WAF and DDoS protection costs on the major clouds

By Rohit Athaide · Published 4 Nov 2026

Short answer: a web application firewall (WAF) filters web requests to block common attacks. DDoS protection absorbs floods of traffic meant to knock a site offline. Both appear on the bill as separate lines. Basic DDoS protection is generally included. WAFs are charged per policy, per rule and per million requests inspected.

Key points

• Basic DDoS protection is included on the large clouds. Advanced plans are paid.
• WAF fees come in three parts: policy, rules and requests.
• Managed rule sets and bot control cost extra.
• A CDN in front reduces inspected requests.
• Our web app estimate does not include a WAF.

Which services are involved?

Check the vendor’s page for what is included at no charge, since that changes.

How are WAFs billed?

1. A fee per policy or web ACL, charged by the month or hour.
2. A fee per rule, again monthly.
3. A fee per million requests inspected. This grows with traffic.
4. Extra charges for managed rule sets or advanced features such as bot control.

Some WAFs are included in the price of a gateway or CDN tier, and others are charged on top. Compare the total including the gateway.

What does a worked example look like?

Made-up round numbers to show the method, not real prices. A site receives 50 million requests a month. The WAF has one policy, 10 rules and a managed rule set.

Now put a CDN in front that answers 80 percent of requests from cache. Only 10 million reach the origin WAF, so the request line becomes 6.00 and the total 31.00, a 44 percent saving. If the WAF runs at the CDN edge instead, the pricing follows that product’s own meters. Request volume is the line that scales, so cutting inspected requests is the biggest lever.

What about DDoS protection?

Basic protection against common network floods is usually included. Advanced plans, often a flat monthly fee with a long commitment, add response support and cost protection. Small sites rarely need them. Businesses that lose money when they are offline do.

What makes it grow?

• High request volume, including bots.
• Many rules and rule groups.
• Logging every request, which is billed as ingested data. See logging and monitoring costs.

How do I reduce the cost?

Put a CDN in front, since cached requests never reach the WAF at the origin and cost less. See using a CDN. Protect only the paths that need it. Our web app estimate does not include a WAF, so add it separately. See hidden cloud costs.

Which mistakes are common?

• Turning on every managed rule set by default.
• Logging every allowed request in full.
• Paying for an advanced DDoS plan for a low-risk site.
• Forgetting that a WAF bills per request, so bot traffic costs money.

Decision checklist

• What is the monthly request volume, and how much is cacheable?
• Which rules do I actually need?
• Is advanced DDoS protection justified by the cost of downtime?
• Are logs sampled?

Next steps

See load balancer costs and data transfer costs for the other network lines on a web app bill.