—
per month—ACL + rules
—request cost
—per year
The per-request fee is what scales
WAF fixed costs are small; the per-million inspection charge is what grows with traffic. Scope it to endpoints that need protection. Pair with the CDN bandwidth calculator.
Where WAF bills surprise people
WAF pricing has three meters: a monthly base per web ACL (~$5), per-rule charges (~$1/rule/month), and per-request fees (~$0.60 per million). The last one is the sleeper — a site doing 100M requests monthly pays $60 in request fees against a $20 base. Managed rule groups from vendors add their own subscription on top. Bot Control and fraud-detection add-ons are priced separately and can triple the bill; check whether you're paying for inspection features on traffic that a free Cloudflare tier would have filtered before it reached you.