


Find out in this report how the two Web Application Firewall (WAF) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
My experience with the pricing or licensing of Cloudflare Web Application Firewall is that many features can be accessed for free, so the pricing is definitely reasonable.
Time savings in daily operations come from the automatic learning and signature update reducing the need for constant manual rule management, allowing the security and network teams to spend significantly less time handling false positive application-related escalations.
Subscription models offer clearer ROI due to a more competitive pricing scheme.
The amount of attacks it protects against is immense, more than F5 Advanced WAF itself costs.
I would rate the technical support with Cloudflare as excellent every time I've had to contact them.
The technical support of Cloudflare Web Application Firewall rates between five and seven at maximum.
Both response time and availability need to be improved.
If there is a bug, the support is usually understanding and resolves issues.
I have interacted with F5's support, and while I have no major complaints, they could improve.
The company provides technical support, and they are mostly available 24/7.
The proximity of Fortinet with customers ensures quick issue resolution.
Sometimes it could be faster, but generally, their support is reliable.
The scalability of Cloudflare Web Application Firewall rates between 8 to 9, as it depends upon the use cases and what exactly the client needs.
I can run it in HA mode or even divide the traffic volume to the number of instances that I have based on their resource sizing.
It auto checks everything, and you need to install the certificate.
In my experience, Fortinet FortiWeb Cloud WAF-as-a-Service's scalability is quite good, and I would rate it at eight point five out of ten.
We are purchasing Fortinet FortiWeb Cloud WAF-as-a-Service from the distributor side, who have provided support and a price discount.
The stability of Cloudflare Web Application Firewall deserves a perfect 10 out of 10.
F5 Advanced WAF has been very reliable and consistent for us; in our on-premise enterprise setup, it has been stable and predictable in day-to-day operations without any unexpected crashes or WAF-related downtime in production.
F5 Advanced WAF is pretty stable.
The stability of the solution is excellent.
The product can improve by having more multitenancy capability, which is currently not available.
I think they're doing a good job with DNS and as support for any domains that I create or that my clients create, it's mandatory for me to ensure they have Cloudflare as their DNS provider.
And maybe something similar to Pushpin that Fastly has, which is an option where you can push messages that then can be scaled globally over the network.
Deployment training for F5 Advanced WAF is lacking and restricts growth by being inaccessible and costly for partners.
Overall, these are not blockers, merely enhancement opportunities, and once tuned, F5 Advanced WAF is very stable and reliable; improving usability, reporting, and onboarding would make it even more effective for larger environments.
There is excellent clarity in the LTM and the WAF.
Fortinet FortiWeb Cloud WAF-as-a-Service could be improved with better logging capabilities, as many come with less spacing, necessitating a FortiSIM for enhanced functionality.
The utilization of AI in Fortinet FortiWeb Cloud WAF-as-a-Service still needs to be upgraded and improved.
I want them to provide SAML authentication.
Licensing is capacity-driven, so you need careful planning based on traffic volume and use cases, and adding features such as Bot Protection impacts costs; once licensing is clear and sized correctly, there are no surprises.
Subscription models have competitive pricing, while perpetual licenses involve an upfront higher cost.
The price is affordable and satisfactory.
It is twice cheaper.
I just recommend Fortinet FortiWeb Cloud WAF-as-a-Service because it is very expensive.
The price is not the cheapest, but it offers great value for money.
The custom rules and the geo-redundant geographical rule feature, which allows me to implement geographical rules for customers, add significant value.
The best features of Cloudflare Web Application Firewall are multiple, including the WAF, rate limiter, and bot attack protection.
Cloudflare Web Application Firewall's advanced reporting and analytics tools add a layer that we're able to visualize and see before it actually hits the local firewall.
The Advanced Attack Signature database is very strong and regularly updated, effectively blocking SQL injections, cross-site scripting, command injections, and file inclusion attacks while allowing selective enabling or disabling of signatures to avoid blocking genuine traffic.
The perpetual license, despite an initial higher cost, lacks transparency regarding support expiration.
It contains the logic of both negative and positive security combined.
It is possible to easily find vulnerabilities with the WAF.
It effectively mitigates web attacks, provides virtual protections, and handles large traffic with minimal processing effort.
Its usability is a key aspect as it is very easy to use and deploy in front of new APIs.
| Product | Mindshare (%) |
|---|---|
| F5 Advanced WAF | 7.1% |
| Cloudflare Web Application Firewall | 5.4% |
| Fortinet FortiWeb Cloud WAF-as-a-Service | 0.9% |
| Other | 86.6% |


| Company Size | Count |
|---|---|
| Small Business | 16 |
| Midsize Enterprise | 6 |
| Large Enterprise | 6 |
| Company Size | Count |
|---|---|
| Small Business | 26 |
| Midsize Enterprise | 15 |
| Large Enterprise | 31 |
| Company Size | Count |
|---|---|
| Small Business | 5 |
| Midsize Enterprise | 2 |
| Large Enterprise | 5 |
Cloudflare Web Application Firewall's intuitive dashboard enables users to build powerful rules through easy clicks and also provides Terraform integration. Every request to the WAF is inspected against the rule engine and the threat intelligence curated from protecting over 27 Million websites. Suspicious requests can be blocked, challenged or logged as per the needs of the user while legitimate requests are routed to the destination, agnostic of whether it lives on-premise or in the cloud. Analytics and Cloudflare Logs enable visibility into actionable metrics for the user.
F5 Advanced WAF is a web application security solution for financial and government sectors, e-commerce, and public-facing websites. It offers protection against various attacks, including botnets, web scraping, and foreign entities. The solution can be deployed on-premises or in the cloud and is often used with other security tools. Its most valuable features include DDoS and DNS attack protection, SSL uploading, anomaly detection, and the ability to input custom rules.
F5 Advanced WAF has helped organizations to expose more services to the public while providing an extra layer of protection, preventing revenue loss, and securing connectivity.
Fortinet FortiWeb Cloud WAF-as-a-Service provides cloud-based web application protection, ensuring businesses secure their web apps against threats without hardware management, offering dynamic scalability and threat intelligence.
Fortinet FortiWeb Cloud WAF-as-a-Service offers an advanced security platform that effectively protects web applications from cyber threats by leveraging comprehensive threat intelligence and efficient traffic management. Its cloud-native architecture facilitates seamless integration, allowing for scalable security solutions that adapt to varying demand levels. Known for reducing complexity, it empowers organizations to focus on strategic initiatives without the need for dedicated on-premise resources. The service also provides robust analytics, enabling informed decision-making based on real-time threat landscapes.
What are the key features?In industries such as finance and e-commerce where sensitive data protection is paramount, Fortinet FortiWeb Cloud WAF-as-a-Service is extensively implemented to secure web applications against potential vulnerabilities. It ensures compliance with stringent regulatory standards and protects consumer information, thus maintaining trust and brand reputation. Healthcare providers leverage it to protect patient records, a sector that demands the utmost security and confidentiality.
We monitor all Web Application Firewall (WAF) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.