Google Cloud Armor vs Cloudflare WAF
SEPT 2026 auditA comparison of Google Cloud Armor and Cloudflare WAF built from values read directly from each provider's own documentation, with the source recorded against every figure.
The short answer
Choose Google Cloud Armor if…
Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.
Editorial · Palash Bagchi · approved
Choose Cloudflare WAF if…
Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.
Editorial · Palash Bagchi · approved
Consider something else if…
- Google Cloud Armor: Your policies are regional. The SLA drops to 99.9% for regionally-scoped backend policies, so the commitment depends on an architecture choice rather than on the tier you bought — and the Enterprise tiers that bundle request volume carry a one-year commitment.
- Cloudflare WAF: You need the SLA or PCI DSS. Both start at the $200 Business plan — the 100% uptime commitment and PCI DSS 4.0 compliance are absent from Free and Pro, which is a tenfold step up from $20 to reach them.
3 sourced criteria separate them — see where, with sources, below.
Pick the criteria you care about. The chart counts how many of them lean toward each provider — the same read as scanning the bars below, just totalled for the ones you chose.
Google Cloud Armor 0
Cloudflare WAF 0
At a glance.
| Criterion | Google Cloud Armor | Cloudflare WAF |
|---|---|---|
| Pricing | ||
| Entry paid plan | $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730. | $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. |
| Pricing model | Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing. | Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. |
| Infrastructure | ||
| Uptime SLA | 99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier. | 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. |
Where they differ.
Entry paid plan
- Google Cloud Armor
- $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730.
- Cloudflare WAF
- $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Sources (2) →Sources ↓
- Cloud Armor pricing ↗
“Security policies $0.006849315 / 1 hour”
Read 2026-09-15 · official pricing
- Cloudflare Plans ↗
“$20 /mo billed annually, or $25/mo billed monthly”
Read 2026-09-15 · official pricing
Pricing model
- Google Cloud Armor
- Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing.
- Cloudflare WAF
- Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests.
Sources (2) →Sources ↓
- Cloud Armor pricing ↗
“Data processing fee None Yes; see the following section Yes; see the following section Time commitment None None One year”
Read 2026-09-15 · official pricing
- Cloudflare Plans ↗
“Web Application Firewall (WAF) Free Pro Business Contract”
Read 2026-09-15 · official pricing
Uptime SLA
99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier.
100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines.
Sources (2) →Sources ↓
- Google Cloud Armor Service Level Agreement ↗
“Google Cloud Armor - Globally-scoped Security Policies >=99.99%”
Read 2026-09-15 · official docs
- Cloudflare Plans ↗
“Uptime SLA — — 100% 100%”
Read 2026-09-15 · official pricing
When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.
Documented by only one.
These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing.
Questions this comparison answers.
Entry paid plan: Google Cloud Armor or Cloudflare WAF?
Google Cloud Armor: $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730.
Cloudflare WAF: $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Should I choose Google Cloud Armor or Cloudflare WAF?
Pick Google Cloud Armor if Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.
Pick Cloudflare WAF if Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.