DATA to supply the mTLS client CA bundle directly as base64 or PEM inline (e.g. via the web UI), without mounting files into BunkerWeb containers.
    • Adds MTLS_CA_CERTIFICATE_PRIORITY to control the source priority of the client CA bundle (file path vs. inline data).
    • Adds MTLS_CRL_DATA to supply a PEM-encoded certificate revocation list inline as base64 or PEM, enabling BunkerWeb to reject revoked client certificates.
    • Adds MTLS_CRL_PRIORITY to control the source priority of the client CRL (file path vs. inline data).
    • Scheduler now validates, caches under /var/cache/bunkerweb, and distributes CA bundles and CRLs to every BunkerWeb instance automatically on each job run — no per-instance file mounts required.

    +3 more show less

    • Strips all inbound X-SSL-* request headers on every site (HTTP/1.1, HTTP/2, HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer.), whether mTLS is enabled or not, so downstream apps cannot receive spoofed client-certificate metadata.
    • Permissions Policy default now blocks client-hint directives (ch-*); services that rely on Accept-CH (e.g. Sec-CH-Prefers-Color-Scheme) can re-allow specific hints such as ch-dpr=(self) via the Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. configuration.
    • Blocked-request reports use a circular buffer capped at a configurable limit per NGINX worker (without Redis) or a global cap (with Redis); reports are cleared on restart unless Redis persistence is enabled — exports to syslog or a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. are recommended for long-term retention.

    8 details in Everything

31. docs update Aug 22, 2026 · issue 053

    BunkerWeb 1.6.14 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.-based 2FA with encrypted secrets, Biscuit keys, and server-side sessions pinned to IP and User-Agent.

    ⤢
    └──▷ USE IT
    Persist TOTP encryption keys and Biscuit keys across container recreations by mounting a volume on /data in the UI service.
    docker-compose.yml copy

    services:
      bw-ui:
        image: bunkerity/bunkerweb-ui:1.6.14
        volumes:
          - bw-ui-data:/data   # persists Flask secret, TOTP encryption keys, and Biscuit keys
    
    volumes:
      bw-ui-data:

    • Adds TOTP-based two-factor authentication for admin accounts; secrets are stored encrypted in the database with keys kept in /var/lib/bunkerweb/.totp_encryption_keys.json.
    • Introduces TOTP_ENCRYPTION_KEYS environment variable (space-separated keys or a JSON map, each key exactly 43 characters) to supply or rotate your own TOTP encryption keys instead of relying on auto-generated ones.
    • Persists Flask secret, Biscuit keys, and TOTP encryption keys by mounting a volume on /data in the bunkerweb-ui container (symlinked to /data/lib), surviving container recreation.
    • Implements server-side sessions pinned to client IP and User-Agent, with a default idle lifetime of 12 hours and a hard cap of 7 days.
    • Session cookies can be made permanent (surviving browser restarts) without issuing a separate long-lived token; sessions remain bound by the idle and hard-cap limits and are revoked immediately on logout, password change, or Wipe other sessions.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Recreating the bunkerweb-ui container without a persistent volume on /data wipes TOTP encryption keys; every user loses their 2FA enrollment and must re-enroll.
    • !Setting TOTP_ENCRYPTION_KEYS to an invalid value (e.g. fewer than 43 characters, such as the placeholder changeme) causes the key to be discarded and replaced by a random one, leaving 2FA unusable until the variable is cleared manually — unlike leaving the variable unset, this also prevents the admin enrollment from being reset automatically.
32. docs update Aug 22, 2026 · issue 053

    BunkerWeb 1.6.14 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client certificate support with centralized CA/CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. distribution and Redis-backed metrics sync.

    ⤢ ⤢ ⤢
    └──▷ USE IT
    Enable mTLS by pointing the Scheduler at a CA bundle file and a CRL — no per-instance mounting needed.
    env copy

    MTLS_CA_CERTIFICATE_PRIORITY=file
    MTLS_CA_CERTIFICATE_DATA=
    MTLS_CRL_PRIORITY=file
    MTLS_CRL_DATA=

    Supply the CA bundle and CRL inline (e.g. in a containerised deployment where file mounts are inconvenient).
    env copy

    MTLS_CA_CERTIFICATE_PRIORITY=data
    MTLS_CA_CERTIFICATE_DATA=<base64-or-PEM-bundle>
    MTLS_CRL_PRIORITY=data
    MTLS_CRL_DATA=<base64-or-PEM-crl>

    Set Redis metrics TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. to 30 days so inactive blocked-request data ages out automatically while active data stays live.
    env copy

    METRICS_REDIS_TTL=2592000

    • Adds MTLS_CA_CERTIFICATE_PRIORITY config key to control the source of the client CA bundle (file path vs. inline data), with MTLS_CA_CERTIFICATE_DATA for supplying the trusted CA bundle directly as base64 or plaintext PEM (e.g. via the web UI).
    • Adds MTLS_CRL_PRIORITY and MTLS_CRL_DATA config keys to supply a PEM-encoded certificate revocation list (CRL) either as a file path or inline base64/PEM data, enabling BunkerWeb to deny revoked client certificates.
    • Scheduler validates, caches, and distributes CA bundles and CRLs to every BunkerWeb instance automatically — no per-instance file mounting required; updates are picked up on the next job run.
    • Inbound X-SSL-* headers are stripped on all requests (HTTP/1.1, HTTP/2, HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer.) across every site regardless of mTLS state, preventing clients from spoofing values such as X-SSL-Client-Verify: SUCCESS; only values derived from the verified TLS handshake are forwarded.
    • Adds METRICS_REDIS_TTL config key (default 2592000 seconds) to control expiry of Redis metrics keys, with active keys refreshed each sync so abandoned data becomes evictable under memory pressure.

    +2 more show less

    • Metrics plugin now synchronizes blocked-request data to Redis, providing a centralized view of security events across multiple BunkerWeb instances; new reports are buffered per-worker and synced once Redis memory frees to avoid data loss.
    • Extends Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. to also block client hints (ch-* directives); services relying on Accept-CH (e.g. Sec-CH-Prefers-Color-Scheme for dark-mode detection) must explicitly re-allow the needed ch-* features (e.g. ch-dpr=(self)).

    7 details in Everything

33. v1.6.14 Aug 21, 2026 · issue 053

    BunkerWeb 1.6.14 adds per-service CrowdSec multisite settings, a certificate validator in the UI, and new metrics/policy controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.14 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.14

    └──▷ TRY IT
    Run the all-in-one container in an air-gapped environment where CrowdSec must not call home to the Central API.
    copy

    $ docker run -e DISABLE_ONLINE_API=true bunkerity/bunkerweb-all-in-one:1.6.14

    • Makes every CROWDSEC_* setting multisite, so individual services can point at different Local API or AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. endpoints; set CROWDSEC_API to an empty string on a service to retain AppSec inspection without the decision lookup.
    • Adds METRICS_REDIS_TTL setting to control TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. for metrics stored in Redis, alongside atomic list and facet updates and buffering during Redis OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. events.
    • Adds DISABLE_ONLINE_API environment variable to the all-in-one image (matching the official CrowdSec image name) to run CrowdSec without registering to the Central API.
    • Adds a Validate certificate button on the custom certificate settings page in the UI, checking a pasted or uploaded key pair for mismatches, encrypted keys, expiry, and missing server name coverage before the service is saved.
    • Denies Chrome built-in AI APIs in the default PERMISSIONS_POLICY header value.

    +2 more show less

    • Allows the QUERY HTTP method by default in ALLOWED_METHODS and bundled service templates.
    • Honors the k/m suffix on METRICS_MAX_BLOCKED_REQUESTS_REDIS when bounding report reads.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !KEEP_CONFIG_ON_RESTART is no longer listed as a configurable setting in the web UI or database — it must be set in the environment or in /etc/bunkerweb/variables.env on Linux, as it is read by the entrypoint before the database is reachable.
    • !Existing remember me long-lived tokens are rejected and deleted on the next request; users relying on year-long browser persistence will be logged out and must re-authenticate. Extend SESSION_LIFETIME_HOURS and SESSION_ABSOLUTE_HOURS to replicate long-lived sessions.
    • !Biscuit tokens carrying more than a single block are now rejected by the API; any client that appended extra blocks to its tokens will have its requests refused.
34. advisory CVE-2026-75514 Jul 16, 2026 · issue 128
    • CVE-2026-75514: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, whitelist and antibot (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects < 1.6.13)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
35. v1.6.13 Jul 16, 2026 · issue 018

    BunkerWeb v1.6.13 adds global rate limiting, per-URI country check bypass, and post-challenge redirect control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.13 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.13

    └──▷ USE IT
    Protect a backend from being overwhelmed by capping total inbound requests across all clients before per-IP limits are evaluated.
    ini copy

    USE_LIMIT_REQ_GLOBAL=yes
    LIMIT_REQ_GLOBAL_RATE=500r/s

    Exempt health-check and metrics endpoints from country-based blocking so monitoring systems in blocked regions still reach them.
    ini copy

    COUNTRY_IGNORE_URI=/health /metrics\?.*

    Send users to a welcome page after passing an antibot challenge instead of replaying their original (potentially POST) request.
    ini copy

    ANTIBOT_SUCCESS_URI=/welcome

    • Adds USE_LIMIT_REQ_GLOBAL and LIMIT_REQ_GLOBAL_RATE settings to cap the total aggregate request rate for a service across all clients and URLs, evaluated before per-IP and per-URL limits.
    • Adds COUNTRY_IGNORE_URI to skip country whitelist and blacklist checks for URIs matching a list of PCRE expressions, matched against both the request path and the full URI including query string.
    • Adds ANTIBOT_SUCCESS_URI to redirect clients to a fixed URI after successfully completing a challenge, rather than returning them to the originally requested page.

    3 details in Everything

36. advisory CVE-2026-54728 Jul 8, 2026 · issue 128
    • CVE-2026-54728: Authenticated privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. via Host header handling in BunkerWeb UI and API (affects < 1.6.12)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
37. advisory CVE-2026-61718 Jul 8, 2026 · issue 128
    • CVE-2026-61718: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects >= 1.6.2, < 1.6.12)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
38. v1.6.12 Jul 2, 2026 · issue 007

    BunkerWeb v1.6.12 adds upstream TLS verification, per-path mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with., a full logs viewer overhaul, and tightened API token security.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.12 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.12

    └──▷ USE IT
    Enforce TLS verification when BunkerWeb proxies to an internal HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. backend, supplying a custom CA bundle.
    ini copy

    REVERSE_PROXY_SSL_VERIFY=yes
    REVERSE_PROXY_SSL_VERIFY_DEPTH=2
    REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE=/etc/bunkerweb/certs/internal-ca.pem

    Require mTLS only on sensitive API paths while leaving public endpoints unaffected.
    ini copy

    MTLS_URL_1=^/api/admin.*

    Cap scheduler thread-pool workers to limit database connection pressure in high-traffic deployments.
    ini copy

    SCHEDULER_MAX_WORKERS=4

    • Adds upstream HTTPS certificate verification for reverse proxy via REVERSE_PROXY_SSL_VERIFY, REVERSE_PROXY_SSL_VERIFY_DEPTH, REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE, REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_DATA, and REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_PRIORITY settings.
    • Adds MTLS_URL_n regex setting to enforce mTLS selectively per path rather than site-wide.
    • Adds SCHEDULER_MAX_WORKERS to cap the job-executor thread pool and reduce database pool pressure under load.
    • Extends ANTIBOT_IGNORE_URI to match full request URIs including query strings.
    • Supports pre-hashed bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. values for ADMIN_PASSWORD, enabling secret-manager and GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. workflows.

    +7 more show less

    • Hardens Biscuit API token generation by binding Host header, client IP, and username as typed terms; adds optional API_ALLOWED_HOSTS allowlist.
    • Adds API_ACL_BOOTSTRAP_FILE bcrypt hash validation, rejecting weak or malformed values on startup.
    • Overhauls the UI logs viewer with syntax highlighting, severity filters with counts, in-page search, live-tail with pause, download/copy actions, local-time display, and collapsible multi-line entries.
    • Adds fold support for multi-line file settings (e.g., PEM certificates and keys) in the RAW config editor.
    • Improves BunkerNet UI status reporting with Connected / API unreachable / Not registered states, masked instance ID, and disk self-heal.
    • Adds Ubuntu 26.04 Resolute Raccoon as a supported Linux package target.
    • Updates ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. to 3.0.16 and Core Rule Set to 4.27.0.

    12 details in Everything

39. v1.6.10 May 19, 2026 · release notes

    BunkerWeb 1.6.10 adds per-backend HTTP version control, cross-subdomain session sharing, modern TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. installer, and new UI bulk-action controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.10 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.10

    └──▷ USE IT
    Route a specific backend over HTTP/2 while keeping other upstreams on HTTP/1.1 — useful for gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. or h2-capable origin servers.
    yaml copy

    REVERSE_PROXY_URL=/api
    REVERSE_PROXY_HOST=https://backend-h2.internal
    REVERSE_PROXY_HTTP_VERSION=2

    Share antibot challenge state across subdomains so users aren't re-challenged when moving between app.example.com and api.example.com.
    yaml copy

    SESSIONS_DOMAIN=.example.com

    Run the installer with the modern TUI prompts and pre-specify the server IP to skip the interactive IP selection menu.
    copy

    $ sudo ./install.sh --tui --server-ip 203.0.113.42

    • Adds MAX_HEADERS setting (default 100) to cap the number of request header lines accepted.
    • Adds per-backend REVERSE_PROXY_HTTP_VERSION supporting 1.0, 1.1, and 2, overriding the global default per upstream.
    • Adds SESSIONS_DOMAIN multisite setting to share antibot/challenge session state across sibling subdomains.
    • Adds Web UI session lifecycle controls: SESSION_LIFETIME_HOURS (sliding idle TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.), SESSION_ABSOLUTE_HOURS (hard cap), and SESSION_ROLLING_HOURS (periodic session ID regeneration).
    • Adds LETS_ENCRYPT_MAX_LOG_BACKUPS (default 50) to cap certbot log rotation.

    +10 more show less

    • Adds modern inline TUI installer prompts via gum, with fallback to whiptail then plain read; controlled by --tui, --no-tui, and BW_INSTALL_TUI.
    • Adds --server-ip <IP> flag and SERVER_IP_INPUT to the installer; interactive installs present a menu when multiple IPv4s are detected.
    • Supports k/m shorthand suffixes for metrics and datastore size settings, plus g/G for shared memory size settings.
    • Allows custom uppercase HTTP methods containing underscores and dashes in ALLOWED_METHODS.
    • Updates default Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header to include local-network, local-network-access, and loopback-network directives.
    • Adds 18 missing single-column database indexes, improving query performance for large deployments.
    • Adds opt-in Select all N matching banner in UI list pages for bulk actions across pages.
    • Adds import/export for custom configurations in the UI, including optional .zip bundles attached to service exports.
    • CSV/Excel exports on Reports and Bans pages now include every column and honor active search and SearchPanes filters.
    • Bundled ui and api templates now enable REVERSE_PROXY_KEEPALIVE=yes by default.

    15 details in Everything

40. v1.6.9 Mar 13, 2026 · release notes

    BunkerWeb v1.6.9 adds a gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. proxy plugin, ZeroSSL CA support, three new DNS providers, country group filtering, and new NGINX timeout controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.9 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.9

    └──▷ USE IT
    Tune database connection pooling for high-traffic deployments to improve scheduler resilience under load.
    yaml copy

    DATABASE_POOL_SIZE=20
    DATABASE_POOL_MAX_OVERFLOW=10
    DATABASE_POOL_TIMEOUT=30
    DATABASE_POOL_RECYCLE=1800
    DATABASE_POOL_PRE_PING=yes
    DATABASE_REQUEST_RETRY_ATTEMPTS=5
    DATABASE_REQUEST_RETRY_DELAY=2

    • New gRPC plugin enables proxying of gRPC traffic to upstream services with TLS, SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address., custom headers, and retry policy support.
    • Let's Encrypt plugin now supports selecting between Let's Encrypt and ZeroSSL as the certificate authority, including ZeroSSL-specific settings.
    • Adds Gandi, Hetzner, and ClouDNS as DNS providers in the Let's Encrypt plugin.
    • Country plugin gains the ability to whitelist or blacklist groups of countries, not just individual countries.
    • New CLIENT_BODY_TIMEOUT, CLIENT_HEADER_TIMEOUT, KEEPALIVE_TIMEOUT, and SEND_TIMEOUT settings expose NGINX timeout controls for long-lived connections.

    +15 more show less

    • New file setting type lets users upload files directly from the Web UI and use their content as setting values.
    • Adds MAX_REQUESTS setting (with UI_MAX_REQUESTS / API_MAX_REQUESTS overrides) to configure Gunicorn worker max requests before restart.
    • Adds MAX_CONTENT_LENGTH setting to the Web UI to configure the maximum upload size (defaults to 50 MB).
    • Sensitive field values in the Let's Encrypt plugin are now redacted from logs and process arguments (except at TRACE level).
    • HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate./STREAM/TLS ports can now be left empty to disable listening on those ports.
    • Global settings UI gains an override non-global services functionality.
    • Web UI now supports editing settings via the wizard method.
    • Adds DATABASE_POOL_SIZE, DATABASE_POOL_MAX_OVERFLOW, DATABASE_POOL_TIMEOUT, DATABASE_POOL_RECYCLE, DATABASE_POOL_PRE_PING, DATABASE_POOL_RESET_ON_RETURN, DATABASE_RETRY_TIMEOUT, DATABASE_REQUEST_RETRY_ATTEMPTS, and DATABASE_REQUEST_RETRY_DELAY settings for fine-grained database connection pool tuning.
    • Autoconf adds experimental support for GRPCRoute in the Kubernetes Gateway API integration.
    • CUSTOM_SSL_CERT_DATA and CUSTOM_SSL_KEY_DATA settings are now of type file, allowing direct certificate and key upload from the Web UI.
    • Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header default value updated to include the gamepad feature.
    • Home dashboard enhanced with new IP blocking metrics and improved tooltips.
    • Reports page gains improved filter handling and data fetching.
    • CrowdSec updated to version 1.7.6 in the all-in-one image.
    • NGINX updated to v1.28.2 for Fedora 42 and 43.

    20 details in Everything

41. v1.6.8 Feb 13, 2026 · release notes

    BunkerWeb v1.6.8 adds concurrent Let's Encrypt cert generation, three new DNS providers, Gateway API support, and services import with drag-and-drop.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.8 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.8

    └──▷ USE IT
    Enable concurrent Let's Encrypt certificate generation across all services to cut provisioning time on multi-site deployments.
    yaml copy

    LETS_ENCRYPT_CONCURRENT_REQUESTS=yes

    Preserve the running nginx config across scheduler restarts to avoid a temporary-config gap during maintenance windows.
    yaml copy

    KEEP_CONFIG_ON_RESTART=yes

    Disable request body buffering on a reverse-proxy service to stream large uploads directly to the upstream without holding them in memory.
    yaml copy

    REVERSE_PROXY_REQUEST_BUFFERING=off

    • New REVERSE_PROXY_REQUEST_BUFFERING setting in the Reverse Proxy plugin lets operators control whether request bodies are buffered before proxying (default: on).
    • New LETS_ENCRYPT_CONCURRENT_REQUESTS setting enables parallel certificate generation across multiple services, speeding up multi-site Let's Encrypt provisioning (default: no).
    • Adds GoDaddy, TransIP, and Domeneshop as DNS challenge providers in the Let's Encrypt plugin.
    • New global KEEP_CONFIG_ON_RESTART setting preserves the existing nginx configuration across restarts instead of regenerating a temporary one each time (default: no).
    • Templator engine refactored to use Jinja2, unlocking richer templating capabilities for custom configurations.

    +9 more show less

    • Experimental Kubernetes Gateway API controller support added (Gateway/HTTPRoute resources) for Autoconf deployments.
    • API now supports HTTP/2 in Gunicorn for improved performance and protocol compatibility.
    • CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. annotation support added for FORWARDED_ALLOW_IPS and PROXY_ALLOW_IPS settings; defaults updated to cover common private network ranges.
    • Web UI services table now displays security mode per service at a glance.
    • Web UI gains services import functionality with drag-and-drop support.
    • Redis report querying in the UI enhanced with filter parsing and chunked retrieval for large datasets.
    • Easy Install script gains an option to automatically install a Redis server for data persistence and caching.
    • DuggyTuxy Data-Shield IPv4 Blocklist added to the built-in blacklist sources.
    • NGINX updated to v1.28.2 and Core Rule Set updated to v4.23.0 (CRSv3 to v3.3.8).

    14 details in Everything

42. v1.6.7 Jan 9, 2026 · release notes

    BunkerWeb v1.6.7 adds post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. TLS prep, syslog support, draft configs, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. UI, and granular plugin ordering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.7 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.7

    └──▷ USE IT
    Enable syslog output alongside existing log handlers so a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. can ingest BunkerWeb events in real time.
    yaml copy

    ACCESS_LOG=syslog:server=192.168.1.10:514
    ERROR_LOG=syslog:server=192.168.1.10:514

    Control SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. session cache size to tune TLS performance for high-traffic deployments.
    yaml copy

    SSL_SESSION_CACHE_SIZE=20m

    Create a draft custom configuration in the UI so changes are reviewed before going live.
    📍In the web UI, go to Custom Configurations, create or edit a configuration, and save it as Draft. Toggle it to Online only when ready to publish.
    • Adds dynamic ECDH curve resolution for SSL/TLS negotiation, enabling post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. readiness (X25519MLKEM768) with OpenSSL 3.5+.
    • Optimizes Redis connection handling by reusing pooled connections in Lua timers for reduced overhead.
    • Enables sending logs to a syslog server with support for multiple log handlers simultaneously.
    • New LETS_ENCRYPT_DNS_CREDENTIAL_DECODE_BASE64 setting controls whether Base64 decoding is applied to DNS credentials in the Let's Encrypt plugin.
    • New ACCESS_LOG and ERROR_LOG settings allow configuring access and error log destinations per BunkerWeb instance.

    +15 more show less

    • Upgrades Auth Basic plugin: credentials are now hashed with salted scryptscryptA password-hashing function that requires substantial memory for each guess, making large-scale password cracking more expensive. (CSPRNGCSPRNGA cryptographically secure pseudorandom number generator — an algorithm that produces unpredictable output suitable for secrets like keys and tokens, where a standard PRNG's statistical randomness alone would be exploitable.) and verified in constant time.
    • Updates Bad Behavior plugin to apply default-server bans globally across all services automatically.
    • Adds draft mode for custom configurations — changes are not applied until explicitly published, with draft/online toggle in the web UI.
    • New SSL_SESSION_CACHE_SIZE setting configures SSL session cache size (e.g., 10m, 512k, or off/none to disable).
    • Enhances Antibot plugin to redirect users back to the original request path after a successful challenge using the Referer header.
    • Allows manual editing of custom configurations created via the web UI or API.
    • New PLUGINS_ORDER_* settings allow customizing plugin execution order per phase, with multisite support.
    • Adds HTTPS support directly to the web UI via certificate and key configuration, eliminating the need for a reverse proxy.
    • Enhances UI session management with Redis backend support and configurable session lifetime.
    • Refactors API rate limiting to be configurable via settings.
    • Updates CrowdSec integration to version 1.7.4 in the all-in-one image.
    • Adds Linux package support for Fedora 43.
    • Updates NGINX to v1.28.1 across all integrations.
    • Updates Core Rule Set to v4.21.0.
    • New KUBERNETES_REVERSE_PROXY_SUFFIX_START setting makes Ingress controller reverse proxy indexing configurable (default 1).

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Fedora 41 is no longer supported; upgrade to Fedora 42 or 43 before deploying v1.6.7 Linux packages.
43. v1.6.6 Nov 24, 2025 · release notes

    BunkerWeb v1.6.6 adds mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. plugin, DuckDNS/PowerDNS Let's Encrypt providers, country-based antibot controls, and a new API service template.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.6 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.6

    └──▷ USE IT
    Restrict antibot challenges to visitors from specific high-risk countries while letting known-safe countries through without a challenge.
    yaml copy

    ANTIBOT_ONLY_COUNTRY=CN RU
    ANTIBOT_IGNORE_COUNTRY=US GB DE

    Harden Auth Basic by increasing bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. rounds beyond the default for sensitive admin endpoints.
    yaml copy

    USE_AUTH_BASIC=yes
    AUTH_BASIC_ROUNDS=800000

    • New mtls plugin adds mutual TLS client certificate authentication with configurable verification modes, chain depth control, and optional header forwarding for downstream authorization.
    • Adds ANTIBOT_IGNORE_COUNTRY and ANTIBOT_ONLY_COUNTRY settings to the Antibot plugin for country-based challenge bypassing or enforcement.
    • Adds AUTH_BASIC_ROUNDS setting to the authbasic plugin to tune bcrypt password hashing strength (default: 656000, range: 1000–999999999).
    • Switches Auth Basic password hashing to bcrypt for improved security.
    • Adds a new API template to quickly protect an API service using BunkerWeb.

    +17 more show less

    • Starts monitoring HTTP 405 and 400 status codes, surfacing them on the reports page.
    • IP whitelisting checks added to the badbehavior module to prevent banning whitelisted IPs; whitelisted IPs are served the default page even when the default server is deactivated.
    • Let's Encrypt mail handling now validates the configured email, warns if missing or invalid, and automatically adds --register-unsafely-without-email to Certbot when no valid email is present.
    • Adds METRICS_MEMORY_MAX_RETRIES setting to retry metric operations on memory failure.
    • Enables editing of API settings in the web UI and UI settings via the API.
    • UI gains a RAW mode for editing and creating templates, with disabled-settings highlighting and Ctrl+S / Command+S save shortcuts.
    • Reports page export now uses server-side chunked processing for improved performance on large datasets.
    • Adds DB-IP attribution to the web UI reports page footer.
    • DataTable state saving is now automatically enabled across the UI.
    • Autoconf adds event debouncing in Docker, Ingress, and Swarm controllers for improved configuration management.
    • Kubernetes integration gains an annotation to ignore specific services in Autoconf.
    • Kubernetes ConfigMaps of type settings can now be applied to services more easily.
    • Updates MODSECURITY_REQ_BODY_NO_FILES_LIMIT regex to support human-readable size values.
    • Updates the default Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header to include private-state-token-issuance and private-state-token-redemption.
    • Linux Easy Install script enhanced with manager and worker mode configurations.
    • Adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.7 and RHEL 10.1 package support.
    • Per-plugin commit option added to the plugin update process with improved error handling.

    22 details in Everything

44. 1.6.6-rc2 Prerelease Nov 5, 2025 · release notes

    BunkerWeb 1.6.6-rc2 adds mtls plugin, DuckDNS provider, API template, and ANTIBOT country filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.6-rc2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.6-rc2

    • AUTH_BASIC_ROUNDS config key added to the authbasic plugin to set password hashing strength (default: 656000, range: 1000-999999999)
    • ANTIBOT_IGNORE_COUNTRY and ANTIBOT_ONLY_COUNTRY settings added to the Antibot plugin for country-based challenge prompting/bypassing
    • New mtls plugin introduced for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client certificate authentication with configurable verification modes and chain depth control
    • New letsencrypt plugin now supports DuckDNS as a DNS provider

    4 details in Everything

45. 1.6.6-rc1 Prerelease Oct 31, 2025 · release notes

    Adds per-plugin commit options, API/UI settings bidirectional edit, and RAW mode template editing shortcuts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.6-rc1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.6-rc1

    • Adds METRICS_MEMORY_MAX_RETRIES to control retry operations for metrics linked to memory failures
    • Enables edition of API settings directly in the web UI and UI settings via the API
    • Adds RAW mode for editing/creating templates with Ctrl+S / Command+S save shortcuts

    3 details in Everything

46. v1.6.5 Oct 6, 2025 · release notes

    BunkerWeb v1.6.5 adds a REST control-plane API, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. for internal API, token auth, reCAPTCHA v3 support, and a new Templates management UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.5 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.5

    └──▷ USE IT
    Limit how long idle UI user sessions persist in the database, reducing stale-session exposure.
    yaml copy

    DATABASE_MAX_SESSION_AGE_DAYS=7

    Create and apply a reusable service template from the new Templates management page so new services inherit a consistent baseline configuration.
    📍In the UI, go to Templates › New Template, define your settings, save, then when creating or editing a service select the template from the Template column in the Services page.
    • Introduces a dedicated control-plane service exposing a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to programmatically list/register instances, trigger reload/stop, and manage bans, plugins, jobs, and configurations.
    • Adds HTTPS support for BunkerWeb's internal API.
    • Adds optional API token authentication for BunkerWeb API calls to enable token-based access control.
    • Adds reason data for bad behavior bans and reports.
    • Adds session retention configuration via the DATABASE_MAX_SESSION_AGE_DAYS setting in the Database plugin, with an automatic cleanup job to purge old UI user sessions.

    +10 more show less

    • Adds support for the new reCAPTCHA version in the Antibot plugin.
    • Adds the ability to ignore IPs in the DNSBL plugin.
    • Introduces a Templates management page in the UI to create, edit, clone, and delete service templates.
    • Adds a new Template column in the services page showing which template a service is based on, with filtering support.
    • Adds the ability to quickly ban IP addresses directly from the reports page.
    • Introduces a reloading health status for BunkerWeb when NGINX is reloading.
    • Updates the default Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header value to include additional features and remove deprecated ones.
    • Updates CoreRuleSet to v4.19.0.
    • All-in-One image updates CrowdSec to v1.7.0 and adds support for disabling specific CrowdSec parsers.
    • Adds upgrade capability to the easy-install script for seamless in-place Linux package updates.

    15 details in Everything

47. 1.6.5-rc3 Prerelease Sep 16, 2025 · release notes

    BunkerWeb 1.6.5-rc3 adds API token auth, DNSBL IP ignores, UI ban and health status features.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.5-rc3 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.5-rc3

    • Adds optional API token authentication via BUNKERWEB_API_TOKEN env var to control access to BunkerWeb API calls
    • Adds IGNORE_IPS configuration option in the DNSBL plugin to exclude specific IPs from DNS blacklisting checks
    • Enables quick banning of IP addresses directly from the reports page in the UI
    • Introduces a new reloading health status for BunkerWeb and NGINX during restart cycles

    4 details in Everything

48. 1.6.5-rc2 Prerelease Sep 11, 2025 · release notes

    Adds CrowdSec parser disabling, reCAPTCHA support in Antibot plugin

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.5-rc2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.5-rc2

    • Add parsers configuration key to disable specific CrowdSec parsers
    • Add new reCAPTCHA version support in the Antibot plugin

    2 details in Everything

49. 1.6.5-rc1 Prerelease Aug 30, 2025 · release notes

    v1.6.5-rc1 adds in-place upgrade support via easy-install script and UI promo/update controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.5-rc1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.5-rc1

    └──▷ TRY IT
    Upgrade BunkerWeb in-place using the provided script.
    copy

    $ ./easy-install.sh upgrade

    Force download PRO plugins directly from the UI without update checks.
    📍Click Force update on the PRO page in the web console.
    • Adds upgrade capability to the easy-install script for seamless in-place updates
    • Add Force update button on PRO page to force the download of PRO plugins without checking for updates
    • Enhance update-check job to utilize cached GitHub release data and improve error handling

    3 details in Everything

50. v1.6.4 Aug 18, 2025 · release notes

    BunkerWeb 1.6.4 adds human-readable size values for ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. request body limits and expands Linux platform support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.4 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.4

    • Enhances the ModSecurity plugin to accept human-readable size values (e.g., 10m, 512k) for request body limits on requests without files.
    • Adds Linux package support for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10.0.
    • Adds Linux package support for Debian 13 (Trixie).

    3 details in Everything

51. 1.6.3 Aug 5, 2025 · release notes

    BunkerWeb 1.6.3 adds multi-path Redirects, configurable antibot alphabet and split installation types

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.3 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.3

    └──▷ TRY IT
    Restrict antibot CAPTCHA characters to hexadecimal digits only.
    copy

    $ ANTIBOT_CAPTCHA_ALPHABET=0123456789ABCDEF

    • Redirect plugin now supports multiple source/destination paths for routing
    • ANTIBOT_CAPTCHA_ALPHABET environment variable allows custom character sets for CAPTCHAs

    2 details in Everything

52. 1.6.3-rc3 Prerelease Jul 30, 2025 · release notes

    BunkerWeb 1.6.3-rc3 adds custom robots.txt headers/footers and new DNS providers for Let's Encrypt

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.3-rc3 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.3-rc3

    • ROBOTSTXT_HEADER and ROBOTSTXT_FOOTER settings added to customize the robots.txt file content (Base64 encoded)
    • domainoffensive.de added as a supported DNS provider in the letsencrypt plugin
    • Dynu added as a supported DNS provider in the letsencrypt plugin

    3 details in Everything

53. 1.6.3-rc2 Prerelease Jul 29, 2025 · release notes

    BunkerWeb 1.6.3-rc2 adds PRO setup wizard steps, Linux CrowdSec auto-install, and TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. env var alias

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.3-rc2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.3-rc2

    └──▷ TRY IT
    Use the new env var alias when configuring BunkerWeb via environment variables.
    copy

    $ export TOTP_ENCRYPTION_KEYS='my_secret_key_here'

    • Add Advanced settings section to the setup wizard to configure SERVER_NAME and the Let's Encrypt plugin
    • Add TOTP_ENCRYPTION_KEYS as an alias for the TOTP_SECRETS environment variable
    • Add CrowdSec automatic installation/configuration in the easy-install script for Linux distributions

    3 details in Everything

54. 1.6.3-rc1 Prerelease Jul 19, 2025 · release notes

    Adds BunnyNet DNS provider support and new robotstxt plugin for automated robots.txt management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.3-rc1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.3-rc1

    • Add BunnyNet as a DNS provider in the letsencrypt plugin
    • Add new robotstxt plugin to manage the robots.txt file from settings and serve it

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Dropped support for Fedora 40 in this release.
55. v1.6.2 Jul 8, 2025 · release notes

    BunkerWeb v1.6.2 adds Redis-backed metrics, custom Let's Encrypt profiles, a UI healthcheck endpoint, and smarter download caching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.2

    └──▷ USE IT
    Enable the web UI healthcheck endpoint so your orchestrator (e.g., Docker, Kubernetes) can probe BunkerWeb's UI liveness.
    yaml copy

    ENABLE_HEALTHCHECK=yes

    • Implements Redis-backed metrics storage with optimized retrieval workflows for faster, more reliable performance.
    • Adds support for custom Let's Encrypt profiles and logs profile changes during renewal.
    • Adds an optional /healthcheck endpoint to the web UI for health monitoring, enabled via the ENABLE_HEALTHCHECK setting.
    • Refactors download scripts to canonicalize and deduplicate URLs before fetching, with smarter cache management.
    • Enhances logging to differentiate between allowed and denied access based on whitelist status.

    +5 more show less

    • Updates CrowdSec (All-in-One) to v1.6.9.
    • Updates CoreRuleSet to v4.16.0.
    • Adds Go Back button functionality on the unauthorized page.
    • Improves dynamic translation handling and updates chart rendering on theme and language changes.
    • Documents Valkey support alongside Redis for data persistence and caching.

    10 details in Everything

56. 1.6.2-rc7 Prerelease Jun 25, 2025 · release notes

    BunkerWeb 1.6.2-rc7 adds number and multivalue setting types for UI inputs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2-rc7 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2-rc7

    • Adds the number setting type to allow numeric validation in the web UI settings form

    1 detail in Everything

57. 1.6.2-rc5 Prerelease Jun 17, 2025 · release notes

    Adds LETS_ENCRYPT_PASSTHROUGH setting to Let's Encrypt plugin for upstream passthrough

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2-rc5 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2-rc5

58. 1.6.2-rc4 Prerelease Jun 12, 2025 · release notes

    BunkerWeb 1.6.2-rc4 adds multiselect setting type, community blacklist plugin, and header hiding for reverse proxy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2-rc4 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2-rc4

    • BLACKLIST_COMMUNITY_LISTS setting added to blacklist plugin for selecting community blocklists
    • REVERSE_PROXY_HIDE_HEADERS setting added to Reverse Proxy plugin to hide upstream HTTP headers
    • multiselect setting type introduced for choosing multiple options from a configurable list in plugins

    3 details in Everything

59. 1.6.2-rc3 Prerelease Jun 6, 2025 · release notes

    v1.6.2-rc3 adds LETS_ENCRYPT_MAX_RETRIES config, Docker secrets support, and CrowdSec/Redis integration in all-in-one image.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2-rc3 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2-rc3

    • Add LETS_ENCRYPT_MAX_RETRIES setting to the Let's Encrypt plugin to configure certificate retry count
    • Add clear notifications feature to both UI and backend for improved notification management
    • Improve plugin navigation by displaying plugins as a vertical list on the left side of the card
    • Display a small enabled/disabled icon next to each plugin name in the plugin sidebar
    • Update QR code generation to use PilImage and output JPEG format

    +7 more show less

    • Add a modal to update ban durations, with support for localization
    • Add system memory usage monitoring to the home page dashboard
    • Refactor the data display on the report page for a more user-friendly experience
    • Add quick actions for bans back
    • Enhance reset button visibility and tooltip handling across various settings templates
    • Add the possibility to delete cache files
    • Provide an interactive installer script for BunkerWeb that guides users through setup options

    12 details in Everything

60. 1.6.2-rc2 Prerelease May 19, 2025 · release notes

    BunkerWeb 1.6.2-rc2 adds LE profile options, IONOS DNS support, plaintext cert data, underscore header control, manual cert deletion, and UI multi-language.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2-rc2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2-rc2

    • Adds LETS_ENCRYPT_PROFILE setting to choose certificate generation profiles (classic, tlsserver, shortlived) in the Let's Encrypt plugin
    • Adds CUSTOM_SSL_CERT_DATA and CUSTOM_SSL_KEY_DATA settings to accept plaintext or base64-encoded custom certificate data in the customcert plugin
    • Adds IONOS as a supported DNS provider in the letsencrypt plugin
    • Adds REVERSE_PROXY_UNDERSCORES_IN_HEADERS setting (default no) to control underscore handling in the Reverse Proxy plugin
    • Adds LETS_ENCRYPT_CUSTOM_PROFILE setting to allow a custom profile for the Let's Encrypt plugin

    +4 more show less

    • Adds LETS_ENCRYPT_DISABLE_PUBLIC_SUFFIXES setting (default yes) to disable public suffix checks in the Let's Encrypt plugin
    • Adds permanent ban feature to the badbehavior plugin, web UI, and bwcli
    • Adds manual deletion of Let's Encrypt certificates via the web UI
    • Introduces multi-language support (ar, bn, en, es, fr, hi, pt, ru, ur, zh, de, it) in the web UI

    9 details in Everything

61. 1.6.2-rc1 Prerelease Mar 29, 2025 · release notes

    v1.6.2-rc1 adds configurable SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cipher levels, Antibot filter options, and Infomaniak DNS provider to letsencrypt plugin.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2-rc1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2-rc1

    • Adds modern, intermediate, and old cipher level options to the SSL plugin configuration for granular control over TLS settings
    • Adds custom cipher list support in the SSL plugin configuration via a new field (implied by ability to set)
    • Adds configuration options in the Antibot plugin to ignore specific request attributes: URI, IP, reverse DNS, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., and User-Agent
    • Allows configuration of the algorithm used for generating self-signed certificates in the Self-signed certificate plugin (default: ec-prime256v1)
    • Adds Infomaniak as a supported DNS provider option within the letsencrypt plugin

    5 details in Everything

62. v1.6.1 Mar 15, 2025 · release notes

    BunkerWeb v1.6.1 ships an all-in-one Docker image and promotes CrowdSec to a built-in core plugin.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.1

    • New all-in-one Docker image bundles BunkerWeb, Scheduler, Autoconf, and UI into a single container for simplified deployments.
    • Adds CrowdSec as a core plugin, bringing crowd-sourced threat intelligence natively into BunkerWeb without a separate integration.
    • Enhances Let's Encrypt DNS credential handling to accept base64-encoded values and properly process escape sequences.
    • Improves ban handling in the UI with stronger validation and informative responses scoped to ban scope and service.
    • Adds failover message reporting in the UI for better visibility into service continuity events.

    5 details in Everything

63. 1.6.1-rc2 Prerelease Feb 27, 2025 · release notes

    v1.6.1-rc2 adds PROXY_BUFFER_SIZE and PROXY_BUFFERS settings, custom plugin hooks/blueprints, and UI indicators for cloned service settings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.1-rc2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.1-rc2

    • Adds PROXY_BUFFER_SIZE and PROXY_BUFFERS environment variables to control proxy buffer configuration in multisite mode.
    • Enables developers to create custom plugins using hooks and blueprints instead of relying solely on the plugin page.
    • Displays a visual label in the UI to indicate which service settings have been cloned from the original.

    3 details in Everything

64. 1.6.1-rc1 Prerelease Feb 20, 2025 · release notes

    v1.6.1-rc1 adds deSEC DNS provider support and several web UI enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.1-rc1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.1-rc1

    └──▷ HOW TO FIND IT
    Navigate the UI to edit a previously auto-configured service.
    📍Go to instances › [Instance Name] › Services, select the autoconf service, and click Edit.
    • Adds deSEC DNS provider support in letsencrypt plugin
    • Makes services created with the autoconf method editable in the web UI
    • Adds an instance hostname validation in the instances page when adding a new instance

    3 details in Everything

65. v1.6.0 Feb 14, 2025 · release notes

    BunkerWeb 1.6.0 adds mCaptcha antibot mode and a new ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. global CRS setting to speed up multi-service config generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ USE IT
    When you run many services and ModSecurity config generation is slow, enable the global CRS to share one ruleset across all services.
    yaml copy

    USE_MODSECURITY_GLOBAL_CRS: "yes"

    • Adds mCaptcha as a new antibot mode for bot protection.
    • New USE_MODSECURITY_GLOBAL_CRS setting lets you share a single CRS across all services instead of per-service CRS, accelerating configuration generation at scale.

    2 details in Everything

66. 1.6.0-rc3 Prerelease Jan 26, 2025 · release notes

    BunkerWeb v1.6.0-rc3 adds bulk reporting in BunkerNet, Kubernetes ConfigMap overrides via annotation, a new anonymized support page, and Fedora 41 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.0-rc3 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.0-rc3

    • Adds bunkerweb.io/CONFIG_TYPE=settings annotation to Kubernetes ConfigMaps for easy setting overrides
    • Introduces an anonymized Support page in the UI for quick log and configuration sharing
    • Updates BunkerNet logic to send reports in bulk instead of one by one
    • Adds Fedora 41 as a supported platform

    4 details in Everything

67. 1.6.0-rc2 Prerelease Jan 21, 2025 · release notes

    BunkerWeb 1.6.0-rc2 adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. plugin, bwcli plugin_list, and stream support for Kubernetes integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.0-rc2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.0-rc2

    └──▷ TRY IT
    List all installed plugins and their available subcommands via the CLI.
    copy

    $ bwcli plugin_list

    • Introduces the ssl plugin to manage SSL/TLS settings independently of the misc plugin
    • Adds the plugin_list command to the bwcli utility for listing available plugins and their commands
    • Enables stream support within the Kubernetes integration

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The MODSECURITY_CRS_PLUGIN_URLS setting is renamed to MODSECURITY_CRS_PLUGINS
68. 1.6.0-rc1 Prerelease Jan 10, 2025 · release notes

    BunkerWeb 1.6.0-rc1 adds multi-user Auth basic, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. toggle, country tracking bans, and new session/config flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.0-rc1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.0-rc1

    • CHECK_PRIVATE_IP config key added to manage session IP address changes for private networks
    • ALWAYS_REMEMBER functionality implemented for session persistence in login UI
    • New temporary UI service displays startup errors if any occur while web UI is starting up
    • Health check endpoint added and integrated into the scheduler for instance status monitoring
    • Country tracking added to bans data

    +4 more show less

    • MODSECURITY_REQ_BODY_NO_FILES_LIMIT setting allows configuring SecRequestBodyNoFilesLimit in ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application.
    • Multi-user support added to Auth basic plugin
    • TCP toggle listening supported in server-stream configuration, ensuring UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. does not replace TCP when activated
    • LISTEN_STREAM_PORT and LISTEN_STREAM_PORT_SSL settings now accept multiples to allow listening on multiple ports

    9 details in Everything

69. 1.6.0-beta Prerelease Dec 10, 2024 · release notes

    BunkerWeb 1.6.0-beta adds HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. limits, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. encryption, DNS prefetch control, and CoreRuleset plugin support via new env vars

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.0-beta https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.6.0-beta

    └──▷ TRY IT
    Enable DNS prefetch control by setting the environment variable
    copy

    $ export X_DNS_PREFETCH_CONTROL=off

    Encrypt TOTP secrets with a custom key to prevent data loss
    copy

    $ export TOTP_SECRETS=my_custom_secret_key_here

    Configure BunkerWeb to use specific Kubernetes namespaces for autoconf
    copy

    $ export NAMESPACES=production,staging

    • Adds USE_MODSECURITY_CRS_PLUGINS and MODSECURITY_CRS_PLUGIN_URLS environment variables to automatically download and install Coreruleset plugins.
    • Adds the X-DNS-Prefetch-Control header functionality with the X_DNS_PREFETCH_CONTROL setting (default is off) to control DNS prefetching behavior.
    • Adds a new securitytxt plugin to manage the security.txt file from settings and serve it.
    • Adds the REVERSE_PROXY_PASS_REQUEST_BODY setting to control if the request body should be passed to the upstream server (default is yes).
    • Allows controlling job history size via the DATABASE_MAX_JOBS_RUNS setting (default is 10000), with future UI visibility.

    +15 more show less

    • Adds HTTP/3 connections limiting via the HTTP3_CONNECTIONS_LIMIT setting (default is 100) in the limit plugin.
    • Adds a new templating feature to quickly override default values of settings and custom configurations, including UI steps for service configuration.
    • Allows setting a custom timezone for every service via the TZ environment variable, applying to logs and database date fields.
    • Enables running plugins jobs in async mode by setting the async key to true in the plugin job configuration (default is false).
    • Adds Let's Encrypt DNS challenges support.
    • Adds the REMOTE_PHP_PORT setting to control the port used by the remote PHP feature (default is 9000).
    • Updates the scheduler to use the BUNKERWEB_INSTANCES environment variable (replacing OVERRIDE_INSTANCES) for instance configuration.
    • Adds the NAMESPACES environment variable to the autoconf feature for setting namespaces to watch in multi-instance clusters.
    • Adds the USE_KUBERNETES_FQDN environment variable (default is yes) to use FQDNs instead of IPs for instance hostnames in Kubernetes.
    • Adds support for Fedora 41 and drops support for Fedora 40.
    • Refactors the UI to be more modular and easier to maintain.
    • Adds a remember me feature to the login page, keeping users logged in for 31 days.
    • Adds the TOTP_SECRETS setting to encrypt TOTP secrets in the database; recommends setting a custom value to prevent erasure on volume deletion.
    • Makes the 2FA feature more user-friendly and adds recovery codes for lost access.
    • Refactors UI log handling to read directly from /var/log/bunkerweb instead of using integration-specific logic.

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Fedora 40 is no longer supported; systems on Fedora 40 must migrate to Fedora 41 or another supported platform.
70. advisory CVE-2024-53264 Nov 27, 2024 · issue 128
    • CVE-2024-53264: Open Redirect Vulnerability in Loading Page (affects <=1.5.11)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
71. v1.5.11 Nov 10, 2024 · release notes

    BunkerWeb v1.5.11 adds worker dict size control and API timeout settings, plus updates OWASP CRSOWASP CRSA free, community-maintained ruleset for ModSecurity and compatible WAFs that detects common web attacks like SQLi and XSS, giving cyber tools a ready-made detection baseline without writing rules from scratch. to v4.8.0 and v3.3.7.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.11 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.11

    • New WORKERLOCK_MEMORY_SIZE setting lets operators tune the worker dictionary memory size.
    • New API_TIMEOUT and API_READ_TIMEOUT settings enable fine-grained control over API timeout behaviour.
    • Updates OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Core Rule Set v4 to v4.8.0 and v3 to v3.3.7, bringing the latest WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. detection rules.

    3 details in Everything

72. v1.5.9 Jul 24, 2024 · release notes

    BunkerWeb v1.5.9 adds SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address.-based upstream support with new REVERSE_PROXY_SSL_SNI settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.9 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.9

    └──▷ USE IT
    Route traffic to an upstream that requires a specific TLS SNI value (e.g., a CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. or shared-hosting backend that serves multiple certs).
    ini copy

    REVERSE_PROXY_SSL_SNI=yes
    REVERSE_PROXY_SSL_SNI_NAME=backend.example.com

    • Adds REVERSE_PROXY_SSL_SNI and REVERSE_PROXY_SSL_SNI_NAME settings to support SNI-based TLS upstream connections in reverse proxy configurations.
    • Updates the web UI setup wizard to handle scenarios where a reverse proxy already exists but no admin user is configured.
    • Moves Linux package repository to repo.bunkerweb.io.
    • Updates CoreRuleSet to v4.5.0, bringing the latest WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. detection rules.
    • Updates security headers on default and error pages for improved posture.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Linux packages are now served from repo.bunkerweb.io instead of the previous packagecloud.io repository — existing package manager configurations pointing to the old repo URL must be updated.
73. v1.5.8 Jun 19, 2024 · release notes

    Adds DATABASE_URI_READONLY fallback, HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. support, and nightly OWASP CRSOWASP CRSA free, community-maintained ruleset for ModSecurity and compatible WAFs that detects common web attacks like SQLi and XSS, giving cyber tools a ready-made detection baseline without writing rules from scratch. builds to BunkerWeb v1.5.8

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.8 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.8

    • Add automatic fallback to either read-only on the primary database or to the read-only database URI when the main database URI is not available and automatically switch back to the main database URI when it becomes available again
    • Add new DATABASE_URI_READONLY setting to allow setting up a fallback read-only database URI in case the main database URI is not available
    • Enhance security on error pages, default server page and loading page by adding a custom Content-Security-Policy header with nonces and removing the Server header
    • Add experimental support of HTTP/3 (QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking.)
    • Add nightly build of the OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. coreruleset that are automatically downloaded and updated

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drop support for Fedora 39 in favor of Fedora 40
74. v1.5.7 May 14, 2024 · release notes

    BunkerWeb 1.5.7 adds a backup/restore plugin, LETS_ENCRYPT_CLEAR_OLD_CERTS and DISABLE_DEFAULT_SERVER_STRICT_SNI settings, and custom bwcli command support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.7 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.7

    • Adds the backup plugin to allow easy database backup and restore operations
    • Adds LETS_ENCRYPT_CLEAR_OLD_CERTS environment variable (default: no) to control removal of old Let's Encrypt certificates during generation
    • Adds DISABLE_DEFAULT_SERVER_STRICT_SNI environment variable (default: no) to permit or block requests when the SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. header is unknown or unset
    • Enables custom bwcli commands via plugins, expanding the CLI tool surface
    • Supports Ubuntu 24.04 (Noble) as a new Linux distribution target

    +1 more show less

    • Adds combobox plugin search on the Global config / services page for faster plugin discovery

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drops support for ansible and vagrant integrations
75. v1.5.6 Mar 25, 2024 · release notes

    BunkerWeb v1.5.6 adds metrics plugin, Redis Sentinel, new UI pages, and several settings like REDIS_SSL_VERIFY

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.6 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.6

    └──▷ HOW TO FIND IT
    Disable SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate verification for Redis connections in BunkerWeb config.
    📍REDIS_SSL_VERIFY=False
    Control SQLAlchemy logger verbosity independently of the main log level via environment variable.
    📍DATABASE_LOG_LEVEL=DEBUG
    Send a custom Host header for reverse proxy targets using the new setting.
    📍REVERSE_PROXY_CUSTOM_HOST=example.com
    • Adds REDIS_SSL_VERIFY setting to activate/disable SSL certificate verification when using Redis
    • Adds automatic Redis Sentinel fallback to master if no slaves are available
    • Adds Redis Sentinel support for bwcli
    • Adds new Metrics core plugin that allows metrics collection and retrieval of internal metrics
    • Adds DATABASE_LOG_LEVEL setting to control SQLAlchemy loggers separately from the main one

    +5 more show less

    • Adds whitelist check for the default-server as well
    • Adds ability to choose between coreruleset v3 and v4 for ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. (default is v3)
    • Adds TIMERS_LOG_LEVEL setting to control the log level of the lua timers
    • Adds pro version management to core plugins, the scheduler and the web UI
    • Adds REVERSE_PROXY_CUSTOM_HOST setting to set a custom Host header when using reverse proxy

    10 details in Everything

76. v1.5.5 Jan 12, 2024 · release notes

    BunkerWeb v1.5.5 adds 2FA to the Web UI, Anonymous reporting, Redis Sentinel support, and configurable reverse proxy includes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.5 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.5

    └──▷ HOW TO FIND IT
    Inject custom Nginx include directives into reverse proxy blocks via environment variable.
    📍REVERSE_PROXY_INCLUDES=/etc/bunkerweb/custom-includes/*.conf docker compose up -d
    Enable Two-Factor Authentication for the BunkerWeb Web UI administrators.
    📍In the BunkerWeb UI, navigate to Settings › Users and enable 2FA for your account.
    • Adds REVERSE_PROXY_INCLUDES environment variable to manually inject include directives into reverse proxy configurations
    • Adds 2FA support for authentication in the BunkerWeb Web UI
    • Adds Anonymous reporting feature for system health statistics
    • Adds Redis Sentinel support for high-availability Redis deployments

    4 details in Everything

77. v1.5.4 Dec 5, 2023 · release notes

    BunkerWeb v1.5.4 adds an optional setup wizard to the web UI and extends Linux package support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.4 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.4

    • Supports Debian 12, Fedora 39 and RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.9 via Linux packages

    1 detail in Everything

78. v1.5.2 Sep 10, 2023 · release notes

    BunkerWeb v1.5.2 adds ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. JSON LogFormat support and publishes Docker images to ghcr.io.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.2

    • ghcr.io/bunkerity/bunkerweb:* Docker tags are now available for BunkerWeb components
    • Supports ModSecurity JSON LogFormat for log output configuration

    2 details in Everything

79. 1.5.2 Sep 10, 2023 · release notes

    BunkerWeb 1.5.2 adds ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. JSON LogFormat support and GitHub Container Registry publishing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.5.2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.5.2

    • Push Docker images to GitHub packages (ghcr.io repository)

    1 detail in Everything

80. v1.5.1 Aug 8, 2023 · release notes

    v1.5.1 adds Turnstile antibot mode, custom redirect status codes, header preservation, and local plugin downloads.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.1

    └──▷ TRY IT
    Force permanent redirects (301) instead of the default temporary redirect when using reverse proxy.
    copy

    $ REDIRECT_TO_STATUS_CODE=301 bunkerweb

    Preserve original upstream headers in your response while acting as a reverse proxy.
    copy

    $ KEEP_UPSTREAM_HEADERS=yes bunkerweb

    Load external plugins from a local tar.gz archive instead of fetching them over the network.
    copy

    $ PLUGIN_URL=file:///path/to/plugin.tar.gz

    • REDIRECT_TO_STATUS_CODE environment variable to choose between 301 and 302 for redirects
    • KEEP_UPSTREAM_HEADERS to preserve headers when using reverse proxy
    • Turnstile antibot mode support
    • Download lists and plugins from a local file instead of remote sources
    • Support for tar.gz and tar.xz files for external plugins

    5 details in Everything

81. v1.5.0 May 23, 2023 · release notes

    BunkerWeb v1.5.0 introduces a dedicated scheduler service, database-backed configuration, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. integration, and initial TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. stream support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ USE IT
    Deploy the new dedicated scheduler component alongside BunkerWeb to manage background jobs.
    shell copy

    docker pull bunkerity/bunkerweb-scheduler:1.5.0

    • Adds bunkerity/bunkerweb-scheduler:1.5.0 Docker tag for the new dedicated scheduler service managing jobs and configuration
    • Enables storing configuration in a database backend instead of flat files
    • Adds RHEL integration support
    • Initializes support for generic TCP/UDP (stream) protocols
    • Initiates support for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.

    +2 more show less

    • Adds Redis support for clustered integrations
    • Adds Vagrant integration

    7 details in Everything

82. 1.5.0-beta Prerelease May 2, 2023 · release notes

    BunkerWeb v1.5.0-beta adds Redis for clustered integrations, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. and Vagrant support, and initial IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only./TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. stream capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.5.0-beta https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.5.0-beta

    • Add Redis support when using clustered integrations allows backend configuration caching for scaled deployments
    • Add RHEL integration enables deployment on Red Hat Enterprise Linux systems
    • Add Vagrant integration provides a ready-made development environment setup
    • Init support of generic TCP/UDP (stream) extends the proxy to handle non-HTTP protocols
    • Init support of IPv6 allows binding and traffic handling over IPv6 networks

    5 details in Everything

83. v1.4.4 Nov 10, 2022 · release notes

    BunkerWeb v1.4.4 adds greylisting, Blacklist ignore settings, ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. limits, API manual bans, and new env vars

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.4 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.4.4

    └──▷ TRY IT
    Use the CLI to manually ban an IP address
    copy

    $ bwcli ban 192.168.1.100

    • Adds greylist core feature to allow temporary bypass of blocking rules for trusted sources
    • Adds BLACKLIST_IGNORE_* settings to exclude specific IPs or ranges from global blacklists
    • Add automatic change of SecRequestBodyLimit modsec directive based on MAX_CLIENT_SIZE setting
    • Add MODSECURITY_SEC_RULE_ENGINE and MODSECURITY_SEC_AUDIT_LOG_PARTS settings

    4 details in Everything

84. v1.4.3 Aug 26, 2022 · release notes

    BunkerWeb v1.4.3 adds CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. plugin, custom conf injection, Deny status control, and Ansible integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.3 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.4.3

    • Adds *_CUSTOM_CONF_* setting to automatically inject custom configuration files from the environment variable value
    • Adds DENY_HTTP_STATUS setting to allow choosing between standard 403 error page or 444 (close connection) when access is denied
    • Adds CORS (Cross-Origin Resource Sharing) as a core plugin
    • Adds Ansible integration in beta

    4 details in Everything

85. v1.4.2 Jun 28, 2022 · release notes

    BunkerWeb v1.4.2 adds EXTERNAL_PLUGIN_URLS setting for auto-installing external plugins

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.4.2

86. v1.4.1 Jun 16, 2022 · release notes

    Adds reverse_proxy_timeout and auth_request settings with authentik/authelia examples

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.4.1

    • Add reverse proxy timeouts settings to allow configuring timeout values for upstream connections
    • Add auth_request settings to configure Nginx auth_request module parameters for authentication offloading
    • Add authentik and authelia examples demonstrating integration with these specific identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.

    3 details in Everything

87. v1.4.0 Jun 5, 2022 · release notes

    BunkerWeb v1.4.0 adds a modular architecture, Linux packages, and a new settings generation tool

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Project renamed to BunkerWeb
    • Internal architecture fully revised with a modular approach
    • Plugin improvement
    • Volume improvement for container-based integrations
    • Web UI improvement with various new features

    +1 more show less

    • Web tool to generate settings from a user-friendly UI

    6 details in Everything

88. v1.3.2 Oct 24, 2021 · release notes

    Adds Swarm/K8s API integration, distributed bad IPs database via remote API, and expanded request limiting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.2 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.3.2

    • Use API instead of a shared folder for Swarm and Kubernetes integrations
    • Beta integration of distributed bad IPs database through a remote API
    • Improvement of the request limiting feature : hour/day rate and multiple URL support

    3 details in Everything

89. v1.3.1 Sep 2, 2021 · release notes

    BunkerWeb v1.3.1 adds CUSTOM_HEADER, REVERSE_PROXY_BUFFERING, and REVERSE_PROXY_KEEPALIVE environment variables for reverse proxy control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.1 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.3.1

    • Adds CUSTOM_HEADER variable to inject custom headers into proxied requests
    • Adds REVERSE_PROXY_BUFFERING variable to control buffering behavior in reverse proxy mode
    • Adds REVERSE_PROXY_KEEPALIVE variable to manage keep-alive connections for the reverse proxy

    3 details in Everything

90. v1.3.0 Aug 23, 2021 · release notes

    BunkerWeb v1.3.0 adds Kubernetes/Linux integrations in beta, Authelia support, and new configuration variables

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ TRY IT
    Configure BunkerWeb to use a custom response body via the environment
    copy

    $ # Add INJECT_BODY to your .env or docker-compose.yml
    INJECT_BODY='<!-- Custom Footer -->'

    Enable Authelia integration by setting the appropriate environment variable
    copy

    $ # Add AUTH_ENGINE=authelia to your .env or docker-compose.yml
    AUTH_ENGINE=authelia

    Point redirects to a specific URL using the new variable
    copy

    $ # Add REDIRECT_TO to your .env or docker-compose.yml
    REDIRECT_TO=https://example.com/new-location

    • Adds INJECT_BODY variable to customize response payloads
    • Adds WORKER_PROCESSES variable to control Nginx worker count
    • Adds USE_LETS_ENCRYPT_STAGING variable for Let's Encrypt staging environment
    • Adds LOCAL_PHP and LOCAL_PHP_PATH variables for local PHP configuration
    • Adds REDIRECT_TO variable for URL redirection

    +3 more show less

    • Adds Authelia integration support for authentication
    • Introduces Kubernetes integration (beta) as a new deployment target
    • Introduces Linux integration (beta) for standalone server deployment

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CrowdSec is now an external plugin rather than a built-in feature
91. 1.2.7 Jun 14, 2021 · release notes

    Adds custom robots.txt/sitemap in RTD, HEALTHCHECK support, pre/post job split, and underscore in cert paths.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.7 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.2.7

    • Add HEALTHCHECK to image

    1 detail in Everything

92. 1.2.6 Jun 6, 2021 · release notes

    BunkerWeb 1.2.6 adds LOG_LEVEL env var, read-only container support, and a plugin system init.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.6 https://github.com/bunkerity/bunkerweb.git
    # already have the repo? check out this version:
    $ git checkout 1.2.6

    • Adds LOG_LEVEL environment variable to control logging verbosity
    • Enables read-only container execution mode

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ClamAV functionality is now provided via an external plugin rather than being built-in