# Cloudflare WAF

Canonical: https://inetgeek.com/waf/cloudflare-waf/

A web application firewall included in a plan rather than metered, with a 100% uptime SLA on the business tier.

## Who it suits

Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.

Consider something else if You need the SLA or PCI DSS. Both start at the $200 Business plan — the 100% uptime commitment and PCI DSS 4.0 compliance are absent from Free and Pro, which is a tenfold step up from $20 to reach them.

## iScore

69 / 100 (80% interval 65–73), rank 1 of 4 in waf — interval overlaps the next rank, so this is an ordering, not a finding.

inetGeek's own reading, computed from sourced facts against category peers by disclosed rules. Not a provider claim. Intervals are 80%; a provider with few documented facts is pulled toward the category middle rather than scored on what little is known.
Method: https://inetgeek.com/iscore/. Full output with every criterion's basis: https://inetgeek.com/scores.json. Every waf peer ranked: https://inetgeek.com/waf/cloudflare-waf/alternatives/

- Price: 69 (62–75), weight 50%, 2 of 2 criteria scored
- Trust and compliance: 48 (41–56), weight 30%, 2 of 2 criteria scored
- Evidence: 100 (100–100), weight 20%, 4 of 4 criteria scored

## What the documentation says

### Pricing

- Free tier: Yes ([source](https://www.cloudflare.com/plans/), read 2026-09-15)
- Entry paid plan: $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. ([source](https://www.cloudflare.com/plans/), read 2026-09-15)
- Pricing model: Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. ([source](https://www.cloudflare.com/plans/), read 2026-09-15)

### Infrastructure

- Uptime SLA: 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. ([source](https://www.cloudflare.com/plans/), read 2026-09-15)

### Compliance

- PCI DSS: PCI DSS 4.0 compliance is listed as a Business-plan feature, not available on Free or Pro. ([source](https://www.cloudflare.com/plans/), read 2026-09-15)

## Compared with

- [Cloudflare WAF vs AWS WAF](https://inetgeek.com/compare/aws-waf-vs-cloudflare-waf/)
- [Cloudflare WAF vs Google Cloud Armor](https://inetgeek.com/compare/google-cloud-armor-vs-cloudflare-waf/)
- [Cloudflare WAF vs Sucuri](https://inetgeek.com/compare/cloudflare-waf-vs-sucuri/)