AWS WAF
AWS WAF protects web applications from common exploits by filtering requests and applying security rules.
What AWS WAF is
AWS WAF protects web applications from common exploits by filtering requests and applying security rules. Rules can evaluate IP addresses, HTTP headers and bodies, and custom URIs, and can block SQL injection and cross-site scripting. Managed rule groups include protections for bots, account takeover, and fraudulent account creation. Bot Control can block or rate-limit pervasive bots while allowing common bots such as status monitors and search engines. Fraud Control monitors login and signup pages for compromised credentials and fake account creation. A guided setup provides a single-page workflow with security defaults tailored to an application type, and centralized rules can be reused across websites and applications. Optional or recommended JavaScript and iOS/Android SDKs provide additional device telemetry for account takeover and account creation fraud prevention. Charges depend on web ACLs, rules, and processed requests, and may vary by AWS Region. Marketplace managed rule groups can add seller fees; AWS WAF charges are also separate from charges for services it integrates with, including CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync, and Shield Advanced. There is no free plan.
Good
- Rules can block SQL injection and cross-site scripting.
- Managed rules include bot and fraud protections.
- Centralized rules can cover multiple websites and applications.
- Guided setup offers security defaults by application type.
Watch out
- No free plan is available.
- Charges depend on ACLs, rules, and processed requests.
- Marketplace managed rules can add seller fees.
Who it suits
AWS WAF suits organizations protecting web applications or APIs with request filtering, managed rules, and bot controls. AWS lists startups, enterprises, nonprofits, and governments among its customers.
Verdict
AWS WAF combines request filtering, managed protections, and reusable rules for web applications. Consider both its usage-based charges and any separate costs for integrated AWS services or Marketplace rule groups.
Plans and prices
From AWS WAF's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Usage-based AWS WAF | — | No upfront commitments · Additional charges may apply for Bot Control, Fraud Control, DDoS Protection, CAPTCHA, and Marketplace managed rule groups · Monthly fees are prorated hourly; charges depend on web ACLs, rules, and requests. |
The facts
Each one read from AWS WAF's own pages, with the date it was checked.
Money
- Additional costs
- Marketplace managed rule groups can incur seller fees in addition to AWS WAF charges.checked 30 Sep 2026
What it does
- AI traffic monetization
- AWS WAF offers configurable pricing and payment verification for AI bots and agents accessing content and APIs, at no additional AWS WAF charge.checked 30 Sep 2026
- Bot controls
- Bot Control can block or rate-limit pervasive bots and allow common bots such as status monitors and search engines.checked 30 Sep 2026
- Compliance
- AWS states it supports 143 security standards and compliance certifications, including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-3, and NIST 800-171.checked 30 Sep 2026
- Fraud prevention
- Fraud Control monitors login and signup pages for compromised credentials and fake account creation.checked 30 Sep 2026
- Integrations
- AWS WAF charges are additional to pricing for CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync, and Shield Advanced.checked 30 Sep 2026
- Intended customers
- AWS says its customers include startups, enterprises, nonprofits, and governments.checked 30 Sep 2026
- Managed rules
- Managed rule groups provide protections including bot control, account takeover prevention, and account creation fraud prevention.checked 30 Sep 2026
- Mobile telemetry
- Account takeover and account creation fraud prevention support optional or recommended JavaScript and iOS/Android SDKs for additional device telemetry.checked 30 Sep 2026
- Pricing factors
- Charges depend on web ACLs, rules, and processed requests, and pricing may vary across AWS Regions.checked 30 Sep 2026
- Protection setup
- Guided setup offers a single-page workflow with preconfigured security defaults tailored to an application type.checked 30 Sep 2026
- Purpose
- AWS WAF protects web applications from common exploits.checked 30 Sep 2026
- Rule reuse
- A centralized set of rules can be deployed across multiple websites and applications.checked 30 Sep 2026
- Support
- AWS offers pricing assistance through specialists who can provide a personalized quote.checked 30 Sep 2026
- Traffic rules
- Rules can filter requests by IP address, HTTP headers and body, and custom URIs, and can block SQL injection and cross-site scripting.checked 30 Sep 2026
Alternatives to AWS WAF
- 1
Cloudflare Gateway
Free planAndroidiOSWebAPI8.3$7 usage-based - 2
DNSFilter
AndroidiOSWebAPI7.8From $1 a month - 3
MalCare
Free planWebSelf-hosted6.9From $99 a year - 4
DataDome API Protection
AndroidiOSWebAPI6.8From $3,830 a month - 5
Gcore WAAP
Free planWebAPI6.8From €25 a month - 6
Wordfence Security
Free planWebSelf-hosted6.8From $149 a year