We just raised a $30M Series A: Read our story

Cloudflare Web Application Firewall OverviewUNIXBusinessApplication

Cloudflare Web Application Firewall is #16 ranked solution in top Web Application Firewalls. IT Central Station users give Cloudflare Web Application Firewall an average rating of 8 out of 10. Cloudflare Web Application Firewall is most commonly compared to Azure Front Door:Cloudflare Web Application Firewall vs Azure Front Door. The top industry researching this solution are professionals from a comms service provider, accounting for 27% of all views.
What is Cloudflare Web Application Firewall?

Cloudflare Web Application Firewall's intuitive dashboard enables users to build powerful rules through easy clicks and also provides Terraform integration. Every request to the WAF is inspected against the rule engine and the threat intelligence curated from protecting over 27 Million websites. Suspicious requests can be blocked, challenged or logged as per the needs of the user while legitimate requests are routed to the destination, agnostic of whether it lives on-premise or in the cloud. Analytics and Cloudflare Logs enable visibility into actionable metrics for the user.

Cloudflare Web Application Firewall was previously known as Cloudflare WAF.

Buyer's Guide

Download the Web Application Firewall (WAF) Buyer's Guide including reviews and more. Updated: November 2021

Cloudflare Web Application Firewall Customers
crunchbase, udacity, marketo, okcupid, zendesk
Cloudflare Web Application Firewall Video

Pricing Advice

What users are saying about Cloudflare Web Application Firewall pricing:
  • "The pricing model is very straightforward compared to the competition. You just pay per month for the product and usage."
  • "We pay $210 per month for CloudFlare WAF."

Cloudflare Web Application Firewall Reviews

Filter by:
Filter Reviews
Industry
Loading...
Filter Unavailable
Company Size
Loading...
Filter Unavailable
Job Level
Loading...
Filter Unavailable
Rating
Loading...
Filter Unavailable
Considered
Loading...
Filter Unavailable
Order by:
Loading...
  • Date
  • Highest Rating
  • Lowest Rating
  • Review Length
Search:
Showingreviews based on the current filters. Reset all filters
SA
Principal Architect at a mining and metals company with 10,001+ employees
Real User
Top 10
A SaaS solution that is API configurable and a convenient part of a suite but needs updating of core rules

Pros and Cons

  • "It is configurable via API."
  • "It is a SaaS solution unlike much of the competition."
  • "The ModSecurity core rules need to be updated."

What is our primary use case?

Our primary use is as a SaaS-based firewall solution for web applications.  

What is most valuable?

The most valuable part of the solution for us overall is exactly that it is a Software-as-a-Service product. It fits our use needs because it is configurable via API.  

What needs improvement?

There is really only one area of the product that I think needs to be improved. That is that Cloudflare should update the version of the ModSecurity core rule set that they run on. They run a pretty old version of ModSecurity from 2013 and they need to update it. That is one thing I would very much like to see in a future release.  

The main issue that we have is really a decision about how the product fits our model. We use both AWS and Azure, and they have similar products. We are trying to determine whether or not we go for a cloud-native solution per the cloud provider we are using or stick with our current model and continue to use Cloudflare. Switching to AW or Azure as a lone solution means we would go with one or the other across all cloud providers to unify our WAF approach. It might simplify how we look at the maintenance of our web application firewall.  

For how long have I used the solution?

We have been using Cloudflare's web application firewall for twelve months.  

What do I think about the stability of the solution?

I am one-hundred percent convinced of the stability of the product.  

What do I think about the scalability of the solution?

I can say I am pretty confident in the scalability of Cloudflare WAF. I believe that they are the largest WAF provider on the internet at the moment. That is probably at least in part because they are pretty scalable. It is our primary WAF product at the moment.  

How are customer service and technical support?

As far as technical support, we have not really had any issues that require contacting them.  

How was the initial setup?

The initial setup of Cloudflare WAF was very easy. It is a SaaS service so it is just online and it is really only a few clicks away to get started with it. There is no physical infrastructure to bother with so that whole component of maintenance is removed.  

What's my experience with pricing, setup cost, and licensing?

There is no upfront cost for infrastructure because it is a SaaS solution. You just pay per month for the product and usage.  

Which other solutions did I evaluate?

We have evaluated other WAF (Web Application Firewall) solutions. In fact, that is what we are investigating now in taking a deeper look at the advantages of AWS and Azure. That evaluation is really part of my current job.  

At this stage, we have not really considered replacing Cloudflare as a solution with either of those specific solutions or other WAF products. The thing that differentiates Cloudflare WAF is that is it Software-as-a-Service. It is integrated tightly with all of Cloudflare's other services. That is probably the better way to look at it: it is an integrated part of a product suite and not really a separate solution.  

What other advice do I have?

My advice to people who are considering Cloudflare WAF is to check service limits of other providers. Cloudflare does not really have a lot of service limits and that makes a difference. Also, look at the pricing and the pricing models carefully as other products seem to me to become more complicated as your demand scales. It is more straightforward with Cloudflare — or at least it seems to be in comparison to other providers.  

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
BW
Director of Platform and Information Security at a computer software company with 1-10 employees
Real User
Top 5Leaderboard
A scalable multi-cloud holistic security solution with a valuable OWASP security feature

Pros and Cons

  • "The security features are valuable. The particular feature we use is called OWASP."
  • "Their documentation could be better. They don't have documentation that explains everything well. They have documentation for everything you're looking for, but they lack a single piece of documentation to tie everything together. As a new user or beginner, it took us a little bit of time to figure out how to put all these things in place."

What is our primary use case?

As the name suggests, it's a web application firewall. You use it almost like a firewall in front of a web application. It helps filter out the bad traffic or the Layer 7 malicious traffic.

What is most valuable?

Cloudflare provides packaged OWASP rulesets and Cloudflared managed rulesets. Cloudflare provides weekly scheduled rule updates or emergency rule updates. Both rulesets seem very accurate, does not generate much false positives. Before the deployment, I was concerned about how many false positives I have to deal with daily. Very glad the WAF rulesets works out of box, and requires very little tuning or maintenance. 

What needs improvement?

Their documentation could be better. They don't have documentation that explains everything well. They have documentation for everything you're looking for, but they lack a single piece of documentation to tie everything together. As a new user or beginner, it took us a little bit of time to figure out how to put all these things in place. I wish they had easier introduction documents written to help us transition into it. It takes a little bit of effort for a new user to figure out how to do this.

I have asked them for some additional features. I want to be able to quickly find out the rules that I have modified because there are thousands of rules. It took a little bit of effort to figure out which rules I have modified. A feature like that will make it easier for me to track down the changes.

For how long have I used the solution?

I have been using CloudFlare WAF for a few months.

What do I think about the stability of the solution?

CloudFlare WAF is a stable solution. Once you figure out how to set it up and get it running, it's beautiful. 

What do I think about the scalability of the solution?

Scalability is wonderful. It's very easy to scale, and this is the primary reason for selecting it. After all, the software is a service. There's no problem when it comes to scaling.

How are customer service and technical support?

Tech support is solid. No issues there.

How was the initial setup?

The initial setup is a little bit tricky because of poor documentation. Their modeling steers you more towards the enterprise tier. When you pay for the enterprise tier, you can have engineers work directly with you to guide you and help you set it up. But if you just try to do it by yourself, that's when you'll face some difficulty.

What about the implementation team?

We implemented this solution by ourselves.

What's my experience with pricing, setup cost, and licensing?

We pay $210 per month for CloudFlare WAF.

What other advice do I have?

I would tell potential users that once you figured out that initial part, it's straightforward. I would suggest that they look at what they need and compare the costs and management costs. There are various WAFs out there, but it really comes down to comparing the cost and how much effort it takes to deploy it and manage them.

On a scale from one to ten, I would give CloudFlare WAF a solid eight.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
Find out what your peers are saying about Cloudflare, Microsoft, Amazon and others in Web Application Firewall (WAF). Updated: November 2021.
553,954 professionals have used our research since 2012.
MC
Chief Information Officer at a computer software company with 11-50 employees
Real User
Top 5
Reasonably priced with a straightforward setup and the ability to scale

Pros and Cons

  • "Technical support has a very fast response time and they are helpful."
  • "It would be ideal if the solution offered better log integration and more integration with different platforms."

What is our primary use case?

We primarily use the solution as an application firewall.

What is most valuable?

In general, it's a very good product.

The solution is very stable. The performance is great.

The product offers very good scalability.

The pricing is very reasonable.

The installation is very straightforward. It's quite simple.

Technical support has a very fast response time and they are helpful.

We never had any issues with the analytics, dashboards, or monitoring.

What needs improvement?

I can't recall dealing with features that were not sufficient. It's very good.

It would be ideal if the solution offered better log integration and more integration with different platforms.

For how long have I used the solution?

I've been using the solution for about a year and a half at this point. It's been a while. 

What do I think about the stability of the solution?

The performance of the solution is very good. It's very stable. The product doesn't crash or freeze. There are no bugs or glitches. It's reliable. 

What do I think about the scalability of the solution?

The solution can scale quite well. If a company needs to expand the product, it can do so with relative ease.

I am unsure as to if the company plans to increase usage, as I used it primarily at my previous organization. I've since moved on.

How are customer service and technical support?

Technical support is very good. They are very helpful and responsive. We've been quite satisfied with the level of support they provide to our organization.

How was the initial setup?

The initial setup is very straightforward. It's not complex or overly difficult. We found it quite simple to execute. A company should be able to handle the process easily.

We only required two individuals for deployment and maintenance. They were a manager and an admin.

What's my experience with pricing, setup cost, and licensing?

I'm pretty satisfied with the solution in terms of the pricing. It's reasonable. I have no complaints.

Which other solutions did I evaluate?

Before the organizations chose this solution, it's my understanding that it did not evaluate any other options.

What other advice do I have?

We always have the latest version of the solution. As a cloud deployment, it's always updating to the latest version. 

We're a Cloudflare partner.

I'd rate the product at a nine out of ten overall. We've been quite pleased with the overall capabilities of the solution.

I would recommend the solution to other users and companies.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
Buyer's Guide
Download our free Web Application Firewall (WAF) Report and find out what your peers are saying about Cloudflare, Microsoft, Amazon, and more!