Skip to content
inetGeek

Cloudflare WAF

iScore65–73 · #1/4
www.cloudflare.com/application-services/products/waf · WAF and DDoS
SEPT 2026 audit

A web application firewall included in a plan rather than metered, with a 100% uptime SLA on the business tier.

Visit Cloudflare WAF documentation
Compare Cloudflare WAF with

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

Entry paid plan$20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Free tierYes
CategoryWAF and DDoS

Updated 5 criteria comparedSources last checked

01.Evaluation guide

Who it suits

Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.

Consider something else if…

You need the SLA or PCI DSS. Both start at the $200 Business plan — the 100% uptime commitment and PCI DSS 4.0 compliance are absent from Free and Pro, which is a tenfold step up from $20 to reach them.

Editorial · Palash Bagchi · approved

Each value below links to the page it was read from, with the sentence it came from. Criteria Cloudflare WAF does not publish are not listed.

Pricing
3 criteria
Free tierYes
Sources (1) →
  • Cloudflare Plans ↗

    “Free Managed Ruleset Free Pro Business Contract”

    Read 2026-09-15 · official pricing

Entry paid plan$20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Sources (1) →
  • Cloudflare Plans ↗

    “$20 /mo billed annually, or $25/mo billed monthly”

    Read 2026-09-15 · official pricing

Pricing modelBundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests.
Sources (1) →
  • Cloudflare Plans ↗

    “Web Application Firewall (WAF) Free Pro Business Contract”

    Read 2026-09-15 · official pricing

Infrastructure
1 criteria
Uptime SLA100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines.
Sources (1) →
Compliance
1 criteria
PCI DSSPCI DSS 4.0 compliance is listed as a Business-plan feature, not available on Free or Pro.
Sources (1) →

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

Compare Cloudflare WAF withAll alternatives, ranked →
Cloudflare WAF vs AWS WAF
Cloudflare WAF vs Google Cloud Armor

Every page here is sourced and dated.