What DDoS protection costs in 2026: AWS Shield Advanced’s 3,000/month vs Cloudflare’s 20/200 plans

Direct answer: DDoS protection pricing in 2026 comes in two models: AWS Shield Standard free (automatic L3/L4); AWS Shield Advanced 3,000/month with a 1-year commitment, plus data transfer out at 0.050/GB (ALB/EC2/Global Accelerator) or 0.025/GB (CloudFront), including up to 50 billion WAF requests/month, DDoS cost protection and the response team (requires Business/Enterprise Support); Cloudflare includes DDoS protection in its plans — Pro 20/month annual (25 monthly), Business 200/month annual (250 monthly), with advanced DDoS/enterprise support via Contract. At 1TB/10TB/100TB egress: AWS Shield Advanced 3,050/3,500/8,000 (ALB); Cloudflare Pro 20 and Business 200 do not grow with traffic. Bottom line: Cloudflare’s plans are far below Shield Advanced; Shield Advanced buys DDoS cost protection, a response team, WAF bundling and native AWS integration under a 1-year commitment; the tiers are not equivalent — choose by attack surface/compliance/support, not monthly fee alone.

This guide is for teams responsible for website/API entry points, DDoS protection, SRE and procurement. Data cut-off: 7 November 2026; prices come from AWS Shield Pricing and Cloudflare Plans, in USD, excluding tax; all TCOs are editorial calculations, not vendor quotes. “Standard/Advanced, plan/Contract, L3/L4/L7, response team” differ, so official facts, editorial assumptions and non-comparable items are kept separate.

Two meters: 3,000/month + egress vs plan price

AWS Shield Standard: free for all AWS customers, automatic protection against common L3/L4 DDoS, covering ELB, CloudFront, Route 53 and more; does not include the Shield network security director. AWS Shield Advanced: 3,000/month, 1-year commitment; data transfer out 0.050/GB (ALB, EC2, Global Accelerator) or 0.025/GB (CloudFront); includes the AWS Managed Rule group for L7 DDoS, up to 50 billion WAF requests/month (DDoS requests not counted), DDoS cost protection; the Shield Response Team requires Business/Enterprise Support. Cloudflare: Free 0, Pro 20/month annual (25 monthly), Business 200/month annual (250 monthly), Contract custom; DDoS protection on all plans, WAF managed rules on Pro+, Business 100% uptime SLA; advanced DDoS/enterprise support via Contract.

Sources: AWS Shield Pricing and Cloudflare Plans (US/USD, accessed 7 November 2026). Excludes tax, WAF beyond 50B requests, data transfer, support plans, enterprise contracts and migration; AWS Shield Advanced’s response team requires Business/Enterprise Support; Cloudflare advanced DDoS/enterprise support requires Contract.

TCO: 1TB/10TB/100TB egress

At 1TB/10TB/100TB egress, fixed + egress only: 1TB AWS Advanced (ALB) 3,000+1,000×0.050=3,050; CloudFront 3,000+1,000×0.025=3,025; Cloudflare Pro 20, Business 200. 10TB AWS 3,000+10,000×0.050=3,500; CloudFront 3,000+10,000×0.025=3,250; Cloudflare 20/200. 100TB AWS 3,000+100,000×0.050=8,000; CloudFront 3,000+100,000×0.025=5,500; Cloudflare 20/200. Cloudflare’s plan price does not grow with egress; AWS’s egress becomes the main item at high volume. Shield Standard is 0 but covers only basic L3/L4.

Editorial calculation, not a quote. AWS uses 3,000 fixed + 0.050/GB (ALB/EC2) or 0.025/GB (CloudFront) egress; Cloudflare uses Pro 20/Business 200 annual, excluding WAF beyond plan/enterprise features. Excludes tax, support plans, enterprise contracts, WAF beyond 50B requests and migration; Shield Standard 0 covers only basic protection.

Platform scope: basic protection vs enterprise DDoS

AWS Shield Standard is “default basic L3/L4”, suitable for all AWS applications, but without DDoS cost protection/response team/advanced L7 rules. Shield Advanced is an “enterprise subscription”: 1-year commitment, DDoS cost protection (attack-driven scaling costs can be credited), Shield Response Team (requires Business/Enterprise Support), WAF bundle (50B requests/month), native CloudFront/ALB/Route 53/Global Accelerator integration. Cloudflare’s DDoS is in all plans; Pro/Business add WAF managed/custom rules/rate limiting; Business has a 100% uptime SLA; advanced DDoS (very large attacks/dedicated support) goes through Contract. They are different tiers: AWS sells “cloud-native + cost protection + response team”; Cloudflare sells “edge network + packaged WAF/DDoS”.

Sources: the two official pricing pages (accessed 7 November 2026). This is a public pricing/capability overview; exact attack capacity, scrubbing, SLA, response team, compliance and enterprise contracts depend on tier/contract.

Which option fits which scenario?

Already on AWS, want native integration/cost protection/response team, budget available: Shield Advanced (3,000/month+egress, 1-year commitment); only basic L3/L4: Shield Standard 0; want edge DDoS+WAF+CDN all-in-one, budget-first: Cloudflare Pro 20/Business 200; need 100% uptime SLA: Cloudflare Business 200 or Contract; very large attacks/dedicated support/compliance: Cloudflare Contract or AWS Shield Advanced+Enterprise Support; multi-cloud/cross-cloud: Cloudflare’s edge is simpler, AWS-native covers AWS only. Include payment/egress/WAF/support; do not compare monthly fees alone.

Sources: the two official pricing pages (accessed 7 November 2026). This is an editorial decision matrix, not vendor advice; scrubbing capacity, attack response time, SLA credits and migration cost were not tested.

What should procurement and acceptance specify?

At least ten things: attack surface/peaks, L3/L4/L7, WAF rules, scrubbing capacity, SLA/credits, response team, cost protection, logs/alerting, compliance, contract. Run a 2–4 week POC/attack drill and record scrubbing, false positives, latency, alerting, response and the bill; do not compare only “3,000 vs 20/200”.

• Attack surface: bandwidth/pps/connections, L3/L4/L7, application protocols.
• WAF: managed/custom/rate limiting, false positives.
• Scrubbing: capacity, nearest scrubbing, origin.
• SLA: uptime, response, credits.
• Response: 7×24, dedicated team, escalation.
• Cost protection: attack-driven scaling, credit conditions.
• Logs/alerting: attack logs, SIEM, retention.
• Compliance: residency, audit, certifications.
• Contract: 1-year/monthly, commitment, renewal, exit.
• Drill: 2–4 weeks of attack drills; scrubbing, false positives, latency and bill.

FAQ

What is the difference between Cloudflare 20/200 and AWS 3,000?

Cloudflare’s plans include edge DDoS/WAF/CDN, Pro 20, Business 200; AWS Shield Advanced is 3,000/month+egress, including DDoS cost protection, response team (requires support plan), WAF 50B requests/month and native AWS integration. Different tiers.

Is AWS Shield Standard enough?

Standard is free and automatic L3/L4, suitable for basic protection; it excludes DDoS cost protection/response team/advanced L7. Enterprise DDoS needs Advanced.

Is Cloudflare DDoS extra?

DDoS protection is in all plans; Pro+ includes WAF managed/custom rules/rate limiting; advanced DDoS/enterprise support goes through Contract. Business has a 100% uptime SLA.

What does Shield Advanced’s 3,000 include?

1-year commitment, DDoS cost protection, Shield Response Team (requires Business/Enterprise Support), WAF 50B requests/month, native CloudFront/ALB/Route 53/Global Accelerator integration; egress is extra.

How is egress priced?

Shield Advanced egress 0.050/GB (ALB/EC2/Global Accelerator) or 0.025/GB (CloudFront); about 50/25 for 1TB and 5,000/2,500 for 100TB. Cloudflare plans do not bill egress separately.

How do we choose for multi-cloud?

AWS Shield covers AWS resources only; multi-cloud/cross-cloud usually favors Cloudflare’s edge DDoS/WAF, or buy each cloud separately. Choose by attack surface/compliance/support.

What hidden costs should we expect?

WAF beyond 50B requests, support plans (Business/Enterprise), enterprise contracts, logs/SIEM, compliance/audit, migration and tax. Cloudflare advanced DDoS/dedicated support also requires Contract.

How do we choose and accept?

AWS-native/enterprise DDoS: Shield Advanced; basic: Standard; edge/WAF+DDoS: Cloudflare Pro/Business; very large attacks: Contract. A 2–4 week attack drill records scrubbing, false positives, latency and the bill.

Research method and limitations

This article separates “official facts” from “editorial modelling”: AWS Shield Standard free, Advanced 3,000/month, 1-year commitment, 0.050/0.025/GB egress, 50B WAF requests/month and cost protection/response team come from AWS Shield Pricing; Cloudflare Free 0, Pro 20/25, Business 200/250, Contract custom, DDoS in all plans and Business 100% SLA come from Cloudflare Plans. The TCOs are arithmetic at 1TB/10TB/100TB egress and fixed+egress only, not vendor quotes.

Eight limitations: (1) only US public list prices are used, excluding tax, commitments/enterprise discounts and regional differences; (2) only fixed+egress are counted, excluding WAF beyond 50B requests, support plans, logs/SIEM, compliance/audit and migration; (3) the tiers/scrubbing capacity/SLA/response team are not fully equivalent; (4) Shield Standard 0 covers only basic L3/L4; (5) scrubbing capacity, attack response, false positives, latency and SLA were not tested; (6) Azure DDoS, Akamai, Imperva and Fastly are excluded; (7) 1TB/10TB/100TB are assumptions; (8) prices and terms can change by contract, region and exchange rate. Treat this as a pricing-conversion template and replace assumptions with a 2–4 week attack drill/POC.

Sources and basis

• AWS, Shield Pricing: aws.amazon.com/shield/pricing. Standard free, automatic L3/L4; Advanced 3,000/month, 1-year commitment; egress 0.050/GB (ALB/EC2/Global Accelerator) or 0.025/GB (CloudFront); WAF 50B requests/month; DDoS cost protection; response team requires Business/Enterprise Support. Accessed 7 November 2026.
• Cloudflare, Plans: cloudflare.com/plans. Free 0, Pro 20/month annual/25 monthly, Business 200/month annual/250 monthly, Contract custom; DDoS in plans, WAF Pro+, Business 100% uptime SLA. Accessed 7 November 2026.

Data cut-off 7 November 2026; prices are public list prices excluding tax; all models are editorial calculations. This is not procurement advice.