Skip to content
inetGeek

Cloudflare WAF pricing and limits

iScore60–87 · ≈#1/4
www.cloudflare.com/application-services/products/waf · WAF and DDoS
SEPT 2026 audit

A web application firewall included in a plan rather than metered, with a 100% uptime SLA on the business tier.

Visit Cloudflare WAF documentation

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

Entry paid plan$20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Free tierYes
CategoryWAF and DDoS

Reviewed by Palash BagchiUpdated 6 criteria comparedSources last checked

Cloudflare WAF pricing at a glance

Entry paid plan
$20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business source ↗
Pricing model
Bundled into a plan, not metered source ↗

First line of each sourced value. The full text is in Cloudflare WAF pricing below. How this free offer stacks up: cloud free tiers compared.

01.Evaluation guide

Who it suits

Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.

Consider something else if…

You need the SLA or PCI DSS. Both start at the $200 Business plan — the 100% uptime commitment and PCI DSS 4.0 compliance are absent from Free and Pro, which is a tenfold step up from $20 to reach them.

Editorial · Palash Bagchi · approved

Each value below links to the page it was read from, with the sentence it came from. Criteria Cloudflare WAF does not publish are not listed.

Cloudflare WAF pricing

4 criteria
Free tierYes
Sources (1) →
Credit card to startNo
Sources (1) →
Entry paid plan$20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Sources (1) →
Pricing modelBundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests.
Sources (1) →

Infrastructure

1 criteria
Uptime SLA100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines.
Sources (1) →

Compliance

1 criteria
PCI DSSPCI DSS 4.0 compliance is listed as a Business-plan feature, not available on Free or Pro.
Sources (1) →

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

Cloudflare WAF in the news

Headlines from other publications, not checked by us · collected

Selected by a search on this company, refreshed weekly. Nobody here has verified these claims — where something material is confirmed, it is written into the page above with its source, the way every other fact on this site is.

Cloudflare WAF pricing questions

How much does Cloudflare WAF cost?

$20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.

Cloudflare Plans · read

How does Cloudflare WAF charge?

Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests.

Cloudflare Plans · read

Does Cloudflare WAF have a free tier?

Yes.

Cloudflare Plans · read

Do you need a credit card to start on Cloudflare WAF?

No.

Pricing · read

What uptime does Cloudflare WAF guarantee?

100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines.

Cloudflare Plans · read

Comments

Every page here is sourced and dated.