Content:

1. If users of pay-as-you-go WAF 2.0 and WAF 3.0 instances do not add domain name or cloud service assets to the instances, the instances are released.
2. Pay-as-you-go WAF instances no longer support the app protection feature of the bot management module.
3. The basic web protection module is renamed the core web protection module.
4. The maximum threshold value for traffic billing protection is changed to 30,000 queries per second (QPS) for WAF instances in the Chinese mainland and 3,000 QPS for WAF instances outside the Chinese mainland. If you want to specify a higher threshold value, contact your account manager or solution architect.
5. The following list describes the new billable items and pricing changes for hourly billing.

Impact:

• New billable items:
  • WAF instance: After you purchase a pay-as-you-go WAF instance, you are charged for this billable item. Unit price: 0.5 security capacity units (SeCUs) per hour.
  • Peak traffic throttling: You can specify a traffic proportion or QPS threshold for specific URLs or regions to create a rule to trigger throttling. You can configure the settings for traffic surge scenarios, such as promotions, to ensure the availability and stability of origin servers. Unit price: 150 SeCUs per rule-hour.
• Pricing changes:
  • Protection template of the core web protection module: The price changes from 1 SeCU per hour to 3 SeCUs per template-hour.

Note: You are charged for default protection templates after you add protected objects to WAF. You are charged for the protection templates regardless whether they are enabled.

• Scan protection: The price changes from 1 SeCU per rule-hour to 10 SeCUs per rule-hour.
• Peak QPS: Previously, you are not charged if the peak QPS is less than or equal to 5,000. After the change, the threshold is reduced to 1,000. After the peak QPS exceeds the threshold, you are charged 1 SeCU per 5 QPS-hour. The total number of QPS is rounded up to the nearest multiple of 5.
• Custom rule: The price changes from 1 SeCU per rule-hour to 2 SeCUs per rule-hour for basic rules and from 2 SeCUs per rule-hour to 5 SeCUs per rule-hour for advanced rules. The match fields that are used to identify an advanced rule are changed from Body and Body Parameter to URI, IP, Referer, UA, QueryString, URI Path, QueryString Parameter, and Host.
• Domain names added in CNAME record mode: If you add one domain name, you are not charged. If you add more than one domain name, you are charged 2 SeCUs per domain name-hour previously. After the change, you are not charged for the first domain name. You are charged 5 SeCUs per domain name-hour for the 2nd to 10th domain names, 3 SeCUs per domain name-hour for the 11th to 100th domain names, and 1 SeCU per domain name-hour for the rest of the domain names.
• Region blacklist: The price changes from 3 SeCUs per rule-hour to 10 SeCUs per rule-hour.
• Bot management: The price changes from 1 SeCU per 10,000 requests to 1 SeCU per 7,500 requests.

Note: If the number of requests within an hour is not a multiple of 7,500, it is rounded up to the nearest multiple of 7,500.

• API security: The price changes from 1 SeCU per 10,000 requests to 1 SeCU per 7,500 requests.

Note: If the number of requests within an hour is not a multiple of 7,500, it is rounded up to the nearest multiple of 7,500.

The preceding changes do not affect bills that are already generated. Subsequent bills are generated based on the new billable items and prices.

Thank you for your understanding and support.