Vendor deep-dive

Cloudflare WAF Pricing 2026: Pro, Business, Enterprise, and Bot Management Add-On

Cloudflare ships WAF on every paid plan, including the Free tier with basic managed rules. The bundling is genuinely useful: WAF, CDN, DNS, and Universal SSL on one bill. The opacity sits at the Enterprise tier where Bot Management Enterprise is a quote-only add-on that is frequently the largest line on a Cloudflare contract.

Last verified June 2026

Plan-bundled WAF + CDN + DNS

Cloudflare WAF

From

Free plan, WAF rules included

Rate position

Cloudflare sits in the lower third of the 6 vendors that publish a starting WAF rate.

What it costs

Cloudflare WAF prices on a flat monthly plan, waf included on every paid tier basis. The cheapest published entry point is Free plan, WAF rules included. Full tier list below, taken from the live vendor pricing page.

Cloudflare WAF pricing tiers

Tier 1Free
$0 per month, basic managed WAF rules
Tier 2Pro
$20 per month annual, $25 monthly, full managed WAF + Bot Fight Mode
Tier 3Business
$200 per month annual, $250 monthly, Super Bot Fight Mode + custom rules
Tier 4Enterprise
Quote only, billed annually, includes Bot Management entitlement on request
Tier 5Bot Management add-on
Quote only, typically attached to Business and Enterprise contracts

Source: https://www.cloudflare.com/plans/ - retrieved 2026-06-19

What this vendor is best for

Sites that want a flat monthly bill with WAF, CDN, DNS and Universal SSL in the same plan.

Sites that want WAF, CDN, DNS, and SSL on one flat monthly bill.
WordPress, Shopify, headless commerce sites needing a predictable monthly rate.
Teams who value the global Anycast network for DDoS absorption more than per-request granularity.
Anyone happy to start on the Free tier and grow into Pro or Business without re-platforming.

Hidden costs to watch

The line items most buyers miss

Bot Management at the Enterprise level is quote only and frequently the largest line on a Cloudflare contract. Bot Fight Mode (Pro) and Super Bot Fight Mode (Business) are not the same product as Bot Management Enterprise.

Bot Management at the Enterprise level is quote only and frequently the largest line on a Cloudflare contract. Bot Fight Mode and Super Bot Fight Mode are not the same product.
API Shield is an Enterprise add-on, quote only.
Advanced Rate Limiting beyond the plan-included thresholds is metered and adds to the monthly bill.
Workers Logs and Logpush egress are billed separately when streaming WAF events to your SIEM.
Annual billing on Pro and Business is roughly 20% cheaper than monthly. Quoting Cloudflare monthly rates without that footnote inflates the apparent price.

Direct answer

What does Cloudflare WAF actually cost at 100M requests per month?

Use the cost calculator on the homepage to assemble a realistic monthly bill across all published-rate vendors. The default profile (100M req/mo, 1 protected app, 10 custom rules, bot management on) is labelled as an illustrative example so it can be re-run with your own numbers.

Source: https://www.cloudflare.com/plans/, retrieved 2026-06-19

Worked example at 100M requests per month, Business plan

Cloudflare Business plan, 1 zone, 100M requests per month, Super Bot Fight Mode on (included with Business), no Enterprise Bot Management. Illustrative example, not a real company.

Cloudflare WAF bill, Business plan with included bot defence

1.Business plan, annual billing$200.00
2.Super Bot Fight Mode (included)$0.00
3.Managed WAF rules + OWASP Core Rule Set (included)$0.00
4.Advanced Rate Limiting (included plan thresholds)$0.00
5.Per-request fee on 100M requests$0.00

Estimated monthly total$200.00

The flat-plan model is genuinely flat at this profile. Bot Management Enterprise, API Shield, and Workers Logs are extra. The pricing page does not publish their rates; expect a quote conversation.

Bot Fight Mode vs Super Bot Fight Mode vs Bot Management

Three distinct products. Bot Fight Mode is on Pro and applies basic challenges to obvious bot signatures. Super Bot Fight Mode is on Business and adds category-based controls. Bot Management is the Enterprise add-on with machine-learning detection and is quote only. Treating “Pro plan with Bot Fight Mode” as equivalent to “Enterprise with Bot Management” is the most common mistake we see in shortlist spreadsheets.

Closest alternatives

Two published-rate vendors with the most similar pricing model and product fit.

AWS WAF

Per web-ACL + per rule + per million requests

$5.00 per web-ACL per month

→

Fastly Next-Gen WAF

Three security packages, all priced quote-only

Quote only, contact vendor

→

Source

Every number on this page is taken from https://www.cloudflare.com/plans/, retrieved 2026-06-19. Re-check before signing a contract; vendors change pricing without notice.

Last verified June 2026