| WAF | Pricing Model | Entry Price | Public Pricing? |
|---|---|---|---|
| Cloudflare WAF | Bundled into Cloudflare’s plan tiers | Free (included in the $0 plan) | Fully published plan pricing |
| AWS WAF | Pay-per-component: web ACL + rules + rule groups + requests inspected | $5/web ACL/month + $1/rule/month + $0.60 per million requests | Fully published, itemized pricing |
| Akamai App & API Protector | Custom quote | No public pricing | Quote-only |
Short Verdict
These three sit at genuinely different points on the pricing spectrum, and the spectrum itself is the story. Cloudflare bundles WAF protection into every plan tier, including the free one — you get a managed ruleset and unmetered DDoS protection at $0, with paid tiers adding compliance certifications and SLAs rather than gating the WAF itself. AWS WAF is fully metered and itemized: every web ACL, every rule, every rule group, and every million requests inspected has its own published per-unit price, which makes it transparent but means your bill scales directly with how complex your rule setup gets. Akamai App & API Protector publishes nothing — it’s a pure enterprise, quote-only sale, consistent with Akamai’s broader positioning as a CDN/security platform built around custom contracts rather than self-serve plans.
What Each One Actually Is
Cloudflare WAF
Cloudflare’s WAF sits at the edge of its global network and inspects HTTP(S) traffic before it reaches your origin, using a combination of a free managed ruleset and custom rules you write yourself. It’s included on every plan: Free ($0/month), Pro ($20/month billed annually, or $25/month billed monthly), Business ($200/month annually, or $250/month monthly), and a custom annually-billed Contract tier. What changes between tiers isn’t WAF access itself but surrounding guarantees: lossless image optimization and PCI DSS 4.0 compliance only appear from Pro/Business up, and an uptime SLA with service credits only kicks in at Business and above.
AWS WAF
AWS WAF attaches to CloudFront, an Application Load Balancer, API Gateway, or AppSync, and charges separately for every structural piece you create: $5.00 per web ACL per month (prorated hourly), $1.00 per rule per month, and $1.00 per month for each rule group or managed rule group added to a web ACL, plus $0.60 per million requests inspected. Exceeding the default 1,500 web ACL capacity units costs an extra $0.20 per million requests per additional 500 WCUs, and inspecting request bodies beyond the default size limit adds $0.30 per million requests per additional 16 KB. Bot Control, Fraud Control, CAPTCHA, and challenge actions are billed separately on top of this. Requests blocked by AWS’s own DDoS managed rule group aren’t charged.
Akamai App & API Protector
Akamai’s product combines WAF, bot management, and API security into one offering delivered across Akamai’s CDN edge network. Consistent with most of Akamai’s enterprise security line, there is no published price list anywhere on Akamai’s own site — every deployment is quoted individually based on traffic volume, feature set, and contract term.
Trade-offs
- Cloudflare is the easiest to start with at zero cost, but a security-conscious team will likely need the Business tier or above for PCI DSS 4.0 compliance and an uptime SLA — the free WAF alone may not satisfy a compliance checklist.
- AWS WAF gives you precise, predictable per-unit costs, but a complex rule setup with many managed rule groups and high request volume can add up quickly in ways that are easy to underestimate before you build it.
- Akamai is built for large, high-traffic enterprises already on Akamai’s CDN, but with zero public pricing, it’s effectively impossible to budget for without a sales conversation first.
Who It’s a Good Fit For
Cloudflare WAF fits startups and small-to-midsize teams that want strong default protection immediately, scaling into compliance features as they grow. AWS WAF fits teams already running their application behind CloudFront, an ALB, or API Gateway who want granular, usage-based billing tightly integrated with the rest of their AWS bill. Akamai App & API Protector fits large enterprises with high, globally distributed traffic that are already Akamai CDN customers and want WAF, bot management, and API security bundled under one enterprise contract.
Bottom Line
If you want to start protecting a site today at no cost, Cloudflare’s free-tier WAF is the fastest path. If you’re already deep in AWS and want itemized, usage-based pricing, AWS WAF fits cleanly into that bill. If you’re evaluating Akamai, budget time for a sales conversation — there’s no public number to anchor expectations around.
FAQ
Does Cloudflare charge extra for its WAF?
No. Cloudflare’s WAF and its free managed ruleset are included on every plan, including the free $0 tier; paid tiers add compliance and SLA features rather than gating WAF access itself.
What’s the cheapest way to run AWS WAF?
Minimize the number of web ACLs and custom rules, and prefer AWS-managed rule groups where possible, since every web ACL costs $5/month and every rule costs $1/month regardless of how much traffic it inspects.
Is there any published starting price for Akamai App & API Protector?
No. As of this writing, Akamai publishes no pricing for this product on its own website; every deployment requires contacting Akamai directly for a quote.
Sources
Discover more from Software Online Review
Subscribe to get the latest posts sent to your email.
