WAF bot management add-on cost: AWS Bot Control, Cloudflare Bot Management, Imperva ABP
Bot management is the single largest hidden line on most WAF bills. AWS publishes the rate. Cloudflare, Imperva, and Akamai all keep their flagship bot SKUs quote-only. The cross-vendor cost spread at 100M req/mo runs from $185/mo (AWS with Bot Control) to high four figures (Imperva or Akamai Bot Manager Premier per buyer-shared bands).
Last verified June 2026
AWS WAF Bot Control
Published rate. Bot Control is a managed rule group billed at $10 per web-ACL per month plus a per-request rule-group fee. The per-request fee is added on top of the standard $0.60/M request fee. At 100M req/mo the Bot Control rule-group fee alone is roughly $100, dwarfing the $10 base and the $5 web-ACL line. AWS publishes the per-request rule-group fee in the pricing-page footnote, not the headline table.
- 1.Web-ACL base$5.00
- 2.Custom rules (10 x $1)$10.00
- 3.Request fee (100M x $0.60/M)$60.00
- 4.Bot Control rule-group base$10.00
- 5.Bot Control request fee (~$1/M)$100.00
Cloudflare bot defence at three tiers
Three distinct products, frequently confused. Bot Fight Mode ships with Pro ($20-25/mo) and applies basic challenges to obvious bot signatures. Super Bot Fight Mode ships with Business ($200-250/mo) and adds category-based controls. Bot Management is the Enterprise add-on with machine-learning detection and is quote-only. Treating Pro Bot Fight Mode as equivalent to Enterprise Bot Management is the most common shortlist-spreadsheet mistake.
| Feature | Bot Fight Mode (Pro) | Super Bot Fight Mode (Business) | Bot Management (Enterprise) |
|---|---|---|---|
| Basic challenges | ✓ | ✓ | ✓ |
| Category controls | ✗ | ✓ | ✓ |
| Machine-learning detection | ✗ | ✗ | ✓ |
| Per-request scoring API | ✗ | ✗ | ✓ |
| Published rate | ✓ | ✓ | ✗ |
Imperva Advanced Bot Protection
The ex-Distil Networks product, now Imperva ABP. Quote-only with no published rate. Pricing is keyed off request volume, number of protected applications, and whether the contract includes Imperva's ATO Protection or Account Takeover Defence module. Pricing is not public; see the quote-only-vendors discovery-call framework rather than relying on second-hand bands.
Akamai Bot Manager Premier
Quote-only. Sold as a separate line on the Akamai App & API Protector contract. The Premier tier is the research-led SKU with behavioural detection; the lower Standard tier is included with App & API Protector but covers less of the OWASP automated-threats taxonomy. Akamai does not publish either rate.
Related reading
See the API protection cost page for the adjacent add-on category, hidden costs for the broader bill-beyond-list-rate analysis, and the quote-only vendors page for the discovery-call framework.