WAF and DDoS
Each provider is profiled from its own pricing page, with the source recorded against every figure. Two of these charge per rule and per request and have arrived at identical rates; the other two charge for a plan and for a site. The column that matters is what the price counts, and beside it what each one commits to keeping up.
WAF and DDoS
| Provider | Entry paid plan | Published SLA | What is metered |
|---|---|---|---|
| AWS WAF | $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting. | 99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here. | Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments. |
| Cloudflare WAF | $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. | 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. | Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. |
| Google Cloud Armor | $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730. | 99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier. | Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing. |
| Sucuri | $229 a year for the Basic Platform — roughly $19 a month, but billed annually and per site rather than per request or per rule. Pro is $339 and Business $549, the difference being malware cleanup response time and scan frequency rather than capacity. | Not documented | Per site, per year, with no request metering at all. What the tiers buy is service rather than throughput: occasional cleanups on Basic, faster SSL transfers on Pro, fastest malware-cleanup response and more frequent scans on Business. A 30-day guarantee applies and the platform is described as agnostic to the host. |
Which to consider
Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.
Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.
Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.
One site, one annual price, and somebody else cleaning up the malware. $229 a year covers the firewall, a CDN and cleanups, with a 24/7 security team on every tier and no request metering at all.