Direct answer: cloud WAF pricing in 2026 comes in three models: Cloudflare by plan (Pro 20/month annual, 25 monthly; Business 200/250), including WAF managed rules, 20/100 custom rules and CDN/DDoS, with no separate WAF request fee; AWS WAF at 5/WebACL + 1/rule + 0.60/million requests, with AWS managed rule groups at 1/month each; Azure WAF (Front Door classic) at 5/policy + 1/custom rule + 0.60/million requests, with the managed default ruleset at 20/month + 1/million requests. At 20 custom rules, one managed ruleset and 10M/100M/1B requests/month: Cloudflare Pro 20/20/20; Cloudflare Business 200/200/200; AWS WAF 32/86/626; Azure WAF 61/205/1,645 (USD/month, WAF only, excluding CDN/ALB/Front Door/tax). Bottom line: Cloudflare Pro is cheapest at low-to-mid traffic; for an SLA use Business, which beats AWS above about 290M requests/month and Azure above about 97M; AWS/Azure fit teams already on that cloud’s front end and wanting per-rule/per-request granularity.
This guide is for web/API security, architecture, SRE and procurement teams. Data cut-off: 7 November 2026; prices come from Cloudflare Plans, AWS WAF Pricing, Azure WAF Pricing and Cloudflare WAF docs, in USD, excluding tax; all TCOs are editorial calculations, not vendor quotes. “Plan/rule/request/managed ruleset/SLA” differ, so official facts, editorial assumptions and non-comparable items are kept separate.
Cloudflare is a plan price: Pro 20/month (annual) includes WAF managed rules, 20 custom rules, CDN/DDoS, but no uptime SLA; Business 200/month includes 100 rules and a 100% uptime SLA. AWS/Azure are base + rules + requests: AWS 5 + 1/rule + 0.60/M, managed groups 1 each; Azure 5 + 1/rule + 0.60/M, managed default ruleset 20/month + 1/M. At 20 rules and 10M requests: Cloudflare 20, AWS 32, Azure 61; at 1B: Cloudflare 20, AWS 626, Azure 1,645.
Three models: plans, per ACL/rule/request, per policy/rule/request
Cloudflare: Free 0, Pro 20/month (annual; 25 monthly), Business 200/month (annual; 250 monthly), Contract custom; WAF is available on all plans, managed rules are Free Managed Ruleset only on Free and Cloudflare Managed Ruleset + OWASP Core Ruleset on Pro+; custom rules 5/20/100/1,000 (Free/Pro/Business/Enterprise), rate-limiting rules 1 on Free and available on Pro+; Pro has no uptime SLA, Business has a 100% uptime SLA. AWS WAF: 5/WebACL/month, 1/rule/month, 0.60/million requests; 1/month per rule group or managed rule group; Bot Control 10/month per WebACL plus per-request; CAPTCHA/Challenge per attempt; beyond 1,500 WCUs, 0.20/million requests per additional 500 WCUs; beyond a 16KB body, 0.30/million requests per additional 16KB. Azure WAF (Front Door classic / Azure CDN classic): 5/policy/month, 1/custom rule/month, 0.60/million requests; managed default ruleset 20/month + 1/million requests; Front Door Premium includes WAF in its price; Application Gateway/Containers use capacity-unit pricing.
| Platform/tier | Fixed fee (USD/month) | Rule fee | Request fee | Managed rules/SLA |
|---|---|---|---|---|
| Cloudflare Free | 0 | 5 custom rules | No separate WAF fee | Free Managed Ruleset only; no SLA |
| Cloudflare Pro | 20 (annual)/25 (monthly) | 20 custom rules | No separate WAF fee | Managed + OWASP; no uptime SLA |
| Cloudflare Business | 200 (annual)/250 (monthly) | 100 custom rules | No separate WAF fee | Managed + OWASP; 100% uptime SLA |
| AWS WAF | 5/WebACL | 1/rule; managed group 1 each | 0.60/million | Bot Control 10/month + per request |
| Azure WAF (FD classic) | 5/policy | 1/custom rule; managed default 20 | 0.60/million + managed 1/million | Per Front Door/App Gateway terms |
Sources: Cloudflare Plans and Cloudflare WAF docs (custom rules 5/20/100/1,000; WAF Managed Rules availability by plan), AWS WAF Pricing, Azure WAF Pricing (US/USD, accessed 7 November 2026). Excludes tax, discounts, commitments, CDN/ALB/CloudFront/Front Door/Application Gateway, logs, Bot/CAPTCHA overages, WCU/body overages, support and migration; Azure’s 5/1/0.60/20/1 applies to Front Door classic and Azure CDN classic, while Front Door Premium includes WAF.
TCO: 10M, 100M and 1B requests/month
At 20 custom rules, one managed ruleset and one WebACL/policy: 10M requests — Cloudflare Pro 20, Business 200, AWS 5+20+1+6=32, Azure 5+20+20+16=61; 100M — Cloudflare 20/200, AWS 5+20+1+60=86, Azure 5+20+20+160=205; 1B — Cloudflare 20/200, AWS 5+20+1+600=626, Azure 5+20+20+1,600=1,645. Cloudflare’s plan price does not grow with requests; at 1B, AWS/Azure request fees are 96%/97% of the total. Cloudflare Pro still lists 20/month at 1B, but Pro has no uptime SLA and is subject to plan fair-use/feature boundaries; for an SLA, compare Business 200.
| Requests/month | Cloudflare Pro | Cloudflare Business | AWS WAF | Azure WAF (FD classic) |
|---|---|---|---|---|
| 10M | 20.00 | 200.00 | 32.00 | 61.00 |
| 100M | 20.00 | 200.00 | 86.00 | 205.00 |
| 1B | 20.00 | 200.00 | 626.00 | 1,645.00 |
Editorial calculation, not a quote. Cloudflare uses annual pricing; AWS = 5 + 20×1 + 1 managed group + 0.60×million requests; Azure = 5 + 20×1 + 20 managed default + (0.60+1.00)×million requests. Excludes tax, CDN/ALB/CloudFront/Front Door/Application Gateway, logs, Bot/CAPTCHA, WCU/body overages, support and migration; Cloudflare Pro has no uptime SLA while Business has a 100% uptime SLA; AWS/Azure SLA depends on the fronting service.
Break-evens and SLA: Pro vs Business
Cloudflare Pro 20 is below AWS’s 26 fixed base, so on WAF-only list price Pro is lower than AWS from 10M to 1B; but Pro has no uptime SLA, so production with an SLA should look at Business. Business 200 equals AWS 26+0.60R at about 290M requests/month: below 290M AWS is lower, above 290M Business is lower. Business 200 equals Azure 45+1.60R at about 97M requests/month: below 97M Azure is lower, above 97M Business is lower. Pro 20 has no positive break-even against Azure 45+1.60R because Azure’s fixed base is higher. In short: Pro wins at small traffic; AWS/Azure can win at mid traffic; Cloudflare’s flat price wins again at very large traffic.
| Comparison | Formula | Break-even | Result |
|---|---|---|---|
| Pro vs AWS | 20 vs 26+0.60R | No positive intersection | Pro always lower (but no SLA) |
| Business vs AWS | 200 vs 26+0.60R | About 290M requests/month | Below 290M AWS lower; above, Business |
| Business vs Azure | 200 vs 45+1.60R | About 97M requests/month | Below 97M Azure lower; above, Business |
| Pro vs Azure | 20 vs 45+1.60R | No positive intersection | Pro always lower (but no SLA) |
Editorial calculation, WAF monthly + rules + requests only, excluding tax/front end/logs/add-ons; R is million requests/month. Cloudflare Pro has no uptime SLA, Business has a 100% uptime SLA; AWS/Azure SLA depends on CloudFront/ALB/Front Door/Application Gateway.
Rules and add-ons: Bot, CAPTCHA, WCU, managed rules
Rule count sets the “base”, request volume sets the “slope”, add-ons set the “tail”: Cloudflare Pro includes 20 custom rules; more requires Business (100) or Enterprise (1,000); the Cloudflare Managed Ruleset/OWASP are included on Pro+ with no per-rule charge. AWS charges 1/rule/month and 1 per managed rule group/month; Bot Control 10/month per WebACL plus per-request; CAPTCHA/Challenge per attempt; beyond 1,500 WCUs, 0.20/million requests per 500; beyond a 16KB body, 0.30/million requests per 16KB. Azure custom rules are 1/rule/month, and the managed default ruleset is 20/month + 1/million requests; Bot/DDoS capabilities follow the Front Door tier. All three may bill “WAF” separately from front end/CDN/logs, so quote the whole stack.
| Item | Cloudflare | AWS WAF | Azure WAF (FD classic) |
|---|---|---|---|
| Custom rules | 5/20/100/1,000 (in plan) | 1/rule/month | 1/rule/month |
| Managed rules | Pro+ includes Managed + OWASP | 1/group/month (AWS groups) | Default ruleset 20/month + 1/million |
| Request fee | No separate WAF fee | 0.60/million | 0.60/million + managed 1/million |
| Bot/CAPTCHA | Bot Fight Mode; advanced bot by tier | Bot Control 10/month + per request; CAPTCHA per attempt | Follows Front Door tier |
| Overages | Plan fair use/rule caps | WCU, body, region | Policy/rule/request |
| SLA | Business 100%; Pro none | Depends on fronting service | Depends on Front Door/App Gateway |
| CDN/DDoS | Included in plan | CloudFront/ALB separate | Front Door separate |
Sources: Cloudflare Plans/WAF docs, AWS WAF Pricing, Azure WAF Pricing (accessed 7 November 2026). This is a public pricing overview; exact rule caps, Bot/CAPTCHA prices, WCU/body overages, SLA, logs and support depend on tier/contract.
Which option fits which scenario?
Small teams/budget-first/all-in-one CDN+WAF+DDoS: Cloudflare Pro 20 (annual), 20 custom rules is usually enough; production with an SLA, more rules and priority support: Cloudflare Business 200; already on AWS/CloudFront/ALB and wanting per-rule/per-request granularity with AWS managed groups: AWS WAF; already on Azure/Front Door classic and wanting Microsoft threat intelligence/policies: Azure WAF; above about 290M requests/month and wanting a flat price: Cloudflare Business often beats AWS; above about 97M it beats Azure; enterprise compliance/custom contracts: Cloudflare Contract, Azure Front Door Premium, AWS Enterprise/contract. Do not compare only the “WAF monthly fee” — include front end/CDN, logs, Bot and request fees.
| Scenario | First choice | WAF monthly | Check first |
|---|---|---|---|
| Small team/budget/all-in-one | Cloudflare Pro | 20 (annual) | 20 rules/no SLA |
| Production SLA/more rules/support | Cloudflare Business | 200 (annual) | 100 rules/100% SLA |
| Already on AWS/CloudFront/ALB | AWS WAF | 5+1/rule+0.60/M | WCU/body/Bot |
| Already on Azure/Front Door classic | Azure WAF | 5+1/rule+0.60/M+20 | Front Door version/SLA |
| Very large requests/flat price | Cloudflare Business | 200 fixed | 290M/97M break-evens |
| Enterprise compliance/custom contract | Cloudflare Contract / FD Premium / AWS contract | Custom | Compliance/audit/support |
Sources: the three official pricing pages/docs (accessed 7 November 2026). This is an editorial decision matrix, not vendor advice; block rate, false positives, latency, log completeness, SLA credits and migration cost were not tested.
What should procurement and acceptance specify?
At least ten things: monthly/peak requests, rule count/managed rules, Bot/CAPTCHA, body/WCU, front end/CDN, logs/retention, SLA/credits, compliance/residency, migration/rollback, contract/renewal. Run a 2–4 week POC on real traffic and record blocking/false positives, latency, logs, Bot, request fees and the bill; do not compare only the “WAF monthly fee”.
- Requests: monthly total/peak, attack peaks, metered/committed.
- Rules: custom count, managed groups, exceptions/allowlists, change process.
- Bot: bot management/CAPTCHA/challenge; add-on, per-attempt/per-request.
- Body/WCU: inspection caps, overage price, large files/APIs.
- Front end: CloudFront/ALB/API Gateway/Front Door/App Gateway fees.
- Logs: retention, export, SIEM, sampling, cost.
- SLA: uptime, credit multiplier, support response.
- Compliance: PCI, residency, audit, privacy.
- Migration: rule migration, rollback, dual-run, DNS/certificates.
- Contract: annual/monthly, renewal uplift, overage, exit.
FAQ
Which WAF is cheapest?
WAF only, 20 rules, 10M–1B requests: Cloudflare Pro 20/month is lowest; for an SLA, look at Business 200. AWS is 32/86/626 and Azure 61/205/1,645. At mid traffic AWS/Azure can approach or beat Business; at very large traffic Cloudflare’s flat price is lower.
What is the difference between Cloudflare Pro 20 and 25?
20 is the annual-billing equivalent and 25 is monthly; the features are the same (WAF managed rules, 20 custom rules, etc.). Business is 200 annual/250 monthly, with 100 rules and a 100% uptime SLA.
How is AWS WAF priced?
5/WebACL/month + 1/rule/month + 0.60/million requests; AWS managed rule groups 1/group/month; Bot Control 10/month per WebACL plus per-request; CAPTCHA/Challenge per attempt; beyond 1,500 WCUs, 0.20/million requests per 500; beyond a 16KB body, 0.30/million requests per 16KB.
How is Azure WAF priced?
Front Door classic/Azure CDN classic: 5/policy/month + 1/custom rule/month + 0.60/million requests; managed default ruleset 20/month + 1/million requests. Front Door Premium includes WAF in its price; Application Gateway/Containers use capacity units.
Why does Cloudflare not charge per request?
It bundles WAF, CDN and DDoS into a plan price, tiered by features/rule count/support/SLA rather than WAF request volume. Plans have fair-use and rule caps; very high traffic/enterprise needs Business/Contract.
When is Cloudflare Business cheaper than AWS/Azure?
Versus AWS 26+0.60R, Business is lower above about 290M requests/month; versus Azure 45+1.60R, above about 97M. Below those points, AWS/Azure metered fees are lower, but add front end/CDN/logs.
What hidden costs should we expect?
CDN/CloudFront/ALB/Front Door/App Gateway, logs/retention/SIEM, Bot/CAPTCHA, WCU/body overages, rule migration, certificates/DNS, support/SLA, tax and renewal. The WAF monthly fee is only part of the security stack.
How do we choose and accept?
Budget-first/all-in-one: Cloudflare Pro; SLA/more rules: Business; already on AWS/Azure: the native WAF; very large traffic: Business’s flat price. A 2–4 week POC on real traffic records blocking/false positives, latency, logs, Bot, request fees and the bill before signing.
Research method and limitations
This article separates “official facts” from “editorial modelling”: Cloudflare’s Pro 20/25, Business 200/250, WAF on all plans, managed rules Managed+OWASP on Pro+, custom rules 5/20/100/1,000 and Business 100% uptime SLA come from Cloudflare Plans and Cloudflare WAF docs; AWS’s 5/1/0.60, 1/managed group, Bot Control 10/month and WCU/body overages come from AWS WAF Pricing; Azure’s 5/1/0.60/20/1 comes from Azure WAF Pricing (Front Door classic/Azure CDN classic). The TCOs are arithmetic with 20 rules, one managed group and 10M/100M/1B requests, not vendor quotes.
Eight limitations: (1) only US public list prices are used, excluding tax, discounts, commitments, enterprise contracts and regional differences; (2) only WAF monthly + rules + requests are counted, excluding CDN/CloudFront/ALB/API Gateway/Front Door/App Gateway, logs/retention/SIEM, Bot/CAPTCHA, WCU/body overages, certificates/DNS, support and migration; (3) Cloudflare Pro has no uptime SLA while Business has a 100% SLA, but features/fair use/rule caps are not fully equivalent to AWS/Azure; (4) Azure’s 5/1/0.60/20/1 applies only to Front Door classic/Azure CDN classic; Front Door Premium includes WAF and App Gateway/Containers use capacity units; (5) block rate, false positives, latency, log completeness, SLA credits and migration cost were not tested; (6) Fastly, Akamai, Imperva and F5 are excluded; (7) rule migration, re-engineering, training and dual-run costs are excluded; (8) prices and terms can change by contract, region and exchange rate. Treat this as a pricing-conversion template and replace assumptions with a 2–4 week real-traffic POC.
Sources and basis
- Cloudflare, Plans: cloudflare.com/plans. Free 0, Pro 20/month annual / 25 monthly, Business 200/month annual / 250 monthly, Contract custom; Business 100% uptime SLA, Pro none. Accessed 7 November 2026.
- Cloudflare, WAF docs: developers.cloudflare.com/waf. WAF on all plans; WAF Managed Rules Free only Free Managed Ruleset, Pro+ includes Cloudflare Managed Ruleset and OWASP Core Ruleset; custom rules 5/20/100/1,000 (Free/Pro/Business/Enterprise); rate limiting 1 rule on Free, available on Pro+. Accessed 7 November 2026.
- AWS, WAF Pricing: aws.amazon.com/waf/pricing. 5/WebACL/month, 1/rule/month, 0.60/million requests; rule group/managed group 1/month; Bot Control 10/month/WebACL plus per-request; CAPTCHA/Challenge per attempt; WCU/body overages extra. Accessed 7 November 2026.
- Microsoft, Azure WAF Pricing: azure.microsoft.com/pricing/details/web-application-firewall. Front Door classic/Azure CDN classic: 5/policy/month, 1/custom rule/month, 0.60/million requests; managed default ruleset 20/month + 1/million requests; Front Door Premium includes WAF; App Gateway/Containers use capacity units. Accessed 7 November 2026.
Data cut-off 7 November 2026; prices are public list prices excluding tax; all models are editorial calculations. This is not procurement advice.