Vendor comparison
AWS WAF vs Cloudflare WAF: pricing compared
The top cross-vendor query in the category. Per-request granular billing versus flat plan bundles. Pick AWS WAF if you are on AWS and want a real $5 entry point; pick Cloudflare if you want WAF + CDN + DNS on one flat bill.
Last verified June 2026
Decision in one paragraph
AWS WAF wins on bot management transparency (published $10/web-ACL + per-request rate) and on per-request granularity for unpredictable traffic. Cloudflare wins on bundle value (CDN, DNS, SSL, WAF on one bill) and on the genuine Free tier for small sites. Pick AWS WAF if you are already on AWS and need predictable bot-management math. Pick Cloudflare if you want a flat monthly rate and the CDN + DNS bundle.
Side by side
AWS WAF
- Per-request granular billing: $5 web-ACL + $1/rule + $0.60/M requests.
- Bot Control published rate: $10/web-ACL + per-request rule-group fee.
- Native integration with ALB, CloudFront, API Gateway, App Runner.
- Marketplace managed rule groups from third parties layer cleanly on top.
- No bundled CDN: pair with CloudFront for full edge protection.
Cloudflare WAF
- Flat plan billing: Free $0, Pro $20-25, Business $200-250, Enterprise quote.
- CDN, DNS, Universal SSL bundled at every paid tier.
- Bot Management Enterprise is a quote-only add-on (Bot Fight Mode is not the same).
- Global Anycast edge baked in; no separate CDN bill.
- Advanced Rate Limiting and API Shield are Enterprise add-ons.
Feature matrix
| Feature | AWS WAF | Cloudflare |
|---|---|---|
| Published list pricing | ✓ | ✓ |
| Free tier | ✗ | ✓ |
| Bot management published rate | ✓ | ✗ |
| CDN included | ✗ | ✓ |
| Custom rules at entry tier | ✓ | ◐ |
| API protection add-on | ✓ | ✓ |
| Per-request granular billing | ✓ | ✗ |
| Flat monthly plan | ✗ | ✓ |
Headline pricing
| Vendor | Cheapest published rate | Pricing model | Source |
|---|---|---|---|
| AWS WAF | $5.00 per web-ACL per month | Per web-ACL + per rule + per million requests | Source (2026-06-19) |
| Cloudflare WAF | Free plan, WAF rules included | Flat monthly plan, WAF included on every paid tier | Source (2026-06-19) |
Direct answer
Which is cheaper at typical traffic?
At 100M requests per month with bot management on, AWS WAF is typically cheaper because Cloudflare Bot Management is quote-only Enterprise and the price is not publishable. At low traffic with basic WAF only, Cloudflare Free at $0 beats every AWS WAF configuration.
Source: Use the cost calculator on the homepage to model your own workload.
Switching cost
If you are already on one and considering the other
Migrating between AWS WAF and Cloudflare is genuinely heavy: you re-issue TLS certs, repoint DNS, re-tune managed and custom rules to a new engine, and re-write any Lambda@Edge or Workers code that fronts the app. Expect 2-6 weeks of engineering for a mid-sized property. Run both in parallel for at least one full traffic week before cutover. The cheaper monthly rate rarely justifies the switch unless you are reorganising the whole edge layer.
Where to read more
Cross-reference with the pricing-models explainer and the hidden-costs page before signing.
Last verified June 2026