Cloudflare WAF vs StackPath
A detailed comparison to help you choose between Cloudflare WAF and StackPath.
Quick Verdict
4.2/5
Cloudflare WAF
0 reviews
1.0/5
StackPath
0 reviews
Cloudflare WAF is rated higher (4.2 vs 1.0). Cloudflare's Web Application Firewall protects against OWASP Top 10, zero-day vulnerabilities, and DDoS. 300+ global PoPs absorb attacks. Free plan blocks basic threats; Pro adds OWASP managed rules. Defunct edge platform. StackPath closed all products and began liquidating assets in June 2024; its CDN line had already ceased in November 2023. Not purchasable.
Cloudflare WAF Web Application Firewall protecting millions of sites | StackPath Defunct edge platform (closed 2024) | |
|---|---|---|
| Overview | ||
| Rating | 4.2 (0 reviews)✓ | 1.0 (0 reviews) |
| Pricing model | freemium | discontinued |
| Starting price | Free tier available | Free tier available |
| Best for | Any website behind Cloudflare that wants a maintained application firewall and DDoS absorption as a baseline — from hobby projects on the free tier to compliance-bound businesses on Business or Enterprise. | Nobody in 2026 — StackPath was dissolved in June 2024. For the same CDN + WAF + DDoS + edge compute combination, look at Cloudflare, Fastly, or Akamai. |
| Features | ||
| IPv6 | ✓ | |
| DDoS protection | ||
| Automated backups | ||
| Snapshots | ||
| Managed option | ||
| Bare metal | ||
| GPU available | ||
| S3-compatible | ||
| Hourly billing | ||
| Free tier | ✓ | |
| Tags | ||
| Tags | free tierddos protectionapi accesseu datacenterus datacenterapac datacenter | free tierddos protectioneu datacenterus datacenterapac datacenter |
| Visit Cloudflare WAF → | Visit StackPath → | |
Cloudflare WAF
Pros
- + WAF engine and managed ruleset included on every plan, including Free
- + Unmetered DDoS absorption at the edge on all tiers
- + Central rules maintenance — no appliances, agents or rule deployments to manage
- + Attack-score and bot-management layers available as needs grow
- + Flat plan pricing; no per-request or per-rule metering
Cons
- - Advanced rate limiting, attack-score rules and full log export are plan-gated
- - Managed rules can block legitimate traffic; tuning requires a logging-first workflow
- - Free plan limits request body inspection to 1 MB
- - Only applies to proxied records — DNS-only traffic is not filtered
- - A compensating control, not a substitute for fixing application vulnerabilities
StackPath
Pros
- + Historically bundled CDN, WAF, DDoS, and edge compute under one account
- + Large final footprint (73 edge locations across 43 metro markets, company's own count)
- + Edge compute with VMs and containers in the same PoPs as content delivery
- + Backing from Juniper, Cox, and ABRY gave it enterprise credibility while it lasted
Cons
- - Company defunct since June 2024 — all products closed, assets liquidated, support switched off
- - CDN business sold to Akamai in 2023; customers stranded through three platform migrations in five years
- - Conflicting PoP counts across its own marketing pages (45 / 50+ / 73)
- - Any pricing or feature list found online is historical, not purchasable
Stay in the loop
Get weekly updates on the best new hosting and infrastructure providers, deals, and comparisons.
No spam. Unsubscribe anytime.