Firewalls at the edge: what Cloudflare, Cloud Armor and Fastly charge per million requests

The request count, not the feature list, is what splits these three

A web application firewall used to be a line on a CDN invoice. It is now three lines: a monthly base, a charge per rule or rule group, and a charge per million requests processed. The third line is the one that decides the contract, because it scales with traffic while the other two do not.

The pages that matter for this decision publish very different amounts of that arithmetic. Fastly's package page prints a monthly price against a request ceiling for each tier. Cloudflare's plans page describes what each plan is for and what it includes, but the text supplied here carries no per-request rate and no separate WAF price. AWS's WAF page states the billing components by name and leaves the actual figures in a pricing feed the page loads at runtime.

That asymmetry is the finding. A team that wants a per-million number to put in a budget has one vendor publishing a ceiling it can divide into, and two vendors whose numbers arrive by quote or by calculator.

Fastly is the only one of the three that prints a ceiling you can divide into

Fastly's deliver packages are the clearest arithmetic on any of the three pages. Basic is $1,500 a month for 100 million requests, Starter is $6,000 a month for 500 million, Advantage covers 2 billion and Ultimate 5 billion, both quote-only. Divide the two published tiers and the implied rate is $15 per million at Basic and $12 per million at Starter, before any of the included extras are counted.

The extras are what make the comparison honest. Basic carries 20 TLS domains, 30 million image optimisation requests and 100 million WebSocket minutes; Starter doubles the domains to 40 and lifts image requests to 150 million. Advantage and Ultimate move to 80 and 150 domains and 800 million and 2.5 billion image requests. A team whose traffic is mostly HTML and API calls will not touch those lines; a media estate will.

There is a condition attached that a procurement team should read before signing. The package requirements state that deliver packages are intended for web pages including HTML and web APIs, are not intended for streaming services, and that no more than 10% of traffic may originate in the African, Indian or South Korean billing regions. A streaming workload or a user base concentrated in those regions falls outside the package and back into a quote.

Fastly also sells security as its own ladder: Security Core, Security Core Plus and Security Total, all three contact-sales, with custom rule allowances of 5, 25 and 100 and workspaces of 5, 20 and 20. The WAF is not folded into the deliver price on the page, so the two ladders add up.

Cloudflare publishes the plan shape and withholds the rate

The Cloudflare plans page supplied here organises the offer by audience rather than by request volume. It describes a free tier for personal or hobby projects that are not business-critical, a paid tier for mission-critical applications, a tier for teams over 50 solving narrow SSE use cases without enterprise support, and a tier for organisations building toward full-featured SASE or workspace security. Support moves from self-serve to phone, chat and ticket, with professional services as an add-on.

What the page does not carry is a number a buyer can divide by requests. There is no per-million rate, no request ceiling per plan and no separate WAF line in the text. The add-ons section names load balancing, optimised routing with Smart Routing and Tiered Caching, video, WordPress optimisation and persistent object storage, and prints one price: $5 a month on the free plan for the site-speed add-on, included with Pro, Business and Enterprise. That is the only figure in the supplied text.

The page does make claims a buyer can hold the vendor to. It says the platform is built on systems powering 20% of the Internet, that Workers deploy to 330+ cities, and that the pricing is predictable without surprises. None of those is a rate. The question to put to the account team is the marginal cost per million requests above the plan ceiling, and whether WAF rule evaluation is metered separately from CDN delivery.

Cloudflare's developer documentation, which is a separate page, prices Workers by usage and describes flexible pricing that is affordable at any scale, without printing the rate. The pattern is consistent: the shape of the billing is public, the number is not.

AWS WAF is the one that itemises every line, including the ones that surprise

AWS's WAF page is the most explicit of the three about mechanics. Charges are based on the number of web access control lists created, the number of rules added per ACL, and the number of web requests received. There are no upfront commitments, monthly fees are prorated hourly, and the charges sit on top of CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing rather than replacing any of them.

The per-rule line has a second layer. Each rule group or managed rule group added to a web ACL costs $1.00 a month, prorated hourly, and rules inside a group that you create are charged as rules. Two capacity lines follow: an additional $0.20 per million requests for each 500 WCUs the web ACL uses beyond the default allocation of 1,500, and $0.30 per million requests for each additional 16KB analysed beyond the default body inspection limit. Allow, block and count actions carry no extra charge.

Bot and fraud controls are metered separately. Common Bot Control includes the first 10 million requests a month free, Targeted Bot Control the first 1 million, and CAPTCHA attempts and challenge responses are billed per ten thousand attempts and per million responses served. AWS also states that WAF includes 500 MB of CloudWatch Logs ingestion per 1 million WAF requests, with usage beyond that billed by CloudWatch at the WAF-specific vended logs rate for the region.

The page names every component and then loads the figures from a pricing endpoint. A buyer can read exactly what will be charged and still needs the calculator, or the region's rate card, to turn it into a monthly number.

What to ask for when the rate is not on the page

For Cloudflare, ask for the marginal rate per million requests above the plan ceiling, whether WAF rule evaluation is metered separately from delivery, and which add-ons are required rather than optional for the traffic profile in question. The page prices one add-on at $5 a month on the free plan and lists the rest without figures, so the add-on total is a quote item.

For Fastly, ask which of the four deliver packages the request volume lands in, whether the 10% regional traffic condition is met, and what the security ladder adds on top of the deliver price. The published tiers give a starting rate of $15 and $12 per million; the quote-only tiers above 500 million requests are where the volume discount lives, and the page does not print it.

For AWS, ask for the region's web ACL and rule rates, the expected WCU consumption of the managed rule groups in use, and the body inspection size the application actually needs. The $0.20 and $0.30 per million surcharges are published as rates, which means they can be modelled before signature rather than discovered on the first invoice.

One cross-check applies to all three. The request count that matters is the count the WAF processes, not the count the marketing dashboard reports, and bot traffic inflates it. A team that has never separated human from automated requests should measure that split before comparing any per-million rate.

The decision rule

Choose Fastly if the traffic is web pages and APIs rather than streaming, sits mostly outside the African, Indian and South Korean billing regions, and lands under 500 million requests a month, because the published $1,500 and $6,000 packages give a rate you can divide and a ceiling you can forecast against. Above 500 million requests the package price disappears into a quote and the arithmetic advantage goes with it.

Choose AWS WAF if the estate already runs on CloudFront, ALB or API Gateway and the team wants every charge itemised before it is incurred, because the page names the ACL fee, the rule fee, the rule group fee and the two capacity surcharges even though the figures load from a feed. Budget for the WCU and body inspection lines, which are the ones that move when a managed rule group is added.

Wait on Cloudflare, or treat it as a quote, if the decision turns on per-million cost, because the plans page describes the tiers and withholds the rate. It becomes the right answer when the estate is consolidating toward SASE and Zero Trust on one platform, where the plan structure and the 330+ city network matter more than a rate the page does not print.