Vendor deep-dive

AWS WAF Pricing 2026: Per-Web-ACL, Per-Rule, Per-Request, and the Bot Control Trap

AWS WAF is the cheapest published per-request WAF on the market with a $5 web-ACL base, $1 per rule, and $0.60 per million requests. The headline is honest. The trap is that Bot Control and Fraud Control rule groups charge a per-request fee on top of the standard request fee, and at 100M requests per month they can dwarf the $5 web-ACL line.

Last verified 23 September 2026

Cloud-native WAF, per-request billing

AWS WAF

From

$5.00 per web-ACL per month

Rate position

AWS WAF sits in the lower third of the 6 vendors that publish a starting WAF rate.

What it costs

AWS WAF prices on a per web-acl + per rule + per million requests basis. The cheapest published entry point is $5.00 per web-ACL per month. Full tier list below, taken from the live vendor pricing page.

AWS WAF pricing tiers

Tier 1Web ACL
$5.00 per web-ACL per month
Tier 2Rule
$1.00 per rule per web-ACL per month
Tier 3Requests
$0.60 per million requests, plus $0.20 per million for each 500 WCUs the web-ACL uses beyond the default 1,500
Tier 4Bot Control (Common)
$10.00 per web-ACL per month; first 10 million requests a month free, then $1.00 per million
Tier 5Bot Control (Targeted)
First 1 million requests a month free, then $10.00 per million
Tier 6Account Takeover Prevention
$10.00 per web-ACL per month + tiered per-login fees from $1.00 per thousand login requests
Tier 7CAPTCHA
$0.40 per thousand CAPTCHA attempts analyzed, no free tier; Challenge responses $0.40 per million

Source: https://aws.amazon.com/waf/pricing/ - retrieved 2026-09-23

What this vendor is best for

AWS-hosted apps that already use ALB, CloudFront, or API Gateway and want the bill on one console.

AWS-hosted apps already fronted by ALB, CloudFront, or API Gateway.
Teams who want WAF on the same monthly bill as the rest of their AWS spend.
Sites that need fine-grained custom rule control without flat-plan ceilings.
Workloads where request volume is predictable enough to model a per-request bill in advance.

Hidden costs to watch

The line items most buyers miss

Bot Control and Fraud Control add per-request rule-group fees on top of the standard request fee, and the base request rate itself rises by $0.20 per million for every 500 WCUs above the default 1,500 allocation. At 100M requests a month with Bot Control on, the rule-group fee alone dwarfs the $5 web-ACL line.

Bot Control rule group: $10 per web-ACL per month, then $1.00 per million requests once the first 10 million a month are used. Targeted Bot Control is $10.00 per million after its own 1 million free.
Account Takeover Prevention: $10 per web-ACL per month plus a tiered per-login fee that starts at $1.00 per thousand login requests.
The $0.60 per million request rate is not flat. AWS adds $0.20 per million for each 500 web-ACL capacity units used beyond the default 1,500 allocation, so a rule-heavy web-ACL can reach $2.00 per million.
CAPTCHA challenges: $0.40 per thousand attempts analyzed, with no free allowance. Challenge responses are separate at $0.40 per million.
AWS WAF logs delivered to CloudWatch, S3, or Kinesis Firehose carry the normal storage and ingestion charges of those services.
Managed rule groups from AWS Marketplace sellers (Fortinet, F5, Trustwave) carry their own per-request fees layered on top of the AWS WAF base.

Direct answer

What does AWS WAF actually cost at 100M requests per month?

Use the cost calculator on the homepage to assemble a realistic monthly bill across all published-rate vendors. The default profile (100M req/mo, 1 protected app, 10 custom rules, bot management on) is labelled as an illustrative example so it can be re-run with your own numbers.

Source: https://aws.amazon.com/waf/pricing/, retrieved 2026-09-23

Worked example at 100M requests per month

One web-ACL, 10 custom rules, 100 million requests per month, Common Bot Control on, web-ACL inside the default 1,500 capacity units. Numbers come straight from aws.amazon.com/waf/pricing and the AWS price list behind it, retrieved 23 September 2026. Illustrative example, not a real company.

AWS WAF bill, 100M req/mo with Bot Control

1.Web-ACL base fee$5.00
2.10 custom rules at $1.00 each$10.00
3.100M requests at $0.60 / million$60.00
4.Bot Control rule group base$10.00
5.Bot Control request fee, first 10M free then 90M at $1.00 / million$90.00

Estimated monthly total~$175.00

Bot Control request fee dominates the bill once it is on, even after the 10 million free requests a month AWS includes. Without Bot Control the same workload costs roughly $75/mo. Two things AWS keeps in footnotes rather than the headline table: the free Bot Control allowance, and the $0.20 per million surcharge for every 500 capacity units the web-ACL uses above 1,500.

AWS WAF Classic vs WAFv2

AWS WAF Classic is the original 2015 product. WAFv2 launched in 2019 and is the current default for all new web-ACLs. Pricing on this page refers to WAFv2. Classic web-ACLs are still billable at the same web-ACL and rule rates but cannot use the v2 managed rule groups, including Bot Control. Migrate to WAFv2 before adding any managed rule group.

Closest alternatives

Two published-rate vendors with the most similar pricing model and product fit.

Azure WAF (Front Door)

Bundled into the Front Door Standard/Premium tier price, or per-hour on Application Gateway

$35.00 per month (Front Door Standard, custom WAF rules included)

→

Google Cloud Armor

Standard (per policy + per rule + per request) or Enterprise subscription

$5.00 per policy per month (Standard)

→

Source

Every number on this page is taken from https://aws.amazon.com/waf/pricing/, retrieved 2026-09-23. Re-check before signing a contract; vendors change pricing without notice.

Last verified 23 September 2026