BunkerWeb — The Cyber Toolchain

BunkerWeb v1.6.17

Wed, 21 Oct 2026 16:03:27 GMT

BunkerWeb v1.6.17 adds configurable database timeouts and expands the default Permissions-Policy to block `unbounded-element`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands the default `PERMISSIONS_POLICY` header to also deny `unbounded-element`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb api-docs-9bb6ac79a8c8

Fri, 16 Oct 2026 08:29:48 GMT

BunkerWeb 1.6.16 adds ban removal API supporting CrowdSec decision deletion via `remove_crowdsec_decisions` and `decision_keys`⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds ban removal endpoint supporting `kind: "crowdsec_lease"` with `remove_crowdsec_decisions: true`, `confirmed: true`, and `decision_keys` to delete underlying CrowdSec decisions globally or per service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.16

Wed, 14 Oct 2026 10:15:47 GMT

BunkerWeb v1.6.16 adds Redis Cluster support, TLS-drop banning, IPv4 Let's Encrypt certs, and richer IP-list formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `REDIS_CLUSTER_NODES` setting to enable Redis Cluster support for the `redis` integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `BANS_TLS_DROP_REASONS` to close TLS handshakes of banned IPs for specified ban reasons instead of serving a 403 page, including dropping banned clients at the TLS ClientHello behind PROXY protocol when real IP uses `proxy_protocol` (trusted only from proxies in `REAL_IP_FROM`). • Adds `CROWDSEC_BAN_REFRESH` to turn CrowdSec blocks into short, renewed bans listed on the Bans page and removed with their decisions on Unban. • Adds `ANTIBOT_JAVASCRIPT_DIFFICULTY` (16 to 28 bits) to raise the JavaScript proof-of-work challenge cost in the `antibot` plugin. • Supports Let's Encrypt certificates for public IPv4 addresses in `SERVER_NAME` using the `shortlived` profile and the `http` challenge. • Extends IP list URL support in `realip`, `blacklist`, `whitelist`, and `greylist` to include JSON, JSON lines, CSV, and tab-separated formats, with a `#key=value` filter. • Adds an admin-only Web UI Diagnostics bundle on the Support page (`/support/logs`), with IPv6 address and credential anonymization. • Redesigns `antibot` challenge pages to follow browser preferences (theme, reduced motion, contrast, and text size), with a discreet reload link. • Adds `publickey-credentials-remote-client-data-json` denial to the default `PERMISSIONS_POLICY` header in the `headers` plugin. • Allows a `scheduler` job to exit with code 3 to request a configuration reload while still being reported as failed. Breaking changes: • `METRICS_REDIS_TTL` now interprets `m` as minutes instead of millions; values stored in the database are migrated automatically, but values set through environment variables are not and must be updated manually. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.15

Mon, 21 Sep 2026 11:29:34 GMT

BunkerWeb 1.6.15 adds mTLS to upstreams, per-header allow/block criteria, per-URL client size limits, and a syslog-ng UI log collector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `UI_USE_REDIS=no` to disable Redis exclusively for the Web UI without disabling the global Redis-backed ban and report sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `MODSECURITY_SEC_AUDIT_LOG` to configure the ModSecurity audit log path under `/var/log/bunkerweb`. • Adds per-URL `REVERSE_PROXY_MAX_CLIENT_SIZE` to control both request body size and the ModSecurity body-size limit on a per-location basis. • Supports presenting a client certificate to upstreams for mutual TLS in the `reverseproxy` and `grpc` plugins, with configurable upstream CRL, TLS protocols, and ciphers validated and distributed by the Scheduler. • Adds header-based matching to `antibot`, `blacklist`, `whitelist`, `greylist`, `dnsbl`, and `country` plugins — match on a request header name and optional PCRE value regex as an ignore or list criterion; header values are stored as password settings and are never logged or cached. • Expands the `grpc` plugin to match `reverseproxy` configurability, including client response headers, pass/ignore headers, underscores in headers, buffer and body-size controls, `auth_request`, and upstream TLS verification. • Adds CrowdSec IP investigation, allowlist inspection, and decision removal through the Web UI and API, with richer report details and on-page allowlist guidance. • Adds opt-in concurrent audit logging for ModSecurity with instance-side storage validation. • Adds `install-bunkerweb.sh --docker` upgrade capability for Docker stacks previously generated by the installer, backing up the database and preserving secrets, ports, and Compose edits while refusing downgrades. • Adds logrotate integration for the all-in-one image; mount `/etc/logrotate.d/bunkerweb` to provide a custom rotation policy. • Adds destroyed-session rejection on next use, locally or cluster-wide when Redis is enabled. • Allows individual settings to remain as drafts in the RAW editor, with explicit activation and inherited/default effective values. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.14

Fri, 21 Aug 2026 14:54:20 GMT

BunkerWeb 1.6.14 adds per-service CrowdSec multisite settings, a certificate validator in the UI, and new metrics/policy controls. • Makes every `CROWDSEC_*` setting `multisite`, so individual services can point at different Local API or AppSec endpoints; set `CROWDSEC_API` to an empty string on a service to retain AppSec inspection without the decision lookup. • Adds `METRICS_REDIS_TTL` setting to control TTL for metrics stored in Redis, alongside atomic list and facet updates and buffering during Redis OOM events. • Adds `DISABLE_ONLINE_API` environment variable to the `all-in-one` image (matching the official CrowdSec image name) to run CrowdSec without registering to the Central API. • Adds a **Validate certificate** button on the custom certificate settings page in the UI, checking a pasted or uploaded key pair for mismatches, encrypted keys, expiry, and missing server name coverage before the service is saved. • Denies Chrome built-in AI APIs in the default `PERMISSIONS_POLICY` header value. • Allows the `QUERY` HTTP method by default in `ALLOWED_METHODS` and bundled service templates. • Honors the `k`/`m` suffix on `METRICS_MAX_BLOCKED_REQUESTS_REDIS` when bounding report reads. Breaking changes: • `KEEP_CONFIG_ON_RESTART` is no longer listed as a configurable setting in the web UI or database — it must be set in the environment or in `/etc/bunkerweb/variables.env` on Linux, as it is read by the entrypoint before the database is reachable. • Existing 'remember me' long-lived tokens are rejected and deleted on the next request; users relying on year-long browser persistence will be logged out and must re-authenticate. Extend `SESSION_LIFETIME_HOURS` and `SESSION_ABSOLUTE_HOURS` to replicate long-lived sessions. • Biscuit tokens carrying more than a single block are now rejected by the API; any client that appended extra blocks to its tokens will have its requests refused. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.13

Thu, 16 Jul 2026 18:13:29 GMT

BunkerWeb v1.6.13 adds global rate limiting, per-URI country check bypass, and post-challenge redirect control. • Adds `USE_LIMIT_REQ_GLOBAL` and `LIMIT_REQ_GLOBAL_RATE` settings to cap the total aggregate request rate for a service across all clients and URLs, evaluated before per-IP and per-URL limits. • Adds `COUNTRY_IGNORE_URI` to skip country whitelist and blacklist checks for URIs matching a list of PCRE expressions, matched against both the request path and the full URI including query string. • Adds `ANTIBOT_SUCCESS_URI` to redirect clients to a fixed URI after successfully completing a challenge, rather than returning them to the originally requested page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.12

Thu, 02 Jul 2026 17:51:37 GMT

BunkerWeb v1.6.12 adds upstream TLS verification, per-path mTLS, a full logs viewer overhaul, and tightened API token security. • Adds upstream HTTPS certificate verification for reverse proxy via `REVERSE_PROXY_SSL_VERIFY`, `REVERSE_PROXY_SSL_VERIFY_DEPTH`, `REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE`, `REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_DATA`, and `REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_PRIORITY` settings. • Adds `MTLS_URL_n` regex setting to enforce mTLS selectively per path rather than site-wide. • Adds `SCHEDULER_MAX_WORKERS` to cap the job-executor thread pool and reduce database pool pressure under load. • Extends `ANTIBOT_IGNORE_URI` to match full request URIs including query strings. • Supports pre-hashed bcrypt values for `ADMIN_PASSWORD`, enabling secret-manager and GitOps workflows. • Hardens Biscuit API token generation by binding Host header, client IP, and username as typed terms; adds optional `API_ALLOWED_HOSTS` allowlist. • Adds `API_ACL_BOOTSTRAP_FILE` bcrypt hash validation, rejecting weak or malformed values on startup. • Overhauls the UI logs viewer with syntax highlighting, severity filters with counts, in-page search, live-tail with pause, download/copy actions, local-time display, and collapsible multi-line entries. • Adds fold support for multi-line file settings (e.g., PEM certificates and keys) in the RAW config editor. • Improves BunkerNet UI status reporting with Connected / API unreachable / Not registered states, masked instance ID, and disk self-heal. • Adds Ubuntu 26.04 Resolute Raccoon as a supported Linux package target. • Updates ModSecurity to 3.0.16 and Core Rule Set to 4.27.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.10

Tue, 19 May 2026 19:15:43 GMT

BunkerWeb 1.6.10 adds per-backend HTTP version control, cross-subdomain session sharing, modern TUI installer, and new UI bulk-action controls. • Adds `MAX_HEADERS` setting (default `100`) to cap the number of request header lines accepted. • Adds per-backend `REVERSE_PROXY_HTTP_VERSION` supporting `1.0`, `1.1`, and `2`, overriding the global default per upstream. • Adds `SESSIONS_DOMAIN` multisite setting to share antibot/challenge session state across sibling subdomains. • Adds Web UI session lifecycle controls: `SESSION_LIFETIME_HOURS` (sliding idle TTL), `SESSION_ABSOLUTE_HOURS` (hard cap), and `SESSION_ROLLING_HOURS` (periodic session ID regeneration). • Adds `LETS_ENCRYPT_MAX_LOG_BACKUPS` (default `50`) to cap certbot log rotation. • Adds modern inline TUI installer prompts via `gum`, with fallback to `whiptail` then plain `read`; controlled by `--tui`, `--no-tui`, and `BW_INSTALL_TUI`. • Adds `--server-ip ` flag and `SERVER_IP_INPUT` to the installer; interactive installs present a menu when multiple IPv4s are detected. • Supports `k`/`m` shorthand suffixes for metrics and datastore size settings, plus `g`/`G` for shared memory size settings. • Allows custom uppercase HTTP methods containing underscores and dashes in `ALLOWED_METHODS`. • Updates default `Permissions-Policy` header to include `local-network`, `local-network-access`, and `loopback-network` directives. • Adds 18 missing single-column database indexes, improving query performance for large deployments. • Adds opt-in 'Select all N matching' banner in UI list pages for bulk actions across pages. • Adds import/export for custom configurations in the UI, including optional `.zip` bundles attached to service exports. • CSV/Excel exports on Reports and Bans pages now include every column and honor active search and SearchPanes filters. • Bundled `ui` and `api` templates now enable `REVERSE_PROXY_KEEPALIVE=yes` by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.9

Fri, 13 Mar 2026 18:04:21 GMT

BunkerWeb v1.6.9 adds a gRPC proxy plugin, ZeroSSL CA support, three new DNS providers, country group filtering, and new NGINX timeout controls. • New `gRPC` plugin enables proxying of gRPC traffic to upstream services with TLS, SNI, custom headers, and retry policy support. • Let's Encrypt plugin now supports selecting between Let's Encrypt and ZeroSSL as the certificate authority, including ZeroSSL-specific settings. • Adds Gandi, Hetzner, and ClouDNS as DNS providers in the Let's Encrypt plugin. • Country plugin gains the ability to whitelist or blacklist groups of countries, not just individual countries. • New `CLIENT_BODY_TIMEOUT`, `CLIENT_HEADER_TIMEOUT`, `KEEPALIVE_TIMEOUT`, and `SEND_TIMEOUT` settings expose NGINX timeout controls for long-lived connections. • New `file` setting type lets users upload files directly from the Web UI and use their content as setting values. • Adds `MAX_REQUESTS` setting (with `UI_MAX_REQUESTS` / `API_MAX_REQUESTS` overrides) to configure Gunicorn worker max requests before restart. • Adds `MAX_CONTENT_LENGTH` setting to the Web UI to configure the maximum upload size (defaults to 50 MB). • Sensitive field values in the Let's Encrypt plugin are now redacted from logs and process arguments (except at TRACE level). • HTTP/HTTPS/STREAM/TLS ports can now be left empty to disable listening on those ports. • Global settings UI gains an 'override non-global services' functionality. • Web UI now supports editing settings via the `wizard` method. • Adds `DATABASE_POOL_SIZE`, `DATABASE_POOL_MAX_OVERFLOW`, `DATABASE_POOL_TIMEOUT`, `DATABASE_POOL_RECYCLE`, `DATABASE_POOL_PRE_PING`, `DATABASE_POOL_RESET_ON_RETURN`, `DATABASE_RETRY_TIMEOUT`, `DATABASE_REQUEST_RETRY_ATTEMPTS`, and `DATABASE_REQUEST_RETRY_DELAY` settings for fine-grained database connection pool tuning. • Autoconf adds experimental support for GRPCRoute in the Kubernetes Gateway API integration. • `CUSTOM_SSL_CERT_DATA` and `CUSTOM_SSL_KEY_DATA` settings are now of type `file`, allowing direct certificate and key upload from the Web UI. • Permissions-Policy header default value updated to include the `gamepad` feature. • Home dashboard enhanced with new IP blocking metrics and improved tooltips. • Reports page gains improved filter handling and data fetching. • CrowdSec updated to version 1.7.6 in the all-in-one image. • NGINX updated to v1.28.2 for Fedora 42 and 43. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.8

Fri, 13 Feb 2026 19:47:35 GMT

BunkerWeb v1.6.8 adds concurrent Let's Encrypt cert generation, three new DNS providers, Gateway API support, and services import with drag-and-drop. • New `REVERSE_PROXY_REQUEST_BUFFERING` setting in the Reverse Proxy plugin lets operators control whether request bodies are buffered before proxying (default: `on`). • New `LETS_ENCRYPT_CONCURRENT_REQUESTS` setting enables parallel certificate generation across multiple services, speeding up multi-site Let's Encrypt provisioning (default: `no`). • Adds GoDaddy, TransIP, and Domeneshop as DNS challenge providers in the Let's Encrypt plugin. • New global `KEEP_CONFIG_ON_RESTART` setting preserves the existing nginx configuration across restarts instead of regenerating a temporary one each time (default: `no`). • Templator engine refactored to use Jinja2, unlocking richer templating capabilities for custom configurations. • Experimental Kubernetes Gateway API controller support added (Gateway/HTTPRoute resources) for Autoconf deployments. • API now supports HTTP/2 in Gunicorn for improved performance and protocol compatibility. • CIDR annotation support added for `FORWARDED_ALLOW_IPS` and `PROXY_ALLOW_IPS` settings; defaults updated to cover common private network ranges. • Web UI services table now displays security mode per service at a glance. • Web UI gains services import functionality with drag-and-drop support. • Redis report querying in the UI enhanced with filter parsing and chunked retrieval for large datasets. • Easy Install script gains an option to automatically install a Redis server for data persistence and caching. • DuggyTuxy Data-Shield IPv4 Blocklist added to the built-in blacklist sources. • NGINX updated to v1.28.2 and Core Rule Set updated to v4.23.0 (CRSv3 to v3.3.8). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.6

Mon, 24 Nov 2025 15:30:21 GMT

BunkerWeb v1.6.6 adds mutual TLS plugin, DuckDNS/PowerDNS Let's Encrypt providers, country-based antibot controls, and a new API service template. • New `mtls` plugin adds mutual TLS client certificate authentication with configurable verification modes, chain depth control, and optional header forwarding for downstream authorization. • Adds `ANTIBOT_IGNORE_COUNTRY` and `ANTIBOT_ONLY_COUNTRY` settings to the Antibot plugin for country-based challenge bypassing or enforcement. • Adds `AUTH_BASIC_ROUNDS` setting to the `authbasic` plugin to tune bcrypt password hashing strength (default: 656000, range: 1000–999999999). • Switches Auth Basic password hashing to bcrypt for improved security. • Adds a new `API` template to quickly protect an API service using BunkerWeb. • Starts monitoring HTTP `405` and `400` status codes, surfacing them on the reports page. • IP whitelisting checks added to the badbehavior module to prevent banning whitelisted IPs; whitelisted IPs are served the default page even when the default server is deactivated. • Let's Encrypt mail handling now validates the configured email, warns if missing or invalid, and automatically adds `--register-unsafely-without-email` to Certbot when no valid email is present. • Adds `METRICS_MEMORY_MAX_RETRIES` setting to retry metric operations on memory failure. • Enables editing of API settings in the web UI and UI settings via the API. • UI gains a `RAW` mode for editing and creating templates, with disabled-settings highlighting and **Ctrl+S** / **Command+S** save shortcuts. • Reports page export now uses server-side chunked processing for improved performance on large datasets. • Adds DB-IP attribution to the web UI reports page footer. • DataTable state saving is now automatically enabled across the UI. • Autoconf adds event debouncing in Docker, Ingress, and Swarm controllers for improved configuration management. • Kubernetes integration gains an annotation to ignore specific services in Autoconf. • Kubernetes ConfigMaps of type `settings` can now be applied to services more easily. • Updates `MODSECURITY_REQ_BODY_NO_FILES_LIMIT` regex to support human-readable size values. • Updates the default Permissions-Policy header to include `private-state-token-issuance` and `private-state-token-redemption`. • Linux Easy Install script enhanced with manager and worker mode configurations. • Adds RHEL 9.7 and RHEL 10.1 package support. • Per-plugin commit option added to the plugin update process with improved error handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.6-rc2 (Prerelease)

Wed, 05 Nov 2025 00:00:00 GMT

BunkerWeb 1.6.6-rc2 adds mtls plugin, DuckDNS provider, API template, and ANTIBOT country filters • `AUTH_BASIC_ROUNDS` config key added to the `authbasic` plugin to set password hashing strength (default: 656000, range: 1000-999999999) • `ANTIBOT_IGNORE_COUNTRY` and `ANTIBOT_ONLY_COUNTRY` settings added to the `Antibot` plugin for country-based challenge prompting/bypassing • New `mtls` plugin introduced for mutual TLS client certificate authentication with configurable verification modes and chain depth control • New `letsencrypt` plugin now supports `DuckDNS` as a DNS provider Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.6-rc1 (Prerelease)

Fri, 31 Oct 2025 00:00:00 GMT

Adds per-plugin commit options, API/UI settings bidirectional edit, and RAW mode template editing shortcuts. • Adds `METRICS_MEMORY_MAX_RETRIES` to control retry operations for metrics linked to memory failures • Enables edition of API settings directly in the web UI and UI settings via the API • Adds `RAW` mode for editing/creating templates with **Ctrl+S** / **Command+S** save shortcuts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.5

Mon, 06 Oct 2025 15:25:17 GMT

BunkerWeb v1.6.5 adds a REST control-plane API, HTTPS for internal API, token auth, reCAPTCHA v3 support, and a new Templates management UI. • Introduces a dedicated control-plane service exposing a REST API to programmatically list/register instances, trigger reload/stop, and manage bans, plugins, jobs, and configurations. • Adds HTTPS support for BunkerWeb's internal API. • Adds optional API token authentication for BunkerWeb API calls to enable token-based access control. • Adds reason data for bad behavior bans and reports. • Adds session retention configuration via the `DATABASE_MAX_SESSION_AGE_DAYS` setting in the `Database` plugin, with an automatic cleanup job to purge old UI user sessions. • Adds support for the new reCAPTCHA version in the `Antibot` plugin. • Adds the ability to ignore IPs in the `DNSBL` plugin. • Introduces a `Templates` management page in the UI to create, edit, clone, and delete service templates. • Adds a new `Template` column in the services page showing which template a service is based on, with filtering support. • Adds the ability to quickly ban IP addresses directly from the reports page. • Introduces a `reloading` health status for BunkerWeb when NGINX is reloading. • Updates the default Permissions-Policy header value to include additional features and remove deprecated ones. • Updates CoreRuleSet to v4.19.0. • All-in-One image updates CrowdSec to v1.7.0 and adds support for disabling specific CrowdSec parsers. • Adds upgrade capability to the easy-install script for seamless in-place Linux package updates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.5-rc3 (Prerelease)

Tue, 16 Sep 2025 00:00:00 GMT

BunkerWeb 1.6.5-rc3 adds API token auth, DNSBL IP ignores, UI ban and health status features. • Adds optional API token authentication via `BUNKERWEB_API_TOKEN` env var to control access to BunkerWeb API calls • Adds `IGNORE_IPS` configuration option in the `DNSBL` plugin to exclude specific IPs from DNS blacklisting checks • Enables quick banning of IP addresses directly from the reports page in the UI • Introduces a new `reloading` health status for BunkerWeb and NGINX during restart cycles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.5-rc2 (Prerelease)

Thu, 11 Sep 2025 00:00:00 GMT

Adds CrowdSec parser disabling, reCAPTCHA support in Antibot plugin • Add `parsers` configuration key to disable specific CrowdSec parsers • Add new reCAPTCHA version support in the `Antibot` plugin Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.5-rc1 (Prerelease)

Sat, 30 Aug 2025 00:00:00 GMT

v1.6.5-rc1 adds in-place upgrade support via easy-install script and UI promo/update controls. • Adds upgrade capability to the easy-install script for seamless in-place updates • Add Force update button on PRO page to force the download of PRO plugins without checking for updates • Enhance update-check job to utilize cached GitHub release data and improve error handling Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.4

Mon, 18 Aug 2025 20:22:07 GMT

BunkerWeb 1.6.4 adds human-readable size values for ModSecurity request body limits and expands Linux platform support. • Enhances the `ModSecurity` plugin to accept human-readable size values (e.g., `10m`, `512k`) for request body limits on requests without files. • Adds Linux package support for RHEL 10.0. • Adds Linux package support for Debian 13 (Trixie). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.3

Tue, 05 Aug 2025 00:00:00 GMT

BunkerWeb 1.6.3 adds multi-path Redirects, configurable antibot alphabet and split installation types • `Redirect` plugin now supports multiple source/destination paths for routing • `ANTIBOT_CAPTCHA_ALPHABET` environment variable allows custom character sets for CAPTCHAs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.3-rc3 (Prerelease)

Wed, 30 Jul 2025 00:00:00 GMT

BunkerWeb 1.6.3-rc3 adds custom robots.txt headers/footers and new DNS providers for Let's Encrypt • `ROBOTSTXT_HEADER` and `ROBOTSTXT_FOOTER` settings added to customize the `robots.txt` file content (Base64 encoded) • `domainoffensive.de` added as a supported DNS provider in the `letsencrypt` plugin • `Dynu` added as a supported DNS provider in the `letsencrypt` plugin Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.3-rc2 (Prerelease)

Tue, 29 Jul 2025 00:00:00 GMT

BunkerWeb 1.6.3-rc2 adds PRO setup wizard steps, Linux CrowdSec auto-install, and TOTP env var alias • Add `Advanced settings` section to the setup wizard to configure `SERVER_NAME` and the Let's Encrypt plugin • Add `TOTP_ENCRYPTION_KEYS` as an alias for the `TOTP_SECRETS` environment variable • Add CrowdSec automatic installation/configuration in the easy-install script for Linux distributions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.3-rc1 (Prerelease)

Sat, 19 Jul 2025 00:00:00 GMT

Adds BunnyNet DNS provider support and new `robotstxt` plugin for automated robots.txt management. • Add `BunnyNet` as a DNS provider in the `letsencrypt` plugin • Add new `robotstxt` plugin to manage the robots.txt file from settings and serve it Breaking changes: • Dropped support for Fedora 40 in this release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.2

Tue, 08 Jul 2025 13:52:33 GMT

BunkerWeb v1.6.2 adds Redis-backed metrics, custom Let's Encrypt profiles, a UI healthcheck endpoint, and smarter download caching. • Implements Redis-backed metrics storage with optimized retrieval workflows for faster, more reliable performance. • Adds support for custom Let's Encrypt profiles and logs profile changes during renewal. • Adds an optional `/healthcheck` endpoint to the web UI for health monitoring, enabled via the `ENABLE_HEALTHCHECK` setting. • Refactors download scripts to canonicalize and deduplicate URLs before fetching, with smarter cache management. • Enhances logging to differentiate between allowed and denied access based on whitelist status. • Updates CrowdSec (All-in-One) to v1.6.9. • Updates CoreRuleSet to v4.16.0. • Adds 'Go Back' button functionality on the unauthorized page. • Improves dynamic translation handling and updates chart rendering on theme and language changes. • Documents Valkey support alongside Redis for data persistence and caching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.2-rc7 (Prerelease)

Wed, 25 Jun 2025 00:00:00 GMT

BunkerWeb 1.6.2-rc7 adds `number` and `multivalue` setting types for UI inputs • Adds the `number` setting type to allow numeric validation in the web UI settings form Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.2-rc5 (Prerelease)

Tue, 17 Jun 2025 00:00:00 GMT

Adds `LETS_ENCRYPT_PASSTHROUGH` setting to Let's Encrypt plugin for upstream passthrough • Adds `LETS_ENCRYPT_PASSTHROUGH` environment variable to the `Let's Encrypt` plugin configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.2-rc4 (Prerelease)

Thu, 12 Jun 2025 00:00:00 GMT

BunkerWeb 1.6.2-rc4 adds `multiselect` setting type, community blacklist plugin, and header hiding for reverse proxy • `BLACKLIST_COMMUNITY_LISTS` setting added to `blacklist` plugin for selecting community blocklists • `REVERSE_PROXY_HIDE_HEADERS` setting added to `Reverse Proxy` plugin to hide upstream HTTP headers • `multiselect` setting type introduced for choosing multiple options from a configurable list in plugins Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.2-rc3 (Prerelease)

Fri, 06 Jun 2025 00:00:00 GMT

v1.6.2-rc3 adds `LETS_ENCRYPT_MAX_RETRIES` config, Docker secrets support, and CrowdSec/Redis integration in all-in-one image. • Add `LETS_ENCRYPT_MAX_RETRIES` setting to the `Let's Encrypt` plugin to configure certificate retry count • Add clear notifications feature to both UI and backend for improved notification management • Improve plugin navigation by displaying plugins as a vertical list on the left side of the card • Display a small "enabled/disabled" icon next to each plugin name in the plugin sidebar • Update QR code generation to use PilImage and output JPEG format • Add a modal to update ban durations, with support for localization • Add system memory usage monitoring to the home page dashboard • Refactor the data display on the report page for a more user-friendly experience • Add quick actions for bans back • Enhance reset button visibility and tooltip handling across various settings templates • Add the possibility to delete cache files • Provide an interactive installer script for BunkerWeb that guides users through setup options Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.2-rc2 (Prerelease)

Mon, 19 May 2025 00:00:00 GMT

BunkerWeb 1.6.2-rc2 adds LE profile options, IONOS DNS support, plaintext cert data, underscore header control, manual cert deletion, and UI multi-language. • Adds `LETS_ENCRYPT_PROFILE` setting to choose certificate generation profiles (`classic`, `tlsserver`, `shortlived`) in the Let's Encrypt plugin • Adds `CUSTOM_SSL_CERT_DATA` and `CUSTOM_SSL_KEY_DATA` settings to accept plaintext or base64-encoded custom certificate data in the `customcert` plugin • Adds `IONOS` as a supported DNS provider in the `letsencrypt` plugin • Adds `REVERSE_PROXY_UNDERSCORES_IN_HEADERS` setting (default `no`) to control underscore handling in the Reverse Proxy plugin • Adds `LETS_ENCRYPT_CUSTOM_PROFILE` setting to allow a custom profile for the Let's Encrypt plugin • Adds `LETS_ENCRYPT_DISABLE_PUBLIC_SUFFIXES` setting (default `yes`) to disable public suffix checks in the Let's Encrypt plugin • Adds permanent ban feature to the `badbehavior` plugin, web UI, and bwcli • Adds manual deletion of Let's Encrypt certificates via the web UI • Introduces multi-language support (ar, bn, en, es, fr, hi, pt, ru, ur, zh, de, it) in the web UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.2-rc1 (Prerelease)

Sat, 29 Mar 2025 00:00:00 GMT

v1.6.2-rc1 adds configurable SSL cipher levels, Antibot filter options, and Infomaniak DNS provider to letsencrypt plugin. • Adds `modern`, `intermediate`, and `old` cipher level options to the `SSL` plugin configuration for granular control over TLS settings • Adds custom cipher list support in the `SSL` plugin configuration via a new field (implied by ability to set) • Adds configuration options in the `Antibot` plugin to ignore specific request attributes: `URI`, `IP`, `reverse DNS`, `ASN`, and `User-Agent` • Allows configuration of the algorithm used for generating self-signed certificates in the `Self-signed certificate` plugin (default: `ec-prime256v1`) • Adds `Infomaniak` as a supported DNS provider option within the `letsencrypt` plugin Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.1

Sat, 15 Mar 2025 17:29:17 GMT

BunkerWeb v1.6.1 ships an all-in-one Docker image and promotes CrowdSec to a built-in core plugin. • New `all-in-one` Docker image bundles BunkerWeb, Scheduler, Autoconf, and UI into a single container for simplified deployments. • Adds `CrowdSec` as a core plugin, bringing crowd-sourced threat intelligence natively into BunkerWeb without a separate integration. • Enhances Let's Encrypt DNS credential handling to accept base64-encoded values and properly process escape sequences. • Improves ban handling in the UI with stronger validation and informative responses scoped to ban scope and service. • Adds failover message reporting in the UI for better visibility into service continuity events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.1-rc2 (Prerelease)

Thu, 27 Feb 2025 00:00:00 GMT

v1.6.1-rc2 adds `PROXY_BUFFER_SIZE` and `PROXY_BUFFERS` settings, custom plugin hooks/blueprints, and UI indicators for cloned service settings • Adds `PROXY_BUFFER_SIZE` and `PROXY_BUFFERS` environment variables to control proxy buffer configuration in `multisite` mode. • Enables developers to create custom plugins using hooks and blueprints instead of relying solely on the plugin page. • Displays a visual label in the UI to indicate which service settings have been cloned from the original. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.1-rc1 (Prerelease)

Thu, 20 Feb 2025 00:00:00 GMT

v1.6.1-rc1 adds deSEC DNS provider support and several web UI enhancements. • Adds `deSEC` DNS provider support in `letsencrypt` plugin • Makes services created with the `autoconf` method editable in the web UI • Adds an instance hostname validation in the `instances` page when adding a new instance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.6.0

Fri, 14 Feb 2025 11:01:08 GMT

BunkerWeb 1.6.0 adds mCaptcha antibot mode and a new ModSecurity global CRS setting to speed up multi-service config generation. • Adds mCaptcha as a new antibot mode for bot protection. • New `USE_MODSECURITY_GLOBAL_CRS` setting lets you share a single CRS across all services instead of per-service CRS, accelerating configuration generation at scale. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.0-rc3 (Prerelease)

Sun, 26 Jan 2025 00:00:00 GMT

BunkerWeb v1.6.0-rc3 adds bulk reporting in BunkerNet, Kubernetes ConfigMap overrides via annotation, a new anonymized support page, and Fedora 41 support. • Adds `bunkerweb.io/CONFIG_TYPE=settings` annotation to Kubernetes ConfigMaps for easy setting overrides • Introduces an anonymized 'Support' page in the UI for quick log and configuration sharing • Updates BunkerNet logic to send reports in bulk instead of one by one • Adds Fedora 41 as a supported platform Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.0-rc2 (Prerelease)

Tue, 21 Jan 2025 00:00:00 GMT

BunkerWeb 1.6.0-rc2 adds `SSL` plugin, `bwcli plugin_list`, and `stream` support for Kubernetes integration • Introduces the `ssl` plugin to manage SSL/TLS settings independently of the `misc` plugin • Adds the `plugin_list` command to the `bwcli` utility for listing available plugins and their commands • Enables `stream` support within the `Kubernetes` integration Breaking changes: • The `MODSECURITY_CRS_PLUGIN_URLS` setting is renamed to `MODSECURITY_CRS_PLUGINS` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.0-rc1 (Prerelease)

Fri, 10 Jan 2025 00:00:00 GMT

BunkerWeb 1.6.0-rc1 adds multi-user Auth basic, TCP toggle, country tracking bans, and new session/config flags. • `CHECK_PRIVATE_IP` config key added to manage session IP address changes for private networks • `ALWAYS_REMEMBER` functionality implemented for session persistence in login UI • New temporary UI service displays startup errors if any occur while web UI is starting up • Health check endpoint added and integrated into the scheduler for instance status monitoring • Country tracking added to bans data • `MODSECURITY_REQ_BODY_NO_FILES_LIMIT` setting allows configuring SecRequestBodyNoFilesLimit in ModSecurity • Multi-user support added to `Auth basic` plugin • TCP toggle listening supported in server-stream configuration, ensuring UDP does not replace TCP when activated • `LISTEN_STREAM_PORT` and `LISTEN_STREAM_PORT_SSL` settings now accept multiples to allow listening on multiple ports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.6.0-beta (Prerelease)

Tue, 10 Dec 2024 00:00:00 GMT

BunkerWeb 1.6.0-beta adds HTTP/3 limits, TOTP encryption, DNS prefetch control, and CoreRuleset plugin support via new env vars • Adds `USE_MODSECURITY_CRS_PLUGINS` and `MODSECURITY_CRS_PLUGIN_URLS` environment variables to automatically download and install Coreruleset plugins. • Adds the X-DNS-Prefetch-Control header functionality with the `X_DNS_PREFETCH_CONTROL` setting (default is off) to control DNS prefetching behavior. • Adds a new `securitytxt` plugin to manage the security.txt file from settings and serve it. • Adds the `REVERSE_PROXY_PASS_REQUEST_BODY` setting to control if the request body should be passed to the upstream server (default is yes). • Allows controlling job history size via the `DATABASE_MAX_JOBS_RUNS` setting (default is 10000), with future UI visibility. • Adds HTTP/3 connections limiting via the `HTTP3_CONNECTIONS_LIMIT` setting (default is 100) in the `limit` plugin. • Adds a new templating feature to quickly override default values of settings and custom configurations, including UI steps for service configuration. • Allows setting a custom timezone for every service via the `TZ` environment variable, applying to logs and database date fields. • Enables running plugins jobs in async mode by setting the `async` key to `true` in the plugin job configuration (default is `false`). • Adds Let's Encrypt DNS challenges support. • Adds the `REMOTE_PHP_PORT` setting to control the port used by the remote PHP feature (default is 9000). • Updates the scheduler to use the `BUNKERWEB_INSTANCES` environment variable (replacing `OVERRIDE_INSTANCES`) for instance configuration. • Adds the `NAMESPACES` environment variable to the autoconf feature for setting namespaces to watch in multi-instance clusters. • Adds the `USE_KUBERNETES_FQDN` environment variable (default is yes) to use FQDNs instead of IPs for instance hostnames in Kubernetes. • Adds support for Fedora 41 and drops support for Fedora 40. • Refactors the UI to be more modular and easier to maintain. • Adds a `remember me` feature to the login page, keeping users logged in for 31 days. • Adds the `TOTP_SECRETS` setting to encrypt TOTP secrets in the database; recommends setting a custom value to prevent erasure on volume deletion. • Makes the 2FA feature more user-friendly and adds recovery codes for lost access. • Refactors UI log handling to read directly from `/var/log/bunkerweb` instead of using integration-specific logic. Breaking changes: • Fedora 40 is no longer supported; systems on Fedora 40 must migrate to Fedora 41 or another supported platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.11

Sun, 10 Nov 2024 18:03:31 GMT

BunkerWeb v1.5.11 adds worker dict size control and API timeout settings, plus updates OWASP CRS to v4.8.0 and v3.3.7. • New `WORKERLOCK_MEMORY_SIZE` setting lets operators tune the worker dictionary memory size. • New `API_TIMEOUT` and `API_READ_TIMEOUT` settings enable fine-grained control over API timeout behaviour. • Updates OWASP Core Rule Set v4 to v4.8.0 and v3 to v3.3.7, bringing the latest WAF detection rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.9

Wed, 24 Jul 2024 14:06:14 GMT

BunkerWeb v1.5.9 adds SNI-based upstream support with new REVERSE_PROXY_SSL_SNI settings. • Adds `REVERSE_PROXY_SSL_SNI` and `REVERSE_PROXY_SSL_SNI_NAME` settings to support SNI-based TLS upstream connections in reverse proxy configurations. • Updates the web UI setup wizard to handle scenarios where a reverse proxy already exists but no admin user is configured. • Moves Linux package repository to `repo.bunkerweb.io`. • Updates CoreRuleSet to v4.5.0, bringing the latest WAF detection rules. • Updates security headers on default and error pages for improved posture. Breaking changes: • Linux packages are now served from `repo.bunkerweb.io` instead of the previous packagecloud.io repository — existing package manager configurations pointing to the old repo URL must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.8

Wed, 19 Jun 2024 12:06:00 GMT

Adds DATABASE_URI_READONLY fallback, HTTP/3 support, and nightly OWASP CRS builds to BunkerWeb v1.5.8 • Add automatic fallback to either read-only on the primary database or to the read-only database URI when the main database URI is not available and automatically switch back to the main database URI when it becomes available again • Add new DATABASE_URI_READONLY setting to allow setting up a fallback read-only database URI in case the main database URI is not available • Enhance security on error pages, default server page and loading page by adding a custom `Content-Security-Policy` header with nonces and removing the `Server` header • Add experimental support of HTTP/3 (QUIC) • Add nightly build of the OWASP coreruleset that are automatically downloaded and updated Breaking changes: • Drop support for Fedora 39 in favor of Fedora 40 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.7

Tue, 14 May 2024 18:31:09 GMT

BunkerWeb 1.5.7 adds a backup/restore plugin, `LETS_ENCRYPT_CLEAR_OLD_CERTS` and `DISABLE_DEFAULT_SERVER_STRICT_SNI` settings, and custom bwcli command support. • Adds the `backup` plugin to allow easy database backup and restore operations • Adds `LETS_ENCRYPT_CLEAR_OLD_CERTS` environment variable (default: `no`) to control removal of old Let's Encrypt certificates during generation • Adds `DISABLE_DEFAULT_SERVER_STRICT_SNI` environment variable (default: `no`) to permit or block requests when the SNI header is unknown or unset • Enables custom `bwcli` commands via plugins, expanding the CLI tool surface • Supports Ubuntu 24.04 (Noble) as a new Linux distribution target • Adds combobox plugin search on the Global config / services page for faster plugin discovery Breaking changes: • Drops support for ansible and vagrant integrations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.6

Mon, 25 Mar 2024 21:00:10 GMT

BunkerWeb v1.5.6 adds metrics plugin, Redis Sentinel, new UI pages, and several settings like REDIS_SSL_VERIFY • Adds `REDIS_SSL_VERIFY` setting to activate/disable SSL certificate verification when using Redis • Adds automatic Redis Sentinel fallback to master if no slaves are available • Adds Redis Sentinel support for bwcli • Adds new Metrics core plugin that allows metrics collection and retrieval of internal metrics • Adds `DATABASE_LOG_LEVEL` setting to control SQLAlchemy loggers separately from the main one • Adds whitelist check for the default-server as well • Adds ability to choose between coreruleset v3 and v4 for ModSecurity (default is v3) • Adds `TIMERS_LOG_LEVEL` setting to control the log level of the lua timers • Adds pro version management to core plugins, the scheduler and the web UI • Adds `REVERSE_PROXY_CUSTOM_HOST` setting to set a custom Host header when using reverse proxy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.5

Fri, 12 Jan 2024 11:47:17 GMT

BunkerWeb v1.5.5 adds 2FA to the Web UI, Anonymous reporting, Redis Sentinel support, and configurable reverse proxy includes. • Adds `REVERSE_PROXY_INCLUDES` environment variable to manually inject include directives into reverse proxy configurations • Adds 2FA support for authentication in the BunkerWeb Web UI • Adds Anonymous reporting feature for system health statistics • Adds Redis Sentinel support for high-availability Redis deployments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.4

Tue, 05 Dec 2023 10:40:49 GMT

BunkerWeb v1.5.4 adds an optional setup wizard to the web UI and extends Linux package support. • Supports Debian 12, Fedora 39 and RHEL 8.9 via Linux packages Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.2

Sun, 10 Sep 2023 15:43:14 GMT

BunkerWeb v1.5.2 adds ModSecurity JSON LogFormat support and publishes Docker images to ghcr.io. • `ghcr.io/bunkerity/bunkerweb:*` Docker tags are now available for BunkerWeb components • Supports `ModSecurity JSON LogFormat` for log output configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.5.2

Sun, 10 Sep 2023 00:00:00 GMT

BunkerWeb 1.5.2 adds ModSecurity JSON LogFormat support and GitHub Container Registry publishing. • Push Docker images to GitHub packages (ghcr.io repository) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.1

Tue, 08 Aug 2023 19:11:07 GMT

v1.5.1 adds Turnstile antibot mode, custom redirect status codes, header preservation, and local plugin downloads. • `REDIRECT_TO_STATUS_CODE` environment variable to choose between 301 and 302 for redirects • `KEEP_UPSTREAM_HEADERS` to preserve headers when using reverse proxy • Turnstile antibot mode support • Download lists and plugins from a local file instead of remote sources • Support for tar.gz and tar.xz files for external plugins Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.5.0

Tue, 23 May 2023 00:49:04 GMT

BunkerWeb v1.5.0 introduces a dedicated scheduler service, database-backed configuration, RHEL integration, and initial TCP/UDP stream support. • Adds `bunkerity/bunkerweb-scheduler:1.5.0` Docker tag for the new dedicated scheduler service managing jobs and configuration • Enables storing configuration in a database backend instead of flat files • Adds RHEL integration support • Initializes support for generic TCP/UDP (stream) protocols • Initiates support for IPv6 • Adds Redis support for clustered integrations • Adds Vagrant integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb 1.5.0-beta (Prerelease)

Tue, 02 May 2023 00:00:00 GMT

BunkerWeb v1.5.0-beta adds Redis for clustered integrations, RHEL and Vagrant support, and initial IPv6/TCP/UDP stream capabilities. • `Add Redis support when using clustered integrations` allows backend configuration caching for scaled deployments • `Add RHEL integration` enables deployment on Red Hat Enterprise Linux systems • `Add Vagrant integration` provides a ready-made development environment setup • Init support of generic TCP/UDP (stream) extends the proxy to handle non-HTTP protocols • `Init support of IPv6` allows binding and traffic handling over IPv6 networks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb

BunkerWeb v1.4.4

Thu, 10 Nov 2022 17:07:34 GMT

BunkerWeb v1.4.4 adds greylisting, Blacklist ignore settings, ModSecurity limits, API manual bans, and new env vars • Adds `greylist` core feature to allow temporary bypass of blocking rules for trusted sources • Adds `BLACKLIST_IGNORE_*` settings to exclude specific IPs or ranges from global blacklists • Add automatic change of SecRequestBodyLimit modsec directive based on MAX_CLIENT_SIZE setting • Add `MODSECURITY_SEC_RULE_ENGINE` and `MODSECURITY_SEC_AUDIT_LOG_PARTS` settings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bunkerweb