Cloudflare WAF

Web Application Firewall protecting millions of sites

4.2(0 reviews)freemiumUnited States

free tierddos protectionapi accesseu datacenterus datacenterapac datacenter

Integrates with

Cloudflare's Web Application Firewall protects against OWASP Top 10, zero-day vulnerabilities, and DDoS. 300+ global PoPs absorb attacks. Free plan blocks basic threats; Pro adds OWASP managed rules.

What Cloudflare WAF actually is

Cloudflare's Web Application Firewall is the request-inspection layer sitting in front of any site proxied through Cloudflare. Traffic terminates at one of Cloudflare's 330-plus data centers, gets scored and filtered against rules before it ever reaches your origin, and the malicious fraction is dropped at the edge. The important structural fact is that a WAF is included on every plan — Free through Enterprise — along with unmetered DDoS protection. In our view that changed the baseline for what a small site should expect from its hosting stack: firewall coverage stopped being a paid extra and became part of putting a site on the internet.

What "included" means in practice varies sharply by tier, and the honest review lives in those differences. All plans get the Cloudflare Managed Ruleset — a maintained rules package covering the OWASP-style attack classes like SQL injection and cross-site scripting, updated by Cloudflare as new patterns emerge — plus the ability to write custom rules and the underlying firewall engine. On the Free plan the managed ruleset runs with tighter constraints: request bodies are inspected up to 1 MB, and the rule controls are coarser. Paid plans raise those ceilings and expose more of the control surface.

Above the managed layer sit the features that security teams actually tune with: rules based on Cloudflare's attack score (a machine-learning signal that catches payloads no signature has seen), bot management, rate limiting, and logpush to external storage. Availability of these steps up the plan ladder. Rate limiting is the clearest example — every plan can rate limit, but the number of rules, the counting windows and the mitigation behaviors expand with the tier, with the most advanced variants reserved for Enterprise agreements. The free plan is a real firewall; it is not the full product.

The deployment model is the other half of the value. Because the WAF lives in Cloudflare's proxy rather than in a box or an agent at your origin, there is nothing to install, patch or scale. A WordPress site on cheap shared hosting and a Kubernetes front end get the same edge enforcement. That is the quiet revolution here, and it is why we recommend this configuration as a baseline even for sites that will never buy a Cloudflare plan.

Pricing: what you really pay

The firewall ships inside the application plans: Free at $0, Pro at $20 per month billed annually ($240 per year) or $25 billed monthly, Business at $200 per month billed annually ($2,400 per year) or $250 billed monthly, and Enterprise on custom terms. There is no separate WAF line item and no per-request charge. If you already pay for a Cloudflare plan, the marginal cost of the WAF is zero; if you were shopping for a dedicated WAF appliance or a managed rules subscription from another vendor, the comparison is against a $0-to-$250 per-domain-per-month envelope that includes CDN, DNS and TLS as well.

What each tier actually buys matters more than the price. Free includes the managed ruleset and unmetered DDoS protection. Pro adds image optimization and a more capable WAF surface. Business adds compliance-oriented features — the plan comparison lists PCI DSS 4.0 compliance support at Business and above — and the first uptime SLA at 100 percent with service credits at 1x the monthly fee. Enterprise contracts carry 10x credits standard and 25x with premium success, plus network prioritization and negotiated support.

The cost traps are the same ones we flag in our Cloudflare CDN review: per-domain billing stacks up across a portfolio, and the features security teams need for tuning (attack-score rules, advanced rate limiting, full log export) are plan-gated. A business that needs WAF logs in its SIEM should check the logpush availability on its tier before assuming the plan it picked covers compliance needs. We would rather you find that on the pricing page than in an audit.

One more pricing note with teeth: the WAF only functions on proxied (orange-clouded) records. DNS-only records are not filtered. That is architecture rather than billing, but it means the firewall is part of the CDN decision — you cannot take the WAF and leave the proxy.

Performance & infrastructure

All inspection happens at the edge, so the latency cost of the WAF is a few milliseconds of scoring at a data center that was already terminating the connection. For most sites the performance effect of enabling Cloudflare's WAF is a rounding error compared to the caching gains from being on the network at all. The managed ruleset is maintained centrally, so rule updates arrive without you deploying anything — a meaningful operational difference from self-hosted ModSecurity setups where rule maintenance is someone's job.

DDoS absorption is the related capability, and it is unmetered on every plan. Cloudflare's network takes the volumetric load before your origin sees a packet, which is the part of the product that is genuinely hard to replicate: the firewall filters application-layer attacks, while the network underneath absorbs the floods. The database entry for this product quotes a network capacity figure of 142 Tbps; we could not verify that number against a current primary source during this review, so we do not repeat it here. Cloudflare's own reporting describes the largest DDoS mitigation network with 330-plus data centers, and the capacity number on their site moves upward over time.

Operational transparency is decent. Firewall events are visible in the dashboard with matched rules and action taken, and paid tiers can push logs outward. The testing story is where we would urge caution: a WAF that has never blocked a false positive is usually a WAF that has never been tested. Managed rulesets occasionally block legitimate traffic — file uploads, unusual API payloads, admin tools — and the discipline of reviewing firewall events weekly before tightening actions from log to block is the difference between security and an outage.

Where it falls short

False positives are the standing cost of signature-and-score-based filtering, and Cloudflare's rules are no exception. The right posture is to run new rules in logging mode, watch what they catch, and promote them to blocking — a workflow the product supports but does not force. Sites with unusual request shapes (GraphQL endpoints, XML APIs, long JSON bodies) will hit the body inspection limits first: 1 MB on Free, higher above it. For those cases the firewall needs custom scoping, which means learning Cloudflare's rule language.

Plan gating is the second limitation. If your requirement is specifically "advanced rate limiting with fine-grained counters" or "attack-score-driven rules" or "full log streaming," verify the tier that includes it. The gap between the free managed ruleset and the Enterprise product is wide, and the product page language blurs where the line sits.

There is also the architectural constraint already mentioned: everything must flow through Cloudflare's proxy. For organizations with data-residency requirements or policies forbidding a third party from terminating TLS, an edge WAF of any kind is the wrong shape, and a host-based or origin-adjacent WAF is the alternative. And as with every Cloudflare product we review: a network incident at Cloudflare takes your protection and your availability down together.

Finally, WAFs are not application security. Cloudflare filters known attack patterns at the boundary; it does not fix an unparameterized query in your code. We have watched teams treat the WAF as remediation for vulnerabilities they should patch. It is a compensating control, not a substitute.

Who should pick this

Our baseline recommendation in /category/firewall-ddos for any site already proxied through Cloudflare, which is most of the sites on the internet. The free tier's managed ruleset plus unmetered DDoS protection is more protection than most small sites had five years ago at any price. Paid tiers make sense when compliance, tuning or SLA requirements appear — and the jump to Business at $200 per month billed annually is best made for the uptime guarantee and compliance features, not for the WAF alone.

Who should look elsewhere: organizations that cannot let a third party terminate TLS; teams needing on-premise or origin-side enforcement for regulatory reasons; and security teams that require deep custom rule development and full-fidelity logging on day one — those needs point at dedicated WAF vendors or the Enterprise tier, priced accordingly. For everyone else, this is the free security layer you should not leave turned off.

Key takeaways

A WAF and unmetered DDoS protection are included on every plan, including Free at $0.
Pro is $20 per month billed annually ($240/year) or $25 monthly; Business $200 annually ($2,400/year) or $250 monthly.
The Free managed ruleset is real but constrained: 1 MB body inspection, coarser rate limiting controls.
Attack-score rules, advanced rate limiting and full log export step up the plan ladder — verify your tier before buying for compliance.
WAF only covers proxied records; DNS-only traffic is not inspected.
Managed rules can block legitimate traffic — run new rules in logging mode first, and treat the WAF as a compensating control, not a patch.

Sources

Pros

WAF engine and managed ruleset included on every plan, including Free
Unmetered DDoS absorption at the edge on all tiers
Central rules maintenance — no appliances, agents or rule deployments to manage
Attack-score and bot-management layers available as needs grow
Flat plan pricing; no per-request or per-rule metering

Cons

Advanced rate limiting, attack-score rules and full log export are plan-gated
Managed rules can block legitimate traffic; tuning requires a logging-first workflow
Free plan limits request body inspection to 1 MB
Only applies to proxied records — DNS-only traffic is not filtered
A compensating control, not a substitute for fixing application vulnerabilities

Best For

Any website behind Cloudflare that wants a maintained application firewall and DDoS absorption as a baseline — from hobby projects on the free tier to compliance-bound businesses on Business or Enterprise.