Cloudflare Web Application Firewall Reviews

We are using Cloudflare Web Application Firewall's advanced reporting and analytics tools with their Zero Trust, so every employee needs to check DNS requests and network traffic. We have strict network rules and access lists, and we can do triage if we have any data leakage. For that, we are using Datadog SIEM, and we are ingesting all logs from Defender, Azure Defender, Cloudflare Zero Trust into our Datadog SIEM, and then from Datadog SIEM we are doing triage if there is a need.

If we need to investigate a DDoS attack, then we are only using Cloudflare, nothing else.

We are using the rule-based logic feature with Cloudflare Web Application Firewall Zero Trust.

The impact of Cloudflare Web Application Firewall's integration with existing web technologies on our site's performance and security measures is quite great, actually. We never know when we have any issues. We are in the gambling business, in the betting business, so we have constant daily DDoS attacks, and it's always working fine.

Cloudflare Web Application Firewall automatically scales. We do not use any other tool from Cloudflare such as Workers, so for scaling, we do everything by ourselves. We don't even use Cloudflare Bot Management because it's too expensive; you need to pay per request, and it's much cheaper to get one or two additional machines.

In terms of metrics for Cloudflare Web Application Firewall effectiveness in mitigating threats, we always measure the number of requests, nothing else. We compare the number of requests that are not good and we have metrics per request that we send to Datadog. That means that we know how many requests came from the public internet to our services and what is the percentage of those requests that should not hit our servers.

I don't see room for improvement to Cloudflare Web Application Firewall. One thing I don't know much about because we have a dedicated IT team for that, and I'm not involved with Cloudflare much anymore. But if I were to compare them to F5, I would like to see more features that F5 offers. F5 has an option to bring the whole infrastructure, the whole WAF and all their packages, Bot Management, and everything else on your infrastructure. You need to install certain services from their side, and then you can choose if you would like requests to hit your servers immediately or if requests need to be proxied through F5 backbone. That would be a nice addition because we have 90% of the traffic as legit traffic coming from whitelisted servers. If it comes from whitelisted servers, I don't need to go every request through the backbone; I could easily just IP whitelist everything. Then I could maybe have Bot Management on my infrastructure that drastically reduces the price of Cloudflare.

I would like to see Push CDN more improved in the next release of Cloudflare Web Application Firewall. And maybe something similar to Pushpin that Fastly has, which is an option where you can push messages that then can be scaled globally over the network. From our perspective, if we have a listener that listens for stock updates, I would just need to have one processor that pushes those updates to the Cloudflare API, and then Cloudflare would broadcast that message to all listeners. Cloudflare will check the order of the message, and if you, as a customer, are not connected or have some kind of network issue, when you reconnect, you will receive the latest state and missing updates.

I've been using it in my current company for eight years, not as a consultant.

We have zero issues with Cloudflare Web Application Firewall, so it's a 10 out of 10.

We tested another WAF solution, Fastly, and one from Amazon, CloudFront. At the end, we were always missing certain features. On Fastly, you need to code everything, and then there was no direct VPN to your network. The same was the case with CloudFront, same issue, and on CloudFront, you're missing advanced features such as URL rewrites and headers. Some features you can do, but you need to create Lambda functions and that will dramatically increase your price.

I've just tested F5 Web Application Firewall. We have a proof of concept with F5, the cloud solution, I think it's BIG-IP or something similar. What we found out was quite good. Everything worked okay. We appreciate their option to connect different networks and different data centers; that worked well. The only issue was caching, which was quite hard to configure and not as user-friendly as Cloudflare. But everything else compared to Cloudflare was a Swiss knife for network administrators.

We're not using Cloudflare Workers anymore, but we are dealing with Cloudflare Web Application Firewall, Cloudflare One, Image Resizing, Rate Limiting, Analytics, Load Balancers, and Argo Tunnels.

For Cloudflare Web Application Firewall, we did not try to integrate it with any products, but we did migrate from Azure to AWS.

I purchased Cloudflare directly, not from the AWS Marketplace.

I think the licensing model of Cloudflare is quite reasonable.

I give this review a rating of 10 out of 10.

I'm using Cloudflare Web Application Firewall on all my domains and any client domains I have; I set them up with a Cloudflare account.

I have clients in pretty much every industry, including individual businesses, non-profits, lawyers, doctors, and various other professionals.

I have dealt with Cloudflare Web Application Firewall since they released it.

The best features of Cloudflare Web Application Firewall are being able to control access and adding that extra layer above and beyond our internal firewall.

I assess the impact of Cloudflare Web Application Firewall's integration with existing web technologies as basically a front end for edge computing. All the DNS and everything is routed through Cloudflare, so anybody coming to any of the sites has to go through Cloudflare first, making them the first wall of defense.

Cloudflare Web Application Firewall's advanced reporting and analytics tools add a layer that we're able to visualize and see before it actually hits the local firewall.

I assess the performance of the DNS services as fine. I don't see any speed loss, as most of the encrypted DNS we put through our servers ends up at Cloudflare anyhow.

Cloudflare has positively impacted my organization by making it easier for me to handle and set up DNS for multiple clients. I can easily go in and access their accounts, make changes they need, and it's a one-stop shop.

I don't really use the rule-based logic feature or utilize the WAF's ability to scale as a cloud-based service.

I don't have specific areas that could be improved with Cloudflare Web Application Firewall. They are constantly improving and adding features to their feature set. I think they're doing a good job with DNS and as support for any domains that I create or that my clients create, it's mandatory for me to ensure they have Cloudflare as their DNS provider.

I don't have anything specific that I would want in the next releases. When I go and set up a site or look at any of my sites, I discover new features they've implemented and I check them out.

I've been using the DNS product since it was released.

I would rate the technical support with Cloudflare as excellent every time I've had to contact them. I haven't called them but three times.

Positive

I haven't evaluated other WAF solutions as a front end. I've used other DNS providers before, and once I found out about Cloudflare, I switched all my resources and my clients over and haven't switched back. It's a lot more valuable than what they charge.

The initial setup of Cloudflare Web Application Firewall is pretty straightforward for me since I've done enough of them.

I would say it is straightforward for new users, as long as they understand networking and DNS tunneling. Knowing DNS is a must, but other than that, it's great.

The user interface is very simple and straightforward, but users need knowledge about DNS to accomplish tasks.

Regarding return on investment with Cloudflare Web Application Firewall, it costs my time to set them up, but once they're set up, it's complete. Whether they're on a free plan or even if they're on a pay plan, they're not doing that kind of volume to worry about any pricing issues.

My experience with the pricing or licensing of Cloudflare Web Application Firewall is that many features can be accessed for free, so the pricing is definitely reasonable.

The typical use case for Cloudflare Web Application Firewall in my company is that we are providing support to our customers. We have live sites all over the world, and to prevent them from attackers, we use Cloudflare Web Application Firewall.

The best features of Cloudflare Web Application Firewall are multiple, including the WAF, rate limiter, and bot attack protection. The bot fight feature is important as it automatically blocks automated bots, specifically robotic bots, not including SEO crawls. There are multiple features, though I use only a few of them.

I cannot say much about areas of improvement for Cloudflare Web Application Firewall because I haven't gone through deep understanding of it, as I am still learning. However, they need to improve their support because getting a response for basic requests took around 48 hours, which is too long. If I took 48 hours to answer a request at my company, it would be a tough time to see or address the issue, and it would be frustrating.

I have around 1 year of experience with Cloudflare Web Application Firewall.

I rate the stability of Cloudflare Web Application Firewall very high, as I haven't seen any outages since last year.

The stability of Cloudflare Web Application Firewall deserves a perfect 10 out of 10.

The scalability of Cloudflare Web Application Firewall rates between 8 to 9, as it depends upon the use cases and what exactly the client needs. Depending on those factors, we come together on a mutual understanding and utilize the features of Cloudflare Web Application Firewall.

The technical support of Cloudflare Web Application Firewall rates between five and seven at maximum.

The initial setup of Cloudflare Web Application Firewall is straightforward; you just have a few buttons to turn on and off after studying the rules thoroughly.

I have seen a return on investment from Cloudflare Web Application Firewall.

The price of Cloudflare Web Application Firewall is reasonable.

I have an intermediate level of experience with Cloudflare Web Application Firewall.

My relationship with Cloudflare Web Application Firewall is that I am an implementer.

I would definitely recommend others to use Cloudflare Web Application Firewall.

My clients vary in size, including small, medium, and enterprise-level businesses.

Overall, I rate Cloudflare Web Application Firewall an 8 or 9 out of 10.

I use the product for securing web applications and providing DDoS protection from the Internet and malicious users.

The rate limiting features and customizations in terms of URL match and applying policies are valuable to me. The custom rules and the geo-redundant geographical rule feature, which allows me to implement geographical rules for customers, add significant value. 

Additionally, operational manageability is a major benefit for me. Cloudflare is self-sustained instead of requiring on-premises equipment that needs regular updates and maintenance.

The product can improve by having more multitenancy capability, which is currently not available. This improvement would enable managed service providers to implement it more effectively.

I have been using the solution for one and a half years.

I think the response times could be improved slightly.

Neutral

At the moment, I'm using both solutions, however, I tend to move towards Cloudflare since it aligns with the rest of my business. With my firewall, I am using Cloudflare, and for other products, I am using Application Gateways. 

Overall, I am more inclined toward Cloudflare than any other product.

The setup process is very simple for me.

I usually deploy with the help of a team. I am an integrator for my customers.

I'm also aware of Azure Application Gateway.

The overall product rating is nine out of ten. I would definitely recommend it to other users.

I use Cloudflare as a reverse proxy in front of our web part. It is crucial for hiding all traffic with Cloudflare's standard WAF.

For us, the key feature of Cloudflare is DDoS protection and IP hiding, especially since we are a crypto company. We also use rate limiting, particularly for our APIs. Furthermore, we utilize Cloudflare's CDN (cache) functionality, which is not related to security, so I initially skipped mentioning it.

The rate limiting functionality could be enhanced, as we find it somewhat limited.

I have used Cloudflare for approximately two years across different companies.

I have not engaged Cloudflare's technical support, so I cannot comment on it. However, their documentation is comprehensive and reliable.

Neutral

I previously experimented with Azure WAF. In comparison, I find Cloudflare to be easier to implement and more affordable.

The learning curve was steep initially, however, the actual implementation only took about half a day. I first conducted trials with unimportant domains, which took two to three days, before finalizing the setup for our real domain in half a day.

We were a team of three: one responsible for development, another for DevOps, and the third for security.

Cloudflare is cheaper compared to Azure WAF, which I have considered before.

I have previously experimented with Azure WAF.

On a scale from one to ten, I would rate Cloudflare WAF as an eight. I would suggest making the rate limiter functionality better.

As a senior enterprise architect, I work on solution developments using Cloudflare Web Application Firewall, and the other teams of our organization, such as the administration team, perform the daily or BAU activities.

The solution's WAF use case provides protection against DDoS and data injection activities. Cloudflare Web Application Firewall is also utilized for internet-connected applications. One of our organization's customers leverages the solution with the SASE platform for zero-trust security. 

There is a huge signature repository in Cloudflare Web Application Firewall. Whenever there are any new vulnerabilities and attacks, the solution logs it within around 48 hours. There are built-in signatures in the tool, especially for identifying the source and blocking DDoS attacks immediately.  

The solution's learning curve can still be further reduced, which presently stands at two or three months. The product has a custom rule set that users can modify and manifest as needed. The vendor can probably shorten the learning curve using cutting-edge technologies like AI. The solution provider can also work around the web applications and identify the toolset that needs to be implemented to deploy the solution in less time. 

The vendor has launched a SASE product that can function with Cloudflare Web Application Firewall, but many improvements are needed in terms of features, such as the web filtering feature, and CASB has not yet been added. 

I have been using Cloudflare Web Application Firewall for about five years. 

Cloudflare Web Application Firewall is reliably stable. In our organization over the last three or four years, we have witnessed downtime only once, and even that was resolved by the vendor within a few minutes. 

The solution exhibits outstanding scalability due to all the used methods of web application. 

For customer support, there are SLA-based plans which need to be availed. Excellent support is offered for Cloudflare Web Application Firewall. I would rate the tech support a nine out of ten. 

Positive

The product's deployment process is much simpler and shorter than other competitor solutions. The initial setup is straightforward. The deployment duration depends heavily on the learning curve for configuring the web application with Cloudflare Web Application Firewall.

Only when the users start accessing the web application do patterns emerge that suggest which activities to allow. If the deployers can learn the web application processes, including the hash values and operations, then the rules can be set quickly, and the tool can be deployed. 

In reality the product can be deployed immediately, and then the major time is spent customizing the solution to make it relevant to the web applications of a specific environment, which takes two to three months including the rule setting, blocking and modifying tasks. The maintenance is extremely easy because the product is GUI-based and all the portals are accessible. 

The cost of the solution depends upon the type of web application use cases. It starts at $20 and can easily go up to $200 monthly. The SASE product from the same vendor starts at around $8 per month. I think Cloudflare Web Application Firewall is offered at a reasonable price based on its technology and features. 

If the solution is configured well enough, it has proven effective for our organization's customers in helping secure web applications against common threats. Customers must pursue the learning curve, which usually spans two to four months before fine-tuning can be implemented. Cloudflare Web Application Firewall is one of the best industry solutions. 

Cloudflare Web Application Firewall has been very effective in mitigating numerous potential security breaches for our various customers. The learning curve is one of the core aspects of any WAF solution.

For instance, if I have a website and there are specific patterns of user access, I need to whitelist certain aspects. The learning curve is short in reality because multiple learning resources are available along with the solution. There are primarily only two manual tasks with the solution, which are monitoring and exception implementation.  

The solution offers impressive security and performance features compared to other solutions. The core OWASP rules of the solution identify the cyberattack techniques or attacks used by hackers and block them. The solution also has machine learning capabilities that assist in attack prediction. Cloudflare Web Application Firewall is the market leader; it has unique features that are absent in other competitor solutions.

I would definitely recommend Cloudflare Web Application Firewall to other users. I would advise others, as part of the initial deployment phase, to map applications, hash libraries, and user access patterns prior to the deployment. If the aforementioned step is followed, then the solution can be up and running in a very short span after deployment; otherwise, it's a two or three-month learning curve.

If you have the web application, repositories and pattern working processes, then the rule sets can be configured effortlessly. I would rate the tool a nine out of ten overall. 

I mainly use it for routing and then for monitoring the firewall.

We saw some improvements in our website security or our network security.

Rulesets are kind of majorly used for subdomain routing and rate limiting. When we expose our API, so we need to evaluate their use cases.

It's pretty convenient and pretty easy to set up and run. And then kind of for static content, it also offers caching. 

So, it can support one desk and one cloud desk. And, additionally, apart from that, it's kind of up-to-date with all the security vulnerabilities, so that's possible.

We have noticed some latency when the call goes through the firewall. That could be improved.

I have been using it for a couple of months. 

It is a reliable product. 

It is a scalable solution. It can handle all our needs. 

It is a popular tool. 

The setup was easy. It took a couple of days. It takes a couple of days to fully set it up within the organization and with all configurations.

It's for one server setup.

We also configured some customized rules for routing. 

It is not too pricey. I would rate the pricing a five out of ten, with ten being expensive.

Overall, I would rate it an eight out of ten. I would recommend using it. It's a pretty good tool. 

We use the solution for the web application firewall.

The solution protects our application, which runs on the HTTP protocol, from DDoS attacks.

Cloudflare Web Application Firewall should include port forwarding features. It would be good if the solution provided communication channels like a WhatsApp group other than email to provide customer support.

I have been using Cloudflare Web Application Firewall for more than four years.

Cloudflare Web Application Firewall is a stable solution.

The technical support is easy because we use the enterprise plan. Whenever we have technical difficulties, we can use the tech support. However, if there is any impact on the production, we can call the nearest support. Users can email customer support if they have questions about the solution's features.

Neutral

I previously used F5 NGINX in my previous organization.

F5 NGINX supports on-premise servers. F5 NGINX cannot support my current company, a cloud-native organization with no on-premise servers. Only a few products, like Akamai and Cloudflare, can support cloud-native environments. We chose Cloudflare Web Application Firewall because it's much more affordable than other tools.

Cloudflare Web Application Firewall is more affordable than other solutions.

Compared to other products, Cloudflare Web Application Firewall is easier to configure. Cloudflare Web Application Firewall is accurate in finding potential threats. Almost all the threats we faced before using the solution were mitigated after implementing Cloudflare Web Application Firewall.

The solution protects us from DDOS attacks and botnet attacks. Bots can call our application in botnet attacks, causing high resource consumption.

Overall, I rate the solution a seven out of ten.

I'm highly satisfied. It's remarkably user-friendly, enabling me to quickly identify issues, and deploy solutions, and it offers the necessary features. This ease of use makes it efficient in resolving our problems. 

Improvements should be done according to our customer's requirements. 

I have been using Cloudflare Web Application Firewall for more than a year. 

Regarding satisfaction, I would say that typically, we don't require support for the usual setup. We can manage it without significant difficulty. However, a key challenge arises when dealing with numerous integrations with HVAC systems. Depending on the specifics, there might be some configuration mismatches, which necessitate specific support.

They offer an array of features within a single service, including comprehensive functionality for web apps. However, we sometimes struggle to find experts who can help us harness these capabilities effectively. In some instances, their support team may lack the cost-effectiveness needed to address certain challenges, leading customers to consider alternative solutions like Skylight.

As for the typical implementation time for Cloudflare WAF, it usually takes around a week. This initial setup is quite straightforward and rarely poses any issues. The complete setup, including configuration and initial testing, typically extends over a month. However, the precise duration may vary based on the account and specific requirements. Some straightforward setups can be completed within a week.

When it comes to Cloudflare, you can initiate a basic setup within a week, but a more comprehensive implementation with fine-tuned configurations may take longer, potentially up to a month. The exact timeline depends on the intricacies of your specific service and the level of detail required in the configuration for each service.

I believe the pricing is not the best, but it's reasonable and acceptable. We also use the McAfee system in parallel. In terms of pricing, it's okay - not great, but not bad either. It falls in the middle, which is acceptable.

In terms of support licensing, last time, we were searching for a solution, and we considered products from resellers rather than directly from the cloud provider. However, the pricing we encountered was exceptionally high. As a result, we are inclined to select support from the reseller.

Typically, a larger solution is preferable, not a small one. I believe it depends on the project's financial considerations. If the project can benefit from a larger solution and the revenue generated can cover the associated costs, then we opt for that. It's not solely based on the company's size; it's about the customer's business and its specific needs.

When considering the use of a web app, it's crucial to perform a comprehensive self-analysis. This analysis should focus on understanding aspects like bandwidth, connections, and content sessions. By assessing these factors, you can make informed decisions about the most suitable solution. Pricing is a significant component, as it directly impacts your service and, by extension, your business. The challenge with bandwidth is that it's not always within your control, especially when dealing with increased demands. Therefore, before choosing a web app, it's important to conduct a thorough self-analysis. Once you've identified your needs and requirements, you can seek a solution tailored to your specific circumstances. Trying to cover every possible scenario can be a daunting and costly task, so a well-informed and targeted approach is key.

I would rate the solution a nine out of ten.

We use this solution to protect our websites and services.

The solution prevented several attacks, such as Log4j two years ago when it emerged as a major vulnerability. 

Cloudflare Web Application Firewall released protective rules a few hours after we discovered the potential problem and provided protection.

The firewall has rate-limiting, managed, and custom firewall rules.

Some of the features we’re using to a limited extent because they require an extra subscription. We have just the basic one. For example, advanced rate-limiting features are available, but we only use basic rate-limiting. 

We mainly use custom and managed firewall rules, which work well for us. We also use DDoS protection, which is probably one of the main features of the Cloudflare solution. DDoS protection was the initial thing we signed up for Cloudflare to protect our exposed web services and sites.

We also use Cloudflare DNS, logs, and analytics.

Cloudflare is evolving so quickly that we can't even keep up. In the past two years, they have released two major upgrades to their Web Application Firewall. 

However, the notification part could be improved. It's very much connected to Web Application Firewall, rate-limiting, and DDoS protection. 

The notification could be better configurable. Sometimes it makes too much noise. It should have better threshold handling or some setup features, which could set some thresholds because it tries to do it automatically. So, sometimes it just notifies about things that are not worth noticing and vice versa.

I have been using Cloudflare Web Application Firewall for two years. We are using the latest version of this solution.

We extensively use the solution every day. The solution is very stable; we haven’t seen any glitches.

I rate the solution’s stability a nine out of ten.

The solution is very scalable.

You can have multiple zones (domains), and manage them in Web GUI or using APIs.

They have pretty good documentation regarding APIs and in case you have a lot of zones you can automate their management via API calls/scripts, etc.

I rate the solution’s scalability a nine or ten out of ten.

The solution works 24/7 in front of our web service. I don't have to touch it every day, as it functions automatically. Once you set it up, it's done.

I login into the service daily to verify the alerts it has sent to us. Sometimes notifications are noisy, but I still look into each one to see if it's worth taking action.  The firewall itself functions around the clock.

The support is really good and helpful.

Positive

We switched to Cloudflare because DDoS and other scanning attacks were increasing in 2020. We had several DDoS attacks on our sites and needed a solution. 

We also looked at some local telecom solutions in the Baltics, but they were not well-functioning for us. Then, one of our engineers suggested that we use Cloudflare, and it was a great decision. Layer 3/4 DDoS attacks were no longer a problem after we deployed Cloudflare. In fact, DDoS attacks are on the rise worldwide, forcing us to start looking for more serious protective measures.

The initial setup is rather easy. I rate my experience with the initial setup an eight on a scale of ten, where ten is easy and one is difficult.

We have dozen of sites, and the firewall itself was deployed seamlessly. Setting up some additional configurations took some time.

While the file firewall deployed so to say "itself", we had to deal with transferring our sites and services behind it.

There were two main tasks - migrate DNS records and set up new TLS certificates as Cloudflare acts of us as a reverse proxy. There are specific TLS certificates between our sites and Cloudflare as and we cannot use for example LetsEncrypt anymore because our sites are no longer exposed directly to the internet.

So all-in-all it took around one-two months to get a dozen of domains behind Cloudflare WAF. And that's mainly not because of Cloudflare but our own organizational complexity.

We did the implementation ourselves but with the help of Cloudflare's support team. Their support is very good.

Since we are an Eastern European company, the solution is relatively expensive for us. We have to get used to it. Some features like Bot Management software we would like to use are still out of our budget. I would rate it three out of ten, where one is expensive, and ten is cheap.

There are no other expenses around the standard licensing cost. The support is included. When I get some questions, they're not charged separately.

We compared offers from two other providers as well. One was a local telecom provider and the other was Akamai.

I would definitely recommend using the solution.

Overall, I rate the solution a nine out of ten.