BunkerWeb Hosting Live In 5 Minutes

BunkerWeb hosting on xCloud gives you a self-hosted web application firewall and reverse proxy, built on NGINX, with ModSecurity, bot challenges and rate limits in front of your sites. Deploy BunkerWeb from the OneClick catalog and xCloud starts the pinned all-in-one image, creates your administrator from the username you choose and a generated password, mounts a data volume and publishes the web UI over HTTPS. You open the data-plane ports in your own firewall.

Deploy your BunkerWeb

No terminal
No technical skills needed
No lock-in, cancel anytime

What is BunkerWeb?

BunkerWeb is an open-source Web Application Firewall that its README describes as a full-featured web server, based on NGINX, that protects your web services to make them secure by default. It lists an integrated ModSecurity WAF with the OWASP Core Rule Set, automatic Let's Encrypt, HTTP security headers, automatic ban of strange behaviour, connection and request limits, bot challenges and blocking of known bad IPs, with an optional web UI and a plugin system. Self-hosted BunkerWeb is a self-hosted web application firewall you run yourself, in place of a managed service such as Cloudflare's WAF. Its licence is AGPL-3.0.

Here, this template deploys BunkerWeb 1.6.15 as the upstream all-in-one image, pinned by digest, running NGINX, the scheduler, the web UI and an embedded Redis in one container. The bunkerweb_data volume holds the database, configuration and two-factor keys. The data plane is published on ports 8080, 8443 and UDP 8443, which you open yourself, and it is a singleton per server.

From Sign-Up to a Live Firewall UI In Just 3 Easy Steps

A self-hosted BunkerWeb normally means running the scheduler, web UI and NGINX data plane, creating an administrator, keeping the data and issuing a certificate for the UI. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick BunkerWeb from the OneClick catalog. Choose your domain and target server, and optionally set the administrator username (default admin).
Step 02
We Deploy It For You
One click. We bring up the official all-in-one BunkerWeb image pinned by immutable digest — BunkerWeb, scheduler, web UI and embedded Redis in one container — mount the bunkerweb_data volume, create the administrator with a generated password, and publish the web UI over HTTPS on your domain.
Step 03
Protect Your First Service
Save the administrator password from the protected installation credentials and allow one to two minutes for the first start. Open your HTTPS BunkerWeb URL, sign in, create your first protected service under Services pointing at your application, and open the data-plane ports in your own firewall.

Everything BunkerWeb Does, On Your Own Server

The open-source BunkerWeb runs here: a web application firewall and reverse proxy with a web UI on your own domain, with its data on a volume you own.

ModSecurity And OWASP CRS
Put a WAF with ModSecurity and the OWASP Core Rule Set in front of your own web applications.
Bots, Bans And Rate Limits
Block bots with challenges, plus bad-behaviour banning and rate limiting, as listed by upstream.
Web UI For Services
Manage protected services, settings and configuration from the BunkerWeb web UI.
Administrator From Install
The administrator account is created at install, so the UI requires login immediately and there is no setup wizard or open sign-up page.
HTTP, HTTPS And HTTP/3 Data Plane
Protected traffic is served on dedicated ports: 8080/tcp for HTTP, 8443/tcp for HTTPS and 8443/udp for HTTP/3 (QUIC), different from 80 and 443.
One Volume Keeps It All
bunkerweb_data holds the database, cache, custom configuration and plugins, session secret and administrator two-factor keys, and survives an xCloud Restart.

Everything You Need To Run Your Web Firewall 24/7

Managed hosting for BunkerWeb, so the parts that keep it online are not your problem.

BunkerWeb 1.6.15 deployed instantly
Official image pinned by digest
Generated administrator password
Web UI behind login from first start
Free SSL certificate
Server backups and snapshots
Server security updates included
30+ server locations
Unused balance refunded

What You Can Do With BunkerWeb

Put a WAF in front of a web application
An operator adds a service in the web UI and sends traffic through BunkerWeb, so ModSecurity and the OWASP Core Rule Set filter requests before they reach the application.
Challenge bots and ban bad behaviour
A site owner turns on bot challenges, request limits and automatic bans for repeated error responses, tuning each setting from the web UI instead of editing NGINX files.
Automate certificates for protected sites
A team gives the sites BunkerWeb protects certificates through a Let's Encrypt DNS challenge or its own files, because the HTTP-01 challenge needs port 80, which this install does not use.
Own your WAF rules and logs
A security-minded team keeps its firewall configuration, plugins and the administrator's two-factor keys on a server it rents, rather than in a managed service's dashboard.

BunkerWeb vs Alternatives

Cloudflare WAF: Cloudflare's WAF is a managed service that comes with a global CDN and DDoS network. BunkerWeb is a firewall you run yourself on one server, and a self-hosted install does not provide a CDN or DDoS absorption.
CrowdSec: CrowdSec is a separate collaborative security engine with its own OneClick page. In this template BunkerWeb's CrowdSec integration stays off, so the two are independent choices.
Coraza: Coraza is a separate Go WAF library rather than a packaged server. BunkerWeb packages NGINX, ModSecurity, a web UI and plugins into one install.
Anubis: Anubis is a separate bot-challenge proxy with its own OneClick page. BunkerWeb also offers bot challenges, alongside ModSecurity, rate limits and Let's Encrypt automation, in one NGINX-based firewall.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for BunkerWeb hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom if BunkerWeb sits alongside other services.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. BunkerWeb itself is licensed under AGPL-3.0.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy BunkerWeb on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Run Your Own Web Application Firewall?

BunkerWeb on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own the server. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

Is BunkerWeb free?

Yes. BunkerWeb is licensed under the free AGPLv3 licence, linked from this page at the pinned v1.6.15 tag, and the template deploys the open-source version. Upstream also sells a PRO version and BunkerWeb Cloud, a managed service; neither is included. xCloud bills for the Cloud VPS under it, not for BunkerWeb.

Can you run BunkerWeb with Docker?

Yes, and this BunkerWeb Docker hosting template does it for you: the upstream all-in-one image, pinned by digest and built for several architectures, runs as one container on your own server, not in a BunkerWeb cloud account, with NGINX, the scheduler, the web UI and an embedded Redis together and the web UI behind HTTPS.

How much RAM does BunkerWeb need?

The manifest floor for BunkerWeb is 1024 MB RAM, one CPU core and 4 GB disk. Traffic volume, ModSecurity rule sets and the number of protected sites add load. This page sells the 6 GB tier, which leaves ample headroom. Only one install is allowed per server, because it owns fixed ports.

Which ports does BunkerWeb need open?

Only to use it as a reverse proxy: the data-plane ports 8080/tcp for HTTP, 8443/tcp for HTTPS and 8443/udp for HTTP/3 are published, but xCloud opens none of them in any firewall, so open them yourself. They are not 80 and 443, so Let's Encrypt HTTP-01 challenges do not work; use a DNS challenge or your own certificates.

Does BunkerWeb include ModSecurity?

Yes. Upstream's README lists an integrated ModSecurity WAF with the OWASP Core Rule Set, along with automatic banning of strange behaviour, connection and request limits, and bot challenges. You enable and tune them per service in the web UI. This page makes no claim about how well it blocks any specific attack.

Can BunkerWeb get Let's Encrypt certificates automatically?

Upstream lists HTTPS support with transparent Let's Encrypt automation for the services you protect. On this install the web UI sits behind xCloud's HTTPS, while the data plane does not use port 80, so HTTP-01 challenges will not work; use a DNS challenge or your own certificates.

Why can BunkerWeb not reach my other apps on the server?

Protected services must be reachable from the BunkerWeb container over the network, usually through a public URL. Other apps on the same server are not reachable by name or by 127.0.0.1, because each runs in its own network. Point a service at its public address, or plan a shared network yourself.

How do I back up BunkerWeb?

Include the bunkerweb_data volume in your backup: it holds the SQLite database, cache, custom configuration and plugins, the session secret and the administrator's two-factor keys. Keep the volume when you redeploy, copy it off the server, and test a restore on a disposable install.

Backup and restore Docker apps

How do I upgrade BunkerWeb?

Upgrades are not automatic. The template pins BunkerWeb 1.6.15 by immutable digest, and catalog changes reach new installs only. When a newer template version is published, back up the bunkerweb_data volume, study the upstream release notes, then adopt that version. Anonymous usage reporting is switched off in this template.

Is BunkerWeb a Cloudflare WAF alternative?

It is a self-hosted alternative to the WAF part: Cloudflare's WAF is a managed service bundled with a CDN and DDoS network, whereas BunkerWeb runs on your own server. This page makes no protection or performance comparison, and a single server cannot replace a global network, so choose by what you need.

How do I sign in, and how do I change the password?

Sign in at your HTTPS address with the username you chose and the generated password from the credentials panel. ADMIN_USERNAME and ADMIN_PASSWORD are re-applied on every start, so a password changed inside the UI is replaced at the next restart; edit them in the Environment editor instead, using eight or more characters with upper and lower case, a digit and a symbol.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.