Cloudflare WAF vs AWS WAF vs Fastly Next-Gen WAF: Real Web Application Firewall Cost per 100 Million Requests in 2026
Prices checked: October 2, 2026.
DIRECT ANSWER
Short answer
For 100 million requests a month to one application:
| WAF | Monthly cost | What you get | Label |
|---|---|---|---|
| Cloudflare Pro | $20–$25 | Managed + OWASP rulesets, 20 custom rules, no per-request fee | OFFICIAL |
| Cloudflare Business | $200–$250 | Same rulesets, 100 custom rules | OFFICIAL |
| AWS WAF (basic) | ~$78 | 1 web ACL, 10 custom rules, 3 AWS managed rule groups | ILLUSTRATIVE from OFFICIAL rates |
| AWS WAF + Common Bot Control | ~$179 | Above + bot detection | ILLUSTRATIVE |
| AWS WAF + Targeted Bot Control | ~$1,079 | Above with advanced bot detection | ILLUSTRATIVE |
| Fastly Next-Gen WAF | Not published | Sold inside Security packages | QUOTE-ONLY |
Cloudflare is the only one of the three with flat pricing that doesn't move with traffic. 100 million requests costs the same as 10 million or 1 billion on Pro or Business. AWS WAF is cheap at the core ($0.60 per million requests) but add-ons multiply the bill: Targeted Bot Control alone adds $1,001 at this volume.
Native billing units
| WAF | Billed on | Rates | Label |
|---|---|---|---|
| Cloudflare | Plan per domain | Free $0; Pro $25/month ($20 annual); Business $250/month ($200 annual); Enterprise custom | OFFICIAL |
| Cloudflare WAF features | Included in plan | Free Managed Ruleset on all plans; Cloudflare Managed Ruleset and OWASP Core Ruleset on Pro and up; custom rules: Free 5, Pro 20, Business 100, Enterprise 1,000 | OFFICIAL |
| AWS WAF core | Web ACLs, rules, requests | $5 per web ACL/month; $1 per rule/month; $0.60 per million requests | OFFICIAL |
| AWS WAF capacity | WCUs over 1,500 default | $0.20 per million requests per extra 500 WCUs | OFFICIAL |
| AWS WAF body inspection | Over 16 KB | $0.30 per million requests | OFFICIAL |
| AWS Managed Rules | Rule group | $1/month per rule group | OFFICIAL |
| AWS Bot Control (both levels) | Subscription + managed rule group | $10/month subscription per web ACL, plus $1/month as a managed rule group | OFFICIAL |
| AWS Bot Control, Common | Requests | First 10M/month free, then $1 per million | OFFICIAL |
| AWS Bot Control, Targeted | Requests | First 1M/month free, then $10 per million | OFFICIAL |
| AWS CAPTCHA / Challenge | Attempts | $0.40 per thousand | OFFICIAL |
| AWS Fraud Control (ATP/ACFP) | Subscription + requests | $10/month per web ACL each; from $1,000 per million requests for the first 2M, falling to $50 per million at volume | OFFICIAL |
| Fastly Next-Gen WAF | Security Core / Core Plus / Total packages | Contact sales | QUOTE-ONLY |
AWS WAF cost at 100M requests (ILLUSTRATIVE)
Setup: 1 web ACL, 10 custom rules, 3 AWS managed rule groups, within the default 1,500 WCUs, no large-body inspection.
| Item | Calculation | Cost |
|---|---|---|
| Web ACL | 1 × $5 | $5 |
| Custom rules | 10 × $1 | $10 |
| Managed rule groups | 3 × $1 | $3 |
| Requests | 100 × $0.60 | $60 |
| Core total | $78 | |
| + Common Bot Control | $10 subscription + $1 rule group + (100 − 10) × $1 | +$101 → $179 |
| + Targeted Bot Control (instead of Common) | $10 subscription + $1 rule group + (100 − 1) × $10 | +$1,001 → $1,079 |
| + CAPTCHA on 1% of requests (1M attempts) | 1,000 × $0.40 | +$400 |
| + Large-body inspection on all requests | 100 × $0.30 | +$30 |
Not included: the CloudFront distribution or Application Load Balancer that AWS WAF attaches to. Those have their own request and data-transfer charges.
Cost per million requests
| Option | $ per million requests at 100M/month |
|---|---|
| Cloudflare Pro (annual) | $0.20 |
| Cloudflare Pro (monthly) | $0.25 |
| AWS WAF core | $0.78 |
| AWS WAF + Common Bot Control | $1.79 |
| Cloudflare Business (annual) | $2.00 |
| Cloudflare Business (monthly) | $2.50 |
| AWS WAF + Targeted Bot Control | $10.79 |
At 1 billion requests, Cloudflare Pro's cost per million drops to $0.02–$0.025, while AWS WAF core stays near $0.60 plus fixed fees.
Where the cost catches you
- AWS WAF is sold à la carte. Each rule, rule group, bot feature, CAPTCHA and fraud-control feature adds its own meter. Real WAF bills on AWS are usually 2–15× the $0.60/million headline.
- Fraud control is priced per request, at a premium. Account Takeover Prevention costs $1,000 per million for the first 2 million requests. Apply it only to login endpoints, never to all traffic.
- Cloudflare is priced per domain. Ten production domains on Business cost ten plans. Enterprise contracts bundle domains, but they're QUOTE-ONLY.
- Cloudflare requires proxying traffic through Cloudflare. The flat price includes CDN and DDoS protection, but your traffic path moves to Cloudflare.
- Fastly Next-Gen WAF can run outside Fastly's edge, as an agent or module in your own infrastructure. It's sold through security packages with no public per-request price, so get a quote for your request volume.
- Rate-limiting rules are a separate decision. See the rate-limiting comparison for those costs. They aren't included in the WAF figures above.
Which one fits
- Lowest and most predictable cost at any volume: Cloudflare Pro or Business.
- Already behind CloudFront or ALB, with simple rules: AWS WAF core. It's about $78 at 100M requests and scales linearly with traffic.
- Serious bot problems on AWS: add Common Bot Control first. Targeted Bot Control is roughly 10× more per request, so limit it to high-value paths.
- Hybrid or multi-cloud apps that need one WAF everywhere: Fastly Next-Gen WAF. Budget for a sales-led contract.
Assumptions
- 100,000,000 requests/month to one application/domain
- AWS us-east-1 list prices; Cloudflare self-serve plan prices
- Excludes CDN, load balancer, egress and taxes
Pricing sources
- AWS WAF pricing: https://aws.amazon.com/waf/pricing/
- Cloudflare plans: https://www.cloudflare.com/plans/
- Cloudflare WAF custom rules availability: https://developers.cloudflare.com/waf/custom-rules/
- Cloudflare WAF managed rules availability: https://developers.cloudflare.com/waf/managed-rules/
- Fastly pricing: https://www.fastly.com/pricing