AWS WAF
A cloud-native web application firewall that protects web applications and APIs from web-based attacks
- Also known as
- aws-waf
Available worldwide
What is AWS WAF?
AWS WAF is a managed web application firewall service that helps protect web applications against common exploits and bots. It uses rules to allow, block, or count web requests, and supports bot management, fraud prevention, and DDoS protection.
AWS WAF pricing
Plans, per-tier features and add-ons, dated and linked to live pricing. Pricing changes often; always verify at source before you rely on it.
Usage-based pricing: $5/web ACL, $1/rule, plus per-request charges. Free tier for bot control.
Standard WAF
Base WAF protection with customizable rules
- cloudwatch_logs_per_million_requests
- 500 MB
- Web ACL creation and management
- Custom rule creation
- Allow/Block/Count actions
- Request filtering and inspection
- CloudWatch Logs integration
Bot Control
Visibility and control over bot traffic
- common_bot_control_free_requests
- 10 million/month
- targeted_bot_control_free_requests
- 1 million/month
- Common bot detection and management
- Targeted bot control
- Bot traffic visibility
- Rate limiting for bot traffic
- Scope-down statements to reduce evaluated traffic
Fraud Control
Account takeover prevention and account creation fraud prevention
- Account Takeover Prevention
- Account Creation Fraud Prevention
- Compromised credential monitoring
- Fake account creation detection
Add-ons
- CAPTCHA and Challenge responses
- Managed rule groups from AWS Marketplace
Platform & deployment
Independently observed- CLI
- Web
- Cloud / SaaS
Integrations (5)
Independently observed- Amazon CloudFront
- Amazon API Gateway
- AWS CloudWatch
- AWS Shield
- AWS Marketplace (third-party managed rules)
AWS WAF alternatives
Other waf we track, ranked by the same independent score.
- Fastly Next-Gen WAFDistributed web application and API security platform deployable anywhere your infrastructure liveslow · 26%
- Cloudflare WAFAn edge-deployed security layer that inspects incoming web traffic and prevents attacks before they reach your applicationsmedium · 53%
- Corazalow · 32%
- ModSecuritylow · 20%
- Imperva WAFlow · 3%
- Barracuda Web Application FirewallDefend applications and APIs against cyber threats with intelligent attack detection and preventionlow · 30%
Compare AWS WAF
Side by side against other waf, attribute by attribute, with a source on every value.
The Vioscale score: one lens on the evidence
Not user reviews and not a paid placement: a confidence-weighted blend of the independent signals below (adoption, activity, security posture, and more), which you can sort and re-weight yourself. Vendors can correct their listing but can never move their rank, and stars are weighted low as a vanity metric. It is one way to read the evidence for AWS WAF, not the verdict.
| Signal | Score | Weight | Contribution | Evidence |
|---|---|---|---|---|
| Pricing transparency | 100 | 0.08 | 8.4 | ✓ |
| Price level | 80 | 0.05 | 4.2 | ✓ |
| Reliability | 50 | 0.07 | 3.7 | ✓ |
| Security posture | 35 | 0.07 | 2.6 | ✓ |
| Integrations | 22 | 0.04 | 0.9 | ✓ |
| Capabilities | 0 | 0.05 | 0.0 | - |
Computed . Re-weight it by intent, or see the full method.
All data & sourcesshow ↓
Every value we hold, with its source, retrieval date, and confidence. This is the evidence behind the score: don't trust it, verify it.
Integrations
| Attribute | Value | Evidence |
|---|---|---|
| Count | 5 | mediumsource · 2026-08-19 · 60% |
Market
| Attribute | Value | Evidence |
|---|---|---|
| Availability | HqCountry: US · PrimaryMarkets: … · AvailabilityScope: global · AvailableCountries: … · NotAvailableCountries: … | highsource · 2026-08-19 · 75% |
Pricing
Reliability
| Attribute | Value | Evidence |
|---|---|---|
| Status page | Yes | mediumsource · 2026-08-19 · 60% |