

AWS WAF and Cloudflare Web Application Firewall compete in the web security domain, offering robust protective measures for online applications. Cloudflare seems to have an edge with its comprehensive approach and richer feature set, providing users a more extensive range of security tools.
Features: AWS WAF is notable for its flexibility in deploying custom rules, integration with other AWS services, and scalability. Users appreciate the ease of configuration and customization options. Cloudflare boasts a comprehensive set of built-in rules and DDoS protection, with easy deployment and a user-friendly interface. Its rate-limiting features and integration with its broad security suite make it a valuable solution.
Room for Improvement: AWS WAF users indicate a need for better documentation, enhanced third-party integration, and more advanced threat detection capabilities. Concerns also include costs related to traffic. Cloudflare users point to the need for more coherent documentation, better third-party integration, straightforward rule management, and improved customer support for faster response times.
Ease of Deployment and Customer Service: AWS WAF is praised for deployment simplicity within the AWS ecosystem but faces complexity in cross-cloud scenarios. Customer service can be inconsistent, with some support responsiveness issues. Cloudflare earns praise for its ease of deployment across various platforms and its user-friendly interface, although support is noted as inconsistent, particularly with basic plans.
Pricing and ROI: AWS WAF offers a pay-as-you-go pricing model, which can be economical for smaller deployments but expensive with higher traffic. Some users find AWS pricing competitive, despite quick cost escalations. Cloudflare's pricing is often considered more affordable and cost-effective, with flexible subscriptions providing good ROI due to comprehensive features bundled at competitive rates.
With AWS WAF, it is easier for us to block unwanted malicious DDoS attacks and threats from coming into our web application.
My experience with the pricing or licensing of Cloudflare Web Application Firewall is that many features can be accessed for free, so the pricing is definitely reasonable.
Resolving issues can take time because the support personnel may lack product expertise, leading to delays.
They reach out when you send them a ticket, and within 24 hours or less, someone is able to get back to you to solve your problem.
I would rate the technical support with Cloudflare as excellent every time I've had to contact them.
The technical support of Cloudflare Web Application Firewall rates between five and seven at maximum.
AWS WAF does scale in the sense that it is fully managed and has automatic scaling.
The scalability of Cloudflare Web Application Firewall rates between 8 to 9, as it depends upon the use cases and what exactly the client needs.
Since it protects web applications from common attacks such as SQL injection and XSS, it is very stable.
In terms of reliability, I would rate AWS WAF about six out of ten due to the need for improved signature sets.
We faced issues with AWS WAF when writing the custom rules.
The stability of Cloudflare Web Application Firewall deserves a perfect 10 out of 10.
Compared to firewalls, WAFs generally provide limited stateful analysis capabilities.
The way we see it now is just mentioned as a percentage from bots and actual users, which should include proper graphs and detailed information.
Features like bot protection or DDoS mitigation, available with other WAF vendors, do not come natively with AWS WAF.
The product can improve by having more multitenancy capability, which is currently not available.
I think they're doing a good job with DNS and as support for any domains that I create or that my clients create, it's mandatory for me to ensure they have Cloudflare as their DNS provider.
And maybe something similar to Pushpin that Fastly has, which is an option where you can push messages that then can be scaled globally over the network.
Due to our status as an AWS shop, AWS WAF is cost-effective for us, and we benefit from discounts due to our extensive use of AWS services.
The licensing cost for AWS WAF is just pay-as-you-go; it is a service-based model.
The biggest benefit of AWS WAF for us is to filter malicious requests, so we can protect our environment and application from malicious actors.
It has also helped to improve the posture of our application, prevent all DDoS attacks, and unnecessary traffic and SQL injection that is reducing the performance of our application.
The cloud-native nature of AWS is crucial since most of our workload is in AWS, making AWS WAF native to Amazon Web Services.
The custom rules and the geo-redundant geographical rule feature, which allows me to implement geographical rules for customers, add significant value.
The best features of Cloudflare Web Application Firewall are multiple, including the WAF, rate limiter, and bot attack protection.
Cloudflare Web Application Firewall's advanced reporting and analytics tools add a layer that we're able to visualize and see before it actually hits the local firewall.
| Product | Mindshare (%) |
|---|---|
| Cloudflare Web Application Firewall | 4.7% |
| AWS WAF | 4.8% |
| Other | 90.5% |

| Company Size | Count |
|---|---|
| Small Business | 22 |
| Midsize Enterprise | 12 |
| Large Enterprise | 26 |
| Company Size | Count |
|---|---|
| Small Business | 16 |
| Midsize Enterprise | 6 |
| Large Enterprise | 6 |
AWS WAF provides configurable rules, integration with AWS services, and scalable protection against web threats like SQL injections and DDoS attacks. Its automation and reliable performance are highly valued by users.
AWS WAF is a web application firewall offering significant security features like geo-restriction, custom rules, and IP filtering. Designed for seamless orchestration within AWS environments, it facilitates easy configuration and threat automation. Users benefit from its security policies, enhancing application performance by protecting against threats such as cross-site scripting. Despite its strengths, there is a call for enhanced user interfaces, better documentation, flexible pricing, and improved support. Expanding features like real-time analysis, bot protection, and AI integration can further elevate its utility.
What are the key features of AWS WAF?AWS WAF is extensively used in industries hosting applications on AWS, protecting sensitive data, and monitoring for unauthorized access. Custom and managed rules help cater to infrastructure needs, serving a vital role in maintaining application security across various sectors.
Cloudflare Web Application Firewall integrates DDoS protection, load balancing, and firewall capabilities. Its ease of use, configurability, and robust security measures make it a versatile choice for protecting web applications.
Cloudflare Web Application Firewall provides a comprehensive defense against threats with advanced reporting and robust security measures. It includes DNS integration, rate limiting, and extensive rule sets, all within a SaaS model that allows API configurability. Users value its caching, scalability, and pricing, although enhancements are needed in rate-limiting and third-party integration. Improvements in customer support, especially in India, real-time controls, and user documentation are also desired. Users seek a more intuitive dashboard, better log management, and improved alert systems, along with multitenancy capabilities and enhanced reporting.
What are the key features of Cloudflare Web Application Firewall?Cloudflare Web Application Firewall finds application in industries like banking and retail by acting as a comprehensive security gateway, managing authentication and authorization while protecting web applications from malicious Layer 7 traffic. It also implements load balancing, CDN, and zero-trust policies, supported by advanced reporting, analytics tools, and threat scoring to meet specific industry needs.
We monitor all Web Application Firewall (WAF) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.