vioscaleAI
WAFUnclaimed

AWS WAF

A cloud-based firewall service that protects web applications and APIs from attacks and DDoS threats

Visit websiteCompare alternatives
Vendor
Amazon Web Services
Also known as
aws-waf

Available worldwide · Popular in: US

What is AWS WAF?

AWS WAF filters web requests and API traffic to block common attacks like SQL injection and cross-site scripting. It manages bot traffic through rate limiting and automatic detection, and provides automated layer 7 DDoS protection.

Independently observed

AWS WAF pricing

Plans, per-tier features and add-ons, dated and linked to live pricing. Pricing changes often; always verify at source before you rely on it.

Pricing as of verify at live pricing ↗Independently observed
from $1/moUsage-basedFree tier

Usage-based pricing: $5/web ACL, $1/rule, plus per-request charges. Free tier for bot control.

Standard WAF

$5/web ACL + $1/rule + per-million-request charges
monthly

Base WAF protection with customizable rules

cloudwatch_logs_per_million_requests
500 MB
  • Web ACL creation and management
  • Custom rule creation
  • Allow/Block/Count actions
  • Request filtering and inspection
  • CloudWatch Logs integration

Bot Control

Free tier + $1/million requests after free allowance
monthly

Visibility and control over bot traffic

common_bot_control_free_requests
10 million/month
targeted_bot_control_free_requests
1 million/month
  • Common bot detection and management
  • Targeted bot control
  • Bot traffic visibility
  • Rate limiting for bot traffic
  • Scope-down statements to reduce evaluated traffic

Fraud Control

$10/month per web ACL + per-request charges
monthly

Account takeover prevention and account creation fraud prevention

  • Account Takeover Prevention
  • Account Creation Fraud Prevention
  • Compromised credential monitoring
  • Fake account creation detection

Add-ons

  • CAPTCHA and Challenge responses
  • Managed rule groups from AWS Marketplace

What AWS WAF does

The capabilities that matter for waf, normalised so it lines up with every alternative. “-” means we haven't confirmed it, not that it's missing.

Capabilities
Deployment model
Cloud
Owasp top 10 protection
✓
Custom rules engine
✓
Bot management
✓
API discovery protection
-
Ddos l7 protection
✓
Rate limiting
✓
Threat intel feeds
-
SIEM logging integration
-
Kubernetes ingress support
-
SOC2 type ii
-
PCI DSS compliant
-
Fedramp authorized
-
Pricing model
Usage based
Independently observed

Platform & deployment

Independently observed
Platforms
  • Web
Deployment
  • Cloud / SaaS

Integrations (5)

Independently observed
  • Amazon CloudFront
  • Amazon API Gateway
  • AWS CloudWatch
  • AWS Shield
  • AWS Marketplace (third-party managed rules)

AWS WAF FAQ

Common questions about AWS WAF, answered from independent, dated evidence.

What is AWS WAF?

AWS WAF is a managed web application firewall service that helps protect web applications against common exploits and bots. It uses rules to allow, block, or count web requests, and supports bot management, fraud prevention, and DDoS protection. It is indexed under WAF.

Source: https://aws.amazon.com/waf/pricing/

Is AWS WAF free?

AWS WAF offers a free tier, so you can start without paying. Paid plans start at $0.60. Prices are published openly on the vendor's own pricing page. Pricing changes often, so verify at source before relying on it.

Source: https://aws.amazon.com/waf/pricing/

What platforms does AWS WAF support?

AWS WAF supports the web and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.

Source: https://aws.amazon.com/waf/pricing/

Can AWS WAF be self-hosted?

We have only confirmed a cloud / SaaS deployment for AWS WAF, so it appears to be vendor-hosted. If a self-hosted option exists we have not found it documented publicly.

Source: https://aws.amazon.com/waf/pricing/

What does AWS WAF integrate with?

We have confirmed 5 integrations for AWS WAF, including Amazon CloudFront, Amazon API Gateway, AWS CloudWatch, AWS Shield and AWS Marketplace (third-party managed rules). This is what we could verify from public sources, so the vendor may support others we have not indexed.

Source: https://aws.amazon.com/waf/pricing/

What security certifications does AWS WAF have?

We have independently confirmed HIPAA and GDPR for AWS WAF. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as AWS WAF not holding them. Always confirm compliance directly before you rely on it.

Source: https://aws.amazon.com/compliance/?nc2=h_dsc_aa_cmp

Where is AWS WAF available?

AWS WAF is available worldwide. The vendor is headquartered in the United States.

Source: https://aws.amazon.com/waf/pricing/

AWS WAF alternatives

Other waf we track, ranked by the same independent score.

All AWS WAF alternatives, ranked →

Compare AWS WAF

Side by side against other waf, attribute by attribute, with a source on every value.

Independent · unbought · dated

The vioscaleAI score: one lens on the evidence

Not user reviews and not a paid placement: a confidence-weighted blend of the independent signals below (adoption, activity, security posture, and more), which you can sort and re-weight yourself. Vendors can correct their listing but can never move their rank, and stars are weighted low as a vanity metric. It is one way to read the evidence for AWS WAF, not the verdict.

Balanced composite 51 / 100
medium · 73%
Signal contributions to the composite score
SignalScoreWeightContributionEvidence
Security posture350.217.3✓
Pricing transparency1000.055.2✓
Reliability500.094.7✓
Capabilities750.053.8✓
Price level800.043.4✓
Integrations220.051.1✓

Computed . Re-weight it by intent, or see the full method.

All data & sourcesshow ↓

Every value we hold, with its source, retrieval date, and confidence. This is the evidence behind the score: don't trust it, verify it.

Content

AttributeValueEvidence
Faq7 itemsmediumsource · 2026-09-10 · 64%

Features

AttributeValueEvidence
CapabilitiesPricing model: usage_based · Rate limiting: Yes · Bot management: Yes · Deployment model: cloud · Ddos l7 protection: Yes · Custom rules engine: Yesmediumsource · 2026-10-13 · 60%

Integrations

AttributeValueEvidence
Count5mediumsource · 2026-08-19 · 60%

Market

AttributeValueEvidence
AvailabilityPrimaryMarkets: … · AvailabilityScope: global · AvailableCountries: … · NotAvailableCountries: …mediumsource · 2026-10-13 · 50%

Pricing

AttributeValueEvidence
Free tierYesmediumsource · 2026-10-13 · 60%
Price levellowmediumsource · 2026-10-13 · 60%
Starting priceAmount: 1 · Currency: USDmediumsource · 2026-08-19 · 60%
TransparentYesmediumsource · 2026-10-13 · 60%
Modelfreemiummediumsource · 2026-10-13 · 60%

Reliability

AttributeValueEvidence
Status pageYesmediumsource · 2026-08-19 · 60%

Security

AttributeValueEvidence
Disclosure policyYesmediumsource · 2026-08-19 · 60%
FedrampYeshighsource · 2026-10-13 · 75%
GdprYeshighsource · 2026-10-13 · 75%
HipaaYeshighsource · 2026-10-13 · 75%
PciYeshighsource · 2026-10-13 · 75%
Trust centerhttps://aws.amazon.com/compliance/?nc2=h_dsc_aa_cmpmediumsource · 2026-10-13 · 60%
Still deciding?

Is AWS WAF the right choice for you?

Tell us the job, the constraints and what you weigh most, and we will rank AWS WAF against the rest of the waf we index, using the same dated evidence weighted your way.

Free to run, no account needed to start. How the evaluation works

For the makers of AWS WAF

Is this your product?

This profile was built from public sources without asking you. You can take the badge below and use it anywhere, and you can claim the profile to correct anything we got wrong. Both are free, and neither moves AWS WAF up or down: nobody can buy rank here, including you.

Take the badge

Live, always current, and free to use on your own site. It shows AWS WAF's independent score and links back to this profile.

AWS WAF, verified on vioscaleAI
HTML
<a href="https://www.vioscale.ai/software/aws-waf" target="_blank" rel="noopener">
  <img src="https://www.vioscale.ai/badge/software/aws-waf.svg" alt="AWS WAF, verified on vioscaleAI" width="330" height="76" loading="lazy" />
</a>
Markdown, for a README →
Markdown
[![AWS WAF, verified on vioscaleAI](https://www.vioscale.ai/badge/software/aws-waf.svg)](https://www.vioscale.ai/software/aws-waf)

Claim the profile

Verify you control the domain, then point us at the pages that state the facts about AWS WAF and add your own description and media. Free, and it does not change the score.

  • Correct anything wrong, with evidence
  • Point our crawler at the pages that matter
  • Write your own description and add media
Claim AWS WAF

Not the owner? How vendor profiles work

For AI & developers

This profile is machine-readable and citable. Fetch it as JSON, Markdown, or GraphQL, or via MCP.

Machine formatsMarkdownJSONGraphQLMarkdown is open. JSON and GraphQL need a free key.

Last updated . Canonical URI: https://www.vioscale.ai/software/aws-waf.