Tencent Cloud WAF
The facts below are what the maker publishes about Tencent Cloud WAF, checked and dated. Our editors have not written about it yet.
Plans and prices
From Tencent Cloud WAF's own pricing page, checked 20 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Premium | Priced on request | 2,500 QPS · 20 domains · 50 Mbps default bandwidth · 2 primary domains |
| Enterprise | Priced on request | 5,000 QPS · 30 domains · 100 Mbps default bandwidth · 3 primary domains |
| Ultimate | Priced on request | 10,000 QPS · 40 domains · 200 Mbps default bandwidth · 4 primary domains |
| Exclusive | Priced on request | Custom pricing · Contact sales for price |
| Extra domain package | $285 a month | up to 10 domains including one primary domain · monthly |
| Extra capacity package | $350 a month | 1,000 additional QPS · 25 Mbps SaaS bandwidth · Advanced Edition · monthly |
| Advanced Edition | $800 a month | 2,500 QPS · 50 Mbps · 2 primary domains · 20 total domains · monthly subscription |
| API Security Advanced Edition | $1,890 a month | API security enabled · SaaS or cloud-native WAF · monthly subscription |
| Enterprise Edition | $2,180 a month | 5,000 QPS · 100 Mbps · 3 primary domains · 30 total domains · monthly subscription |
| Ultimate Edition | $6,380 a month | 10,000 QPS · 200 Mbps · 4 primary domains · 40 total domains · monthly subscription |
| Exclusive Edition | Priced on request | custom specification · ticket quotation |
The facts
Each one read from Tencent Cloud WAF's own pages, with the date it was checked.
What it does
- Anti-tampering
- Core pages can be cached in WAF so cached content can substitute for a tampered origin page.checked 15 Oct 2026
- BGP access
- WAF advertises 30 dedicated BGP IP lines with intelligent node scheduling to reduce access latency.checked 15 Oct 2026
- Bot management
- AI and rules classify crawlers and bots so customers can allow friendly bots while delaying or blocking malicious scraping.checked 15 Oct 2026
- CC attack defense
- Smart CC protection analyzes abnormal origin responses and behavior, then combines access controls, bot checks and rate controls.checked 15 Oct 2026
- Data leakage prevention
- The product describes hiding the application origin, protecting during intrusion and replacing or masking sensitive data afterward.checked 15 Oct 2026
- Deployment modes
- It offers SaaS WAF using DNS CNAME proxying and cloud-native WAF that mirrors HTTP/HTTPS traffic from Tencent CLB.checked 15 Oct 2026
- Documentation depth
- The documentation index includes getting started, operations, security, integrations, FAQs, SLA, privacy/DPA material and API categories for assets, billing, rules, logs and security.checked 15 Oct 2026
- External origins
- SaaS WAF can protect public servers at Tencent Cloud, other clouds or IDC; mainland domains require ICP filing.checked 15 Oct 2026
- Hybrid cloud
- Enterprise and higher cloud-native editions can deploy protection nodes in a customer IDC or private cloud with centralized policies and logs.checked 15 Oct 2026
- Integrations
- Cloud-native WAF integrates with Tencent CLB, API Gateway and supported cloud-function or APISIX traffic paths.checked 15 Oct 2026
- License status
- WAF is presented as Tencent's proprietary hosted service; the public Apache 2.0 licenses apply to SDK repositories rather than the WAF service itself.checked 15 Oct 2026
- Limit: abuse complaints
- Trustpilot reviewers allege inadequate enforcement against scam, phishing and illegal-gambling domains hosted on Tencent infrastructure; these complaints concern Tencent hosting broadly, not specifically WAF.checked 15 Oct 2026
- Limit: G2 reviewers
- G2 reviewers mention upgrade-only changes, difficult serverless or microservice learning, occasional lag and lengthy large-company implementations.checked 15 Oct 2026
- Limit: Gartner reviewers
- Reported weaknesses include localization and global-community gaps, complex advanced configuration, costly bot modules, limited reporting and AI false positives needing manual tuning.checked 15 Oct 2026
- LLM SDK/API
- An SDK/API mode provides LLM content checks without moving a business domain to WAF, including prompt-injection and sensitive-data checks.checked 15 Oct 2026
- Logging limitation
- Default attack logs are available, while full access-log search and retention require Tencent CLS log storage.checked 15 Oct 2026
- Notable outage
- Tencent's status history records a DDoS-protection incident on January 23, 2026 lasting from 18:42 to 18:50 UTC+8.checked 15 Oct 2026
- Notable update
- Tencent's release notes record October 2024 additions including AI bot protection, custom API security events and LLM attack-log parsing.checked 15 Oct 2026
- OWASP protection
- The rule engine covers SQL injection, XSS, CSRF, unauthorized access, WebShell uploads and other OWASP Top 10 threats.checked 15 Oct 2026
- Praise: G2 reviewers
- G2 reviewers describe deployment as easy, pricing as affordable or aggressive, integration as broad and the service as responsive and scalable.checked 15 Oct 2026
The company
- Company legal entity
- Tencent Cloud Computing (Beijing) Co., Ltd. is a PRC limited company established in 2010 and wholly owned by Tencent.checked 15 Oct 2026
- Company profile
- LinkedIn lists Tencent Cloud as founded in 2013, headquartered in Nanshan District, Shenzhen, with more than 10,001 employees.checked 15 Oct 2026
- Founded
- 1998checked 4 Oct 2026
- Headquarters
- Shenzhen, Chinachecked 4 Oct 2026
Alternatives to Tencent Cloud WAF
- 1
BitNinja
Free planAndroidiOSWebAPI8.2From $6 a month - 2
Cloudbric
Free planAndroidiOSWebAPI8.2From $2.08 a month - 3
Oracle Cloud Infrastructure Secret Management
Free planWebAPI7.0Free plan - 4
DataDome API Protection
AndroidiOSWebAPI6.8From $3,830 a month - 5
Gcore WAAP
Free planWebAPI6.8From €25 a month - 6
Haltdos
Free planWebAPILinuxSelf-hosted6.8From $30 a month