Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

AWS WAF review

#2 of 35 in Web Application Firewall SoftwareWeb Security SoftwareWebsite Security Software

Flexible AWS-native protection with usage-based pricing that requires careful cost planning.

9.2/10Editor score
Visit AWS WAF
AWS WAF9.2 Visit AWS WAF

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

AWS WAF is a managed web application firewall for organizations operating applications on AWS. It monitors HTTP(S) requests sent to protected AWS resources and lets teams allow, block, count, challenge, or rate-limit traffic. Rules can use conditions such as IP addresses, headers, request bodies, URIs, and attack signatures. The service covers web applications and APIs, making it suited to teams that want AWS-native controls across CloudFront, API Gateway, Application Load Balancers, AppSync, Cognito, App Runner, Amplify, and other supported resources.

Pricing is usage-based rather than organized into conventional feature tiers. The Web ACL plan costs $5 per web ACL per month, while Rules cost $1 per rule per month. Request processing costs $0.60 per 1 million requests per month. These components make the low entry price clear, but total cost depends on the number of web ACLs, rules, and inspected requests. Charges for connected AWS services, including CloudFront, API Gateway, Application Load Balancer, AppSync, Cognito, and Shield Advanced, are separate from AWS WAF pricing.

Protection depth is a central strength. AWS WAF combines managed rules for common exploits with filtering by request attributes, rate-based controls, bot monitoring and blocking, CAPTCHA, silent browser challenges, centralized logging, filtering and redaction, and Layer 7 DDoS mitigation. It also supports API protection and AWS application resources. Choose it when your applications already depend on AWS services and you want configurable traffic controls. Teams seeking a conventional tiered plan or a simpler cost model should account for the separate rule and request-processing charges before choosing it.

AWS WAF pros and cons

  • Where it wins
    • Managed rules cover common web exploits, SQL injection, and cross-site scripting.
    • Supports bot controls, rate limiting, CAPTCHA, and Layer 7 DDoS mitigation.
    • Integrates with CloudFront, API Gateway, ALB, AppSync, and other AWS services.
  • Where it doesn't
    • No free plan is available.
    • Rules and request processing add usage-based charges.
    • Connected AWS services can incur separate charges.

AWS WAF fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update