Why people look for an AWS WAF alternative
Rarely because it does not work. Usually because of how it is priced and how much assembly it needs.
AWS WAF charges for the web ACL, for each rule you attach, and for the requests it inspects. Add a managed rule group and that is another line. The result is a security bill that scales with traffic — the same traffic you are already paying CloudFront to deliver — and a spreadsheet exercise every time someone suggests adding a rule.
Then there is the assembly. A working setup means a web ACL, rule groups in the right order, the association with the distribution, logging to Kinesis or S3, and somewhere to read those logs. Each piece is reasonable; together they are a project.
What you get here instead
The WAF runs on the same edge that already serves your site: ModSecurity with the OWASP Core Rule Set, enabled per account from the delivery rules page. There is no separate product to buy, no per-rule line on the invoice, and no pipeline to build before you can read a log.
Alongside it, on the same page: country and ASN blocking, IP allow and deny lists, rate limiting per route, a JavaScript challenge for bot floods, and the HSTS preset. They are enforced at the edge, so a blocked request never reaches your origin.
The trade is honest: you are not getting AWS's catalogue of vendor-specific managed rule groups, and you are not getting a WAF you can script with Terraform against fifty other AWS resources. You are getting the OWASP rule set, switched on, with the operational parts already wired.
The part that decides whether a WAF is usable: the log
Every WAF blocks legitimate requests sometimes. A CMS editor saving a post that contains a code sample will trip an injection rule sooner or later. What separates a usable WAF from an exhausting one is how fast you can find out which rule fired and on which field.
A blocked visitor here gets a branded 403 page carrying a reference ID. That ID is the request identifier in the audit log, so the support conversation goes from "the site blocks me sometimes" to a rule ID and the exact value that matched. The WAF log page in the panel lists blocked events with the attack category, country, IP and rule, and exports to CSV or XLSX when you need to hand it to someone else.
The fix is then narrow by design: exempt that rule for that field on that path, rather than switching protection off for the site.
What AWS WAF has that we do not
Worth saying plainly, because a comparison page that only lists advantages is an advertisement.
AWS WAF has a marketplace of managed rule groups from security vendors, Bot Control and account-takeover protections as paid add-ons, and deep integration with the rest of AWS — CloudWatch metrics, Firewall Manager across accounts, Terraform providers that cover every knob. If your organisation runs on AWS and manages policy centrally across many accounts, that ecosystem is a real advantage and no small provider replaces it.
We run the OWASP Core Rule Set rather than a vendor marketplace, and our rule set version is one we upgrade deliberately rather than continuously. If your requirement is a specific managed rule group from a specific vendor, we are not the answer.
What it costs to protect a site here
The WAF is part of the plan. Turning it on for a site does not add a line to your invoice, and adding a rule does not either — which means the decision to protect a path is a technical one rather than a budget one.
We are not publishing a table against AWS WAF's current rates. Those rates change, a stale table on a vendor page is worse than none, and your own bill is the only honest comparison. Look at what the WAF costs you this month on AWS, then look at the plan page here.
AWS WAF alternative FAQ
Which rule set do you run?
ModSecurity with the OWASP Core Rule Set, which is the same family of rules behind a lot of commercial WAFs. It covers the injection, cross-site scripting, file inclusion and protocol-abuse categories. We upgrade the rule set deliberately, testing against the false-positive patterns our own customers hit, rather than tracking upstream automatically.
Can I exclude a rule that blocks my own application?
Yes, and that is the intended workflow. Find the rule ID from the blocked event, then exempt that rule for the field and path that produced the false positive. Blanket-disabling a rule family or the whole WAF is possible and is almost always the wrong response.
Does the WAF add latency?
Inspection happens at the edge on a request that was already passing through it, so there is no extra network hop. The cost is CPU on the edge rather than a round trip, which is the part that would be noticeable.
Is DDoS protection the same thing?
No. A WAF inspects the content of requests and blocks malicious ones. DDoS protection is about volume. We absorb application-layer floods at the edge with rate limiting and a JavaScript challenge; network-layer protection sits with the upstream networks that announce our prefixes. If you need a contracted scrubbing capacity figure, ask us for it in writing rather than assuming it.
Can I use the WAF without moving my hosting?
Yes. The WAF runs on the CDN edge, so any origin works — a server you keep, another cloud, or a platform you already run. You point the hostname here, the traffic is inspected on the way through, and your origin stays where it is.