Bunny Shield

What Bunny Shield actually is

Bunny Shield is the security layer of Bunny.net: a web application firewall, DDoS mitigation stack, rate limiter, bot detector, and upload scanner that sits in front of your sites and APIs on Bunny's edge network. It is a distinct product with its own pricing tiers, and it is the second half of the Bunny story — the CDN moves your bytes, Shield decides which bytes are allowed to arrive. In our firewall and DDoS category it is the pragmatic pick for anyone already on Bunny's network.

The docs describe the coverage plainly. A WAF that blocks OWASP Top 10 traffic, zero-day exploits, and emerging risks with AI-assisted rule recommendations and real-time logs. DDoS protection backed by 119 global scrubbing centers and a network the marketing page sizes at 250 Tbps+ (the docs' DDoS section cites 200 Tbps+). Rate limiting per IP, user, or path. Bot detection that classifies and neutralizes malicious automation. Access lists that block VPNs, Tor nodes, and other source categories before traffic reaches you. Upload scanning for viruses, malware, and CSAM — an inclusion that tells you where Bunny expects this product to be used: user-generated-content platforms. And API Guardian, which validates request shapes and authenticates traffic at the edge so malformed or abusive calls die before they touch your origin.

The vendor claims 1.5 million protected properties and a peak mitigated attack above 700 Gbit; treat both as vendor figures, but they are the kind of figures a scrubbing network earns rather than invents. The customer wall behind them (TradingView, Streamable, Hyundai, TCL, Samsung Food, WP Rocket among the logos) points at real production traffic.

Pricing: what you really pay

Bunny Shield's pricing table is one of the more complete ones in this category, and we credit that. Four tiers. Basic is free: 71 basic WAF rules, 2 rate-limit rules, 25 million requests per month with overage at $0.70 per million, basic OWASP Top 10 protection, a Bunny-branded block/challenge page, 256 KB body inspection, one custom access list with 1,000 entries, and 250,000 upload scans covering CSAM. Advanced is $9.50 per month: 255 basic WAF rules plus 10 custom WAF rules, 10 rate-limit rules, 50 million requests (overage $0.65 per million), extensive OWASP coverage, non-branded challenge pages, 512 KB body inspection, simple-bot mitigation, 6 curated threat lists, 5 custom lists with 5,000 entries, and 500,000 scans covering CSAM and antivirus. Business is $99 per month: 25 custom WAF rules, 25 rate-limit rules, 250 million requests (overage $0.60 per million), 1 MB body inspection, complex-bot mitigation, 15 curated lists, 10 custom lists with 15,000 entries, and 2.5 million scans. Enterprise is quote-based and is where the expert-managed DDoS rules, zero-day protection, expert-led onboarding, and enhanced SLAs live.

Our read of that matrix: the free tier is a genuine product, not a demo — 25 million requests a month covers a lot of real sites, and 71 managed WAF rules is meaningful protection. The $9.50 tier is where the product becomes serious (custom rules, bot mitigation, unbranded pages). The request-based overage model means a DDoS event that fails to be absorbed can show up as a bigger bill, which is exactly the moment you least want a surprise; set limits deliberately. And the placement of "expert managed DDoS rules" and enhanced SLAs in Enterprise only is the standard security-vendor move — the people most likely to need help during an attack are the ones on the paid-but-not-enterprise tiers.

Performance & infrastructure

Everything runs on the same edge network as Bunny CDN: 119 scrubbing centers, automatic failover, real-time PoP monitoring, and the IP-routing infrastructure described in our Bunny.net review. That co-location is the product's real advantage — there is no separate proxy hop, no second DNS provider, no additional latency stack to justify to your team. Security policies, CDN caching, and edge rules are configured in one panel against the same pull zones.

Inspection depth is where the tiers differentiate. Body inspection caps — 256 KB on free, 512 KB on Advanced, 1 MB on Business, 2 MB+ on Enterprise — bound how much of a request body the WAF examines, which matters for APIs accepting large payloads. WAF learning mode runs basic on free and "AI Insights" on the paid tiers, which in practice means rule recommendations tuned from your traffic rather than a static ruleset alone. Rate limiting, access lists, and challenge pages operate at the edge before origin, so the performance cost of protection is a few milliseconds of inspection rather than a detour through a scrubbing farm you can see on a latency graph.

One point we looked for and want to flag for security buyers: enforcement is consistent worldwide because the challenge pages, access lists, and rate-limit rules all execute on the same edge PoPs that cache your content, rather than depending on which scrubbing center a request lands in. Real-time logs are included at every tier, which matters more than it sounds — during an incident, the difference between a WAF that surfaces the offending requests in seconds and one that surfaces them an hour later is the difference between tuning a rule and cleaning up a compromise. Onboarding is self-service through the Business tier; the expert-led variant is an Enterprise conversation.

Reliability of the underlying network is documented through Bunny's platform SLA (99.99% uptime guarantee with a published outage-credit schedule) and the automatic-healing architecture described there. For the Shield product specifically, the operational track record is shorter than the CDN's — this is a newer product in Bunny's catalog — and we would weight that honestly rather than let the parent platform's decade stand in for it.

Where it falls short

The dependency is total: Bunny Shield protects properties served through Bunny's network. If your traffic is on Cloudflare, Akamai, or an on-premises load balancer, Shield is not the product for you. The corollary is that Bunny CDN customers get security almost for free, and everyone else gets nothing.

Against Cloudflare's WAF and bot management, the gaps are in depth and maturity: fewer rule categories, no published equivalent of a managed ruleset marketplace, thinner bot-classification documentation, and a much smaller body of community knowledge about edge cases. "AI Insights" for WAF learning is claimed but not deeply documented on the pages we reviewed. The same trust question applies to any young security product: the numbers on the pricing page are clear, but the war stories are still being written.

Tier ceilings deserve a careful read before purchase. Custom WAF rules cap at 10 (Advanced) and 25 (Business) — fine for most sites, constraining for large multi-tenant platforms. Custom access lists cap at 15,000 entries on Business. Bot mitigation is tiered so that simple bots are handled at $9.50 and complex bots require Business. And the request-based billing under attack, mentioned above, means the meter keeps running while you are being flooded unless you configure limits.

Who should pick this

Our pick for Bunny CDN customers who want meaningful WAF, rate limiting, and bot control without adding a second vendor or a second network hop. It is particularly well suited to user-generated-content platforms (the upload scanning for malware and CSAM is a real differentiator at this price), media sites under scrapers and credential-stuffing traffic, and small teams that want a free starting tier that is actually protective. If you run a WordPress site or SaaS front door on Bunny and have been living without a WAF, the free tier is where we would start this week.

We would not pick it as a stand-alone security layer for traffic that does not traverse Bunny, as a compliance substitute for an enterprise WAF with managed onboarding and contractual SLAs, or for organizations that need deep bot-management analytics and a ruleset ecosystem. If an attack on your property would be existential and you are not on Enterprise, pair Shield with origin-side defense in depth.

Key takeaways

• WAF, DDoS mitigation, rate limiting, bot detection, access lists, upload scanning, and API request validation on Bunny's 119-center edge network.
• Genuine free tier: 71 WAF rules, 25M requests/month, 250k upload scans; Advanced $9.50/month, Business $99/month, Enterprise by quote.
• Pricing transparency is a strength — the full feature matrix and overage rates ($0.60-0.70 per million requests) are published.
• Only useful in front of Bunny-served properties; there is no stand-alone deployment mode.
• Bot mitigation and inspection depth are tiered — complex-bot handling needs the $99/month Business tier.
• Our view in firewall and DDoS: strong value for Bunny CDN users, still maturing against Cloudflare-class WAF ecosystems.

Sources

• https://bunny.net/shield/
• https://bunny.net/docs/shield
• https://bunny.net/sla/
• https://subger.com/en/in/service/bunny-cdn