Cloudflare is evolving so quickly that we can't even keep up. In the past two years, they have released two major upgrades to their Web Application Firewall. 

However, the notification part could be improved. It's very much connected to Web Application Firewall, rate-limiting, and DDoS protection. 

The notification could be better configurable. Sometimes it makes too much noise. It should have better threshold handling or some setup features, which could set some thresholds because it tries to do it automatically. So, sometimes it just notifies about things that are not worth noticing and vice versa.

The first one is the log management and reporting part. If they add logs history within the Cloudflare offering, that would be a great benefit.

There are a few features that come free with Cloudflare WAF, such as bot management. When users use it they ask for a fee. Users are not usually aware of these features in the initial phase. Users should know that these features are free for three or four months, and after that, they have to pay for them. This would help to align their expectations from the very first day.

There should be training modules that we use for our sales teams and product experts similar to Fortinet and VMware.

Cloudflare Web Application Firewall should include port forwarding features. It would be good if the solution provided communication channels like a WhatsApp group other than email to provide customer support.

Improvements should be done according to our customer's requirements. 

The accuracy of the Cloudflare Web Application Firewall could be improved by reducing the number of false-negative alerts.

Signature-based detection and data loss prevention could also be improved.

Their documentation could be better. They don't have documentation that explains everything well. They have documentation for everything you're looking for, but they lack a single piece of documentation to tie everything together. As a new user or beginner, it took us a little bit of time to figure out how to put all these things in place. I wish they had easier introduction documents written to help us transition into it. It takes a little bit of effort for a new user to figure out how to do this.

I have asked them for some additional features. I want to be able to quickly find out the rules that I have modified because there are thousands of rules. It took a little bit of effort to figure out which rules I have modified. A feature like that will make it easier for me to track down the changes.

The platform's control features related to real-time authentication and response time need improvement.

The blocked logs are difficult to read at times.

The reporting could be improved if it were more granular. Fortigate Firewall, for example, shows all the events at a glance with different fields on a table; you can scroll through for patterns and look at all events. That's not possible with CloudFlare where I need to analyze a report that summarizes all the data. It requires exporting the report as a CSV file, analyzing it in Excel, and then going into CloudFlare to carry out a deeper analysis. If I could do that high-level analysis from the web console and then drill down specific events, it would be a great feature that would improve this product. 

Sometimes, it is challenging to access our applications using the solution. They should work on this particular area. Also, its availability needs improvement.

I can't recall dealing with features that were not sufficient. It's very good.

It would be ideal if the solution offered better log integration and more integration with different platforms.

Finding vulnerabilities or attack patterns needs to evolve continuously. The landscape is changing. Accordingly, the rules have been changed. The Core Ruleset, is already managing that. It has been good at catching malicious activity so far. They just need to continue to invest in this aspect.

They have some limitations with third-party integrations. For example, we can't integrate with our site.  On-premises, we can't do that. You can on Azure storage, of Google Cloud, however. It works better on the cloud.

We are required to follow a specific and separate set of rules for web applications for DDoS attacks while working with AWS and Azure. Instead, there could be an option to duplicate the cluster to maintain the consistency of rules.

The additional features I wish to see in the next release include rate limiting on Cloudflare Web Application Firewall and advanced DDoS protection. The current product is highly explorable and does not have many limitations. However, there are some limitations in terms of administrative privileges and the way it manages auto-alerts.

Cloudflare needs to improve its customer support for Indian customers and work on the monitoring and reporting features.

Cloudflare Web Application Firewall should improve visibility for a customer.

There is really only one area of the product that I think needs to be improved. That is that Cloudflare should update the version of the ModSecurity core rule set that they run on. They run a pretty old version of ModSecurity from 2013 and they need to update it. That is one thing I would very much like to see in a future release.  

The main issue that we have is really a decision about how the product fits our model. We use both AWS and Azure, and they have similar products. We are trying to determine whether or not we go for a cloud-native solution per the cloud provider we are using or stick with our current model and continue to use Cloudflare. Switching to AW or Azure as a lone solution means we would go with one or the other across all cloud providers to unify our WAF approach. It might simplify how we look at the maintenance of our web application firewall.