Cloudflare WAF · Pro vs Business vs Enterprise

The bouncer at your app's front door. Same engine at every tier — higher tiers unlock more rules, deeper inspection, and advanced detections.

Pro

WAF turned on, managed for you

What it isCloudflare Managed Rules (CVE-driven) plus the OWASP Core Ruleset, maintained by our threat research team. You get a small number of your own custom rules on top.

Who it's forSmall sites and teams that want real application-layer protection without hiring someone to run a WAF.

Rules5 custom rules. Managed rulesets included.

Pro plan — $20/mo

Business

More rules, bigger inspection

What it isEverything in Pro, more room to write your own logic, and PCI-compliant infrastructure for the compliance story.

Who it's forMid-size businesses where the site is tied to revenue and someone owns security part-time.

Rules20 custom rules. Larger request-body inspection.

Business — $200/mo

Enterprise

Unlimited rules + advanced detections

What it isUnlimited custom rules, configurable body inspection, and the advanced add-ons: Exposed / Leaked Credentials, Sensitive Data Detection, JA3/JA4 fingerprinting, Account Takeover, Firewall for AI, plus API Shield on top.

Who it's forEnterprises with real attack surface, compliance mandates, and a security team that wants to write its own rules.

RulesUnlimited. Advanced features are add-ons or bundled packages.

Enterprise — custom

	Pro	Business	Enterprise
Core protection (managed by Cloudflare)
Cloudflare Managed RulesetCVE-driven rules, emergency zero-day rules	✓	✓	✓
OWASP Core RulesetParanoia levels + anomaly scoring	✓	✓	✓
Per-rule sensitivity + log-only modeTune out false positives before you block	✓	✓	✓
Rate limitingBasic on lower tiers, Advanced on Ent	Basic	Basic	✓
Your own logic
Custom rules (Wirefilter expressions)Match URI, headers, body, geo, IP, ASN, JA3/JA4	5	20	Unlimited
Skip / bypass rulesAllowlist admin paths, monitoring IPs, health checks	✓	✓	✓
Terraform + full APIManage rules as code	✓	✓	✓
Bot score as a rule signalGranular 1–99 score needs Bot Management	SBFM	SBFM	✓
Request-body inspectionDefault 128KB; Enterprise can raise the limit	128KB	128KB	✓
Advanced detections (Enterprise add-ons)
Exposed / Leaked Credentials CheckClient-side hashed; password never sent readable	✓	✓	✓
Sensitive Data DetectionFlag PII / secrets in responses	✓	✓	✓
Account Takeover protectionCredential-stuffing / brute-force signals	✓	✓	✓
Firewall for AIGuardrails for LLM-backed endpoints	✓	✓	✓
API Shield (on top of WAF)Schema validation, introspection + query-depth abuse	✓	✓	✓
Operations + compliance
Security Analytics + EventsSee every decision, investigate in ~30 seconds	✓	✓	✓
Logpush to your SIEMSplunk, Datadog, Sumo, etc.	✓	✓	✓
PCI DSS 6.6 app-layer firewallSatisfies the firewall option; AoC in dashboard	✓	✓	✓
Emergency zero-day rules, network-wideLog4Shell rule was live in under 24h	✓	✓	✓

💬 The 30-second pitch

How to frame the WAF in one breath

"The WAF is the bouncer at your website's front door. Every request gets checked before it reaches your origin — SQL injection, cross-site scripting, remote code execution, the whole OWASP Top 10.

Why ours is different: we see about 20% of the internet's traffic. When a new attack pattern shows up on one customer's site, our threat research team writes a rule and deploys it globally — usually within hours. Your engineers aren't in a 2am war room when the next Log4Shell hits. We handle it at the door."

💬 Qualifying questions before you pitch

Find out what they have, who owns it, and where the pain is

"What's protecting your web apps at the application layer today — cloud WAF, appliance, both?"
Listen for AWS WAF, Imperva, F5, Akamai, Fastly, Fortinet, home-grown. Each has its own competitive angle below.
"How big is the team maintaining it, and how much of their week goes to tuning and false-positive triage?"
This is the operational-cost question. "One engineer, half his week" is the pain point. Write it down.
"When the last zero-day dropped — Log4Shell, Spring4Shell, MOVEit — how did that play out for you?"
Honest answer is usually "weekend war room." Our emergency rules ship network-wide in hours, often before the CVE is public.
"How do you handle bots today — separate product, or baked into the WAF?"
Bot score is a signal you write WAF rules against. Paying for a separate bot tool AND a WAF is often two contracts they can collapse into one.
"Any compliance driving this — PCI DSS, HIPAA, SOC 2, FedRAMP?"
PCI DSS 6.6 mandates an app-layer firewall. This shifts the buyer from engineering to compliance — often a faster path to funding.

⚔ Competitive positioning

Their WAF works. Argue cost and threat-intel scale, not "yours is broken."

AWS WAF — nickel-and-dime pricing (per rule, per web ACL, per request). Looks cheap; add the engineer hours and it usually isn't. Only sees traffic to your AWS-hosted app; we sit in 330+ cities and see ~20% of the internet.
Imperva — mature and powerful. Customers switch for deployment simplicity (no appliance, DNS change and you're live) and DDoS integration on the same platform, dashboard, and contract.
F5 BIG-IP ASM — the on-prem WAF enterprises grew up with. Don't rip it out if they're happy. Migrations happen over hardware refresh cycles, tuning burden, and threat-intel scope.
Akamai / Fastly / Fortinet — Kona is closest (cloud-native at the edge); differences are pricing model, update speed, dashboard UX. Fastly is Signal Sciences under the hood — great engine, smaller data footprint. Fortinet is a firewall company doing WAF.

The line to land: "Every WAF eventually stops false positives and stops real attacks. The question isn't which one — it's how much of your team's week it eats, and how fast it reacts when a new zero-day hits."

⚠ Be honest about the edges

Where the WAF stops, so you don't oversell

No WAF catches 100% of attacks. Ours layers managed rules, OWASP CRS, custom rules, rate limiting, and bot scoring — plus Enterprise add-ons. If a customer worries about false negatives, the honest answer is "layer Bot Management on top and add API Shield if you have APIs."

WebSocket payloads after the upgrade are not inspected — only the handshake. For WebSocket-specific protection, put a Worker in front. Flag this upfront; it's a common gap.

TLS terminates at Cloudflare (we see plaintext, inspect, re-encrypt to origin) — standard for any cloud WAF. If they need Cloudflare to never see plaintext, that's a separate conversation (Keyless SSL, Geo Key Manager).

⚠ Three mistakes SEs make on this

Anti-patterns that cost deals or damage the account

1. Arguing "our WAF is better"

The "we already have a WAF" objection is the most common one you'll hear. Don't debate detection quality — reframe around operational cost and threat-intel scale. Their WAF works; the question is what it costs them per week.

2. Duplicating the AppSec live demo

The live SQL-injection demo already proves the WAF in practice. Use the AppSec cheat sheet for the hands-on portion — don't rebuild it inside a WAF conversation.

3. Promising body inspection on everything

Default body inspection is 128KB; larger bodies are skipped to preserve performance. If they serve large uploads, walk through the tradeoffs instead of implying "we inspect it all."