# Google Cloud Armor vs Cloudflare WAF

Canonical: https://inetgeek.com/compare/google-cloud-armor-vs-cloudflare-waf/

Every value below is read from Google Cloud Armor's and Cloudflare WAF's own documentation. See https://inetgeek.com/methodology/ for how.

## At a glance

| Criterion | Google Cloud Armor | Cloudflare WAF |
| --- | --- | --- |
| Entry paid plan | $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730. | $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. |
| Pricing model | Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing. | Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. |
| Uptime SLA | 99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier. | 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. |

## Where they differ

### Entry paid plan

- Google Cloud Armor: $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730. ([source](https://cloud.google.com/armor/pricing))
- Cloudflare WAF: $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. ([source](https://www.cloudflare.com/plans/))

### Pricing model

- Google Cloud Armor: Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing. ([source](https://cloud.google.com/armor/pricing))
- Cloudflare WAF: Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. ([source](https://www.cloudflare.com/plans/))

### Uptime SLA

- Google Cloud Armor: 99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier. ([source](https://cloud.google.com/armor/sla))
- Cloudflare WAF: 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. ([source](https://www.cloudflare.com/plans/))

## Which should you choose?

Pick Google Cloud Armor if Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.

Pick Cloudflare WAF if Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.

Consider something else: Google Cloud Armor — Your policies are regional. The SLA drops to 99.9% for regionally-scoped backend policies, so the commitment depends on an architecture choice rather than on the tier you bought — and the Enterprise tiers that bundle request volume carry a one-year commitment.

Consider something else: Cloudflare WAF — You need the SLA or PCI DSS. Both start at the $200 Business plan — the 100% uptime commitment and PCI DSS 4.0 compliance are absent from Free and Pro, which is a tenfold step up from $20 to reach them.

## Documented by only one

- Free tier: Cloudflare WAF: Yes
- Rate limits: Google Cloud Armor: $0.60 per million requests against regionally scoped security policies on Standard. The Enterprise tiers include request volume rather than metering it, so the per-request charge disappears at the point the commitment appears.
- PCI DSS: Cloudflare WAF: PCI DSS 4.0 compliance is listed as a Business-plan feature, not available on Free or Pro.

## Questions this comparison answers

**Entry paid plan: Google Cloud Armor or Cloudflare WAF?**

Google Cloud Armor: $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730.
Cloudflare WAF: $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.

**Should I choose Google Cloud Armor or Cloudflare WAF?**

Pick Google Cloud Armor if Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.
Pick Cloudflare WAF if Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.