Most teams don't have a security decision to make when they pick a WAF. They have a cost model decision, and it just looks like a security decision from the outside.
Every AWS WAF vs Cloudflare comparison on the first page of Google walks through rule sets, managed rule groups, and detection accuracy, then treats price as a footnote at the bottom. That ordering is backwards for most of the teams actually making this decision.
The two platforms aren't identical on security: both cover core web exploits and baseline DDoS/IP filtering, but AWS splits bot detection and account security into separate metered products while Cloudflare bundles them into its plans, and AWS WAF alone integrates with Bedrock AgentCore Gateway for agentic AI workloads. "Broadly comparable protection" is the fairer summary, not identical coverage.
What actually determines whether you're paying $15 a month or $500 a month is a pricing architecture decision made years before you signed up: AWS WAF bills per request, Cloudflare bills per plan tier. At low traffic, that difference is invisible. At scale, it's the whole story.
This guide runs the actual math at three traffic tiers, so the choice comes down to your growth curve instead of a features table.
Key Highlights
AWS WAF prices on three separate meters (Web ACL, rule, and request volume), so the bill is a function of both configuration complexity and traffic, not just traffic alone.
Cloudflare's flat-tier pricing (Free, Pro, Business, Enterprise) means the bill is predictable regardless of request volume within a tier, until you cross into the next one.
In the three scenarios modeled below (10, 20, and 50 rules with an increasing number of managed rule groups), Cloudflare's flat tiers became cheaper than AWS WAF's per-request billing somewhere between the 50-million and 500-million-requests-per-month tiers. That's the crossover for this specific rule configuration, not a general rule, a leaner rule set, a different Cloudflare plan, added bot-control costs, or multiple domains under one account can shift it well outside this range in either direction.
Neither vendor's headline pricing includes the two costs that actually blow up a WAF budget: managed rule group subscriptions and bot/fraud detection add-ons.
How AWS WAF Pricing Actually Works
AWS WAF pricing has three separate line items, and the bill is the sum of all three every month: $5 per Web ACL, $1 per rule (or per managed rule group) attached to that ACL, and $0.60 per million requests inspected. There's no minimum commitment and no free tier, which makes AWS WAF pricing feel approachable at first glance and unpredictable at a second glance, since none of those three numbers cap out.
A single application with one Web ACL, ten rules, and a million monthly requests runs about $15.60. That's the number every AWS WAF pricing page leads with. It's also the number that stops applying the moment traffic actually grows, because the request charge and the rule charge both scale linearly with no ceiling.
How Cloudflare Prices Its WAF
Cloudflare takes the opposite approach: a small number of flat-rate tiers rather than a component-based meter. The Free plan includes a basic managed WAF ruleset at no cost. Pro runs $20/month with unlimited requests.
Business jumps to $200/month and bundles in stronger bot management. Enterprise moves to custom pricing with full API Shield and bot management are included.
The trade-off for that predictability is architectural: Cloudflare needs your traffic proxied through its edge network to apply WAF rules, which is a bigger integration decision for an application that's already deeply wired into AWS-native services than adding a Web ACL to an existing Application Load Balancer.
WAF Pricing at Three Traffic Tiers, and What the Sticker Price Leaves Out
The numbers below cover WAF pricing only. They exclude the architectural cost underneath: AWS WAF attaches directly to infrastructure you already run (ALB, CloudFront, API Gateway), while Cloudflare requires proxying traffic through its edge network first, DNS changes, a new hop, and real re-architecting effort. That cost grows with scale, so it matters more at higher tiers, not less.
One clarification worth making explicit: AWS's own managed rule groups (Core Rule Set, SQL Database rule set, etc.) bill at the standard $1/rule-group/month rate, the same as a custom rule, per AWS's own pricing page. There's no separate $30-60/month charge unless you subscribe to a third-party AWS Marketplace rule group, which carries its own vendor-set price (AWS's example: $20/month + $1.20/million requests; Fortinet's actual listing: $30/month + $1.80/million requests). The examples below use AWS-provided rule groups only, so they're reproducible.
Small site (1M requests/month, 10 rules): AWS WAF: $15.60/month ($5 ACL + $10 rules + $0.60 requests). Cloudflare Free: $0. The architectural switch is cheap at this scale, so the WAF gap is close to the real total difference.
Growing app (50M requests/month, 20 rules, 2 AWS-managed rule groups): AWS WAF: $57/month ($5 + $22 for 22 rule units + $30 requests). Cloudflare Pro: $20-25/month, still cheaper, but by a much smaller margin than an unreconciled estimate suggests. This is also where re-architecting for Cloudflare stops being trivial, DNS cutover, security-group validation, possible latency, easily costing more engineering time than the WAF savings recover for months.
Mid-size platform (500M requests/month, 2 ACLs, 50 rules, 4 rule groups): AWS WAF: $364/month ($10 + $54 + $300). Cloudflare Business: $200-250/month, still cheaper, but the gap ($114-164) is smaller than a rough estimate implies. At this scale, switching architectures means re-routing production traffic, a weeks-long project, not a DNS change.
The real trade-off: Cloudflare's WAF savings and its architectural switching cost move in opposite directions as traffic scales, cheapest to switch when savings matter least, most expensive when they matter most.
Where AWS WAF Pulls Ahead Despite the Price
Cost isn't the only variable, and there's one recent development worth factoring in directly: AWS WAF reached general availability for Bedrock AgentCore Gateway protection on June 29, 2026, giving it native support for securing agentic AI workloads that Cloudflare doesn't yet have a dedicated equivalent for as of this writing.
For teams already running AI agents against AWS-native infrastructure, this closes a gap that would otherwise require a separate security layer, and it's the kind of consideration that belongs in the same conversation as monitoring cloud costs for AI and ML workloads, since agentic workloads tend to introduce cost and security surface area at the same time.
AWS WAF also integrates natively with CloudFront, Application Load Balancer, API Gateway, AppSync, and Verified Access without any traffic re-routing, which matters more for teams already deep in the AWS ecosystem than the price difference does at low-to-moderate scale.
The Hidden Costs Neither Vendor Leads With
The sticker prices above aren't the full story on either side. Bot Control on AWS WAF adds $10 per Web ACL per month plus its own per-request fee: the "Common" tier includes the first 10 million requests free, then $1 per million after that; the ML-driven "Targeted" tier includes only 1 million free requests before jumping to $10 per million.
Account Takeover Prevention and Account Creation Fraud Prevention are priced separately again, per login or registration attempt. None of these show up in the "$15.60/month" headline number.
On the Cloudflare side, the equivalent bot management (Super Bot Fight Mode) is bundled into the Business tier rather than priced separately, which is cheaper in absolute terms once you need it, but means you can't add bot protection to the Free or Pro tier without upgrading the entire plan.
There's also a real cost the pricing page misses entirely: rule tuning is ongoing work, not a one-time setup, as attack patterns and false-positive rates shift over time. That's engineering time worth budgeting for, even without a precise hours-per-month figure to cite.
This is the same blind spot that shows up across most infrastructure cost decisions: the sticker price rarely includes the operational cost of running the thing, which is exactly why a proper cloud cost analysis separates the driver (in this case, request volume and rule complexity) from the symptom (the invoice total) before comparing two options.
Making the Call
If your traffic is stable and under about 20 million requests a month, AWS WAF's per-request model is genuinely competitive, and the native integration with your existing AWS services is worth more than the small price gap.
If you're on a steep growth curve, or you already know you'll need bot management, Cloudflare's flat tiers stop the bill from compounding the way AWS WAF's linear pricing does. This is really the same trade-off that shows up in our broader comparison of AWS and Cloudflare for CDN and compute workloads: predictable flat pricing versus granular, usage-based control.
Either way, the decision shouldn't be made off the sticker price. Model your actual request volume forward 12 months, add the managed rule groups and bot protection you'll realistically need, and compare the real trajectory, not the entry-level number both vendors lead with.
Get a free cloud cost assessment, and we'll map your current WAF spend (or your planned one) against your traffic growth curve, so the AWS-vs-Cloudflare call is based on where your bill is headed, not just where it starts.
