The subscription billing method is a prepaid option for Web Application Firewall (WAF) ideal for workloads with stable, predictable demands or long-term protection needs. Compared to the pay-as-you-go model, a subscription offers lower unit prices and reduces your web application security costs. This topic describes the billing rules for subscription WAF instances.
How billing works
The fees for a subscription WAF instance consist of a base service fee and value-added service fees:
Base service fee (required): A prepaid fee charged for the default protection capabilities included in your selected WAF edition, such as Pro Edition or Enterprise Edition.
Value-added service fee (optional): An additional fee for enabling extra features or expanding resource specifications when the default capabilities do not meet your business needs. These fees are billed as follows:
The Burst QPS (Pay-As-You-Go), Bot Management: Risk Identification, and extension plugin traffic services are billed monthly based on actual usage (postpaid).
All other value-added services are prepaid.
Billable items
Feature differences between editions: The following sections describe the pricing for each billable item of a subscription WAF instance. For a comparison of features available in different WAF editions, see Editions and features.
Price changes: Prices are for reference only and are subject to change. The amount on your Alibaba Cloud bill is final.
Base service fees
Subscription edition | Unit price |
Basic Edition | USD 140/month |
Pro Edition | USD 556/month |
Enterprise Edition | USD 1,400/month |
Ultimate Edition | USD 4,260/month |
Value-added service fees (prepaid)
If you use the Pro, Enterprise, or Ultimate Edition, you are eligible for a one-time, 7-day free trial of Bot Management – Web Protection, Bot Management – App Protection, and API security. The trial begins when you enable the feature. After the trial expires, its configurations are automatically deleted unless you purchase a paid plan.
Billable item | Unit price |
API Security (legacy) |
|
Agentic API Security (new) |
Note Agentic API Security will be officially launched on July 31, 2026. After this date, the legacy API security feature will enter a maintenance period. Users of the legacy version can continue to use it without any impact on existing features. We recommend upgrading to Agentic API Security soon for more comprehensive protection. For more information, see [Notice] WAF API security module upgrade. |
Bot Management - Web Application Protection (legacy) | USD 1,150/month. |
Bot Management - App Protection (legacy) | USD 1,750/month. |
Agentic Bot – Web Protection (new) | USD 1,400/month. Note Agentic Bot will be officially launched on September 23, 2026. After this date, the legacy bot management feature will enter a maintenance period. Users of the legacy version can continue to use it without any impact on existing features. We recommend upgrading to Agentic Bot soon for more comprehensive protection. For more information, see [Notice] WAF bot management module upgrade. |
Agentic Bot – App Protection (new) | USD 2,140/month. |
Peak Traffic Throttling | USD 1,200/month. |
Additional QPS | WAF instances in the Chinese mainland:
WAF instances outside the Chinese mainland:
Note
|
CNAME Record: Additional Domains | Tiered pricing is based on the cumulative number of purchased domains:
|
CNAME Record: Exclusive IP | USD 30/IP/month |
CNAME Record: Intelligent Load Balancing | USD 150/instance/month |
Log Service | USD 75/TB/month Important After you enable Log Service, the minimum log storage capacity you can purchase is 3 TB. |
Multi-cloud/hybrid-cloud WAF extension node (not supported by Pro Edition) | Tiered pricing is based on the cumulative number of extension nodes:
Note If your services are deployed in multi-cloud, on-premises, intranet, or hybrid cloud environments and cannot be added to a public cloud WAF instance by using a CNAME record, you can purchase multi-cloud/hybrid-cloud WAF extension nodes to protect your services with a local WAF. Protection capacity varies by deployment mode:
|
Multi-cloud/hybrid-cloud bot nodes | Tiered pricing is based on the cumulative number of extension nodes:
Note To enable bot protection in a multi-cloud or hybrid cloud cluster, purchase the required number of nodes. |
Multi-cloud/hybrid-cloud API security nodes | Tiered pricing is based on the cumulative number of extension nodes:
Note To enable API security protection in a multi-cloud or hybrid cloud cluster, purchase the required number of nodes. |
Extension plugins (not supported by Pro Edition) | Includes a quota of three plugins for USD 1,200/month . |
Critical Event Protection | Major Event Support must be enabled separately after you purchase a WAF instance. The support period starts immediately after you enable it, regardless of the instance purchase time. For more information, see Major Event Support. |
Value-added service fees (pay-as-you-go)
Pay-as-you-go features can result in overdue payments, which may affect the normal operation of your WAF instance. Monitor your usage and costs to ensure timely payments. For more information about how to manage overdue payments, see Overdue payments.
Billable item | Unit price |
Bot Management/Agentic Bot: Risk Identification | Billed per hit. The unit price is USD 0.007/hit. Note No charges are incurred for risk identification if you do not configure any rules, or if configured rules do not match any traffic. |
Extension plugin traffic | After you enable the extension plugins feature, you are charged a traffic fee based on the number of requests. The unit price is USD 0.01 per 7,500 requests. |
Burst QPS (Pay-As-You-Go) | For detailed billing information, see Burst QPS (pay-as-you-go). |
When you enable WAF protection for an Application Load Balancer (ALB) instance, charges are incurred for both WAF and ALB. For more information, see Enable WAF protection for an ALB instance.
Billing cycle
The billing cycle for prepaid subscription items corresponds to the purchase duration of your order (in UTC+8). A billing cycle starts at the exact time a resource is activated or renewed and ends at 00:00:00 on the day following the expiration date.
Pay-as-you-go fees for value-added services are settled daily (in UTC+8). A new settlement cycle begins after the previous one is complete.
Subscription billing cycles based on years or months refer to calendar years and calendar months.
The billing cycle for Major Event Support starts when the service is enabled and ends at the restoration time you select during activation.
Pay-as-you-go fees are typically settled in the early morning. If you need to make configuration changes, such as adding a domain or enabling a new protection feature, make these changes after 06:00 (UTC+8) to prevent them from being included in the previous day's bill.
If your account's available credit, which includes your account balance and coupons, is less than the amount of the unsettled bill, you will receive a low-balance notification by SMS or email.
Instance expiration
The following rules apply when your subscription WAF instance expires:
Expiration reminders: The system sends renewal reminders by SMS or email 15, 7, 3, and 1 day before your instance expires.
Impact of expiration: If you do not renew the instance before it expires, your WAF configurations are retained for a 15-day grace period.
If you renew the instance within the 15-day grace period, your original configurations are automatically restored.
If you fail to renew within 15 days, the instance and its configurations are permanently deleted on the 16th day, and protection is terminated. To continue using WAF, you must purchase and configure a new instance.
ImportantFor domains connected by using a CNAME record, Alibaba Cloud deletes the CNAME record when the instance is released. If you have not changed your domain's DNS resolution back to the origin server by this time, your domain will become inaccessible.
To avoid service disruptions, renew your instance before it expires.
View bills
To view detailed costs for your subscription instance and value-added services, or to check the usage of pay-as-you-go features on the WAF 3.0 bill management page, see View bills.
FAQ
Included QPS, additional QPS, and burst QPS
The total QPS capacity of a WAF instance is the sum of the QPS included in the edition, Additional QPS, and Burst QPS (Pay-As-You-Go).
Billable item | Description |
QPS included in edition | A subscription WAF instance includes a default amount of QPS capacity. For specific limits, see QPS limits by edition. |
Additional QPS | This prepaid add-on is for when your required QPS consistently exceeds your edition's included limit, but an edition upgrade is not necessary. |
Burst QPS (Pay-As-You-Go) | This feature is enabled by default and cannot be disabled. If your actual traffic exceeds the sum of your purchased QPS included in the edition and Additional QPS, the excess traffic is automatically billed on a pay-as-you-go basis as burst QPS. This is ideal for scenarios with large or sudden traffic fluctuations. |
Maximum QPS capacity
1. QPS billing and processing
Purchased QPS: The sum of QPS included in the edition and Additional QPS.
Burst QPS (Pay-As-You-Go): If your actual traffic exceeds your purchased QPS, the overage is automatically billed as Burst QPS (Pay-As-You-Go).
2. Maximum guaranteed QPS
The sum of the QPS included in the edition, Additional QPS, and Burst QPS (Pay-As-You-Go) is limited by a maximum guaranteed QPS level, which varies by region:
WAF instances in the Chinese mainland: The maximum guaranteed QPS is 100,000.
WAF instances outside the Chinese mainland: The maximum guaranteed QPS is 50,000.
If your actual QPS exceeds this maximum guaranteed level, the service level agreement (SLA) is no longer guaranteed. Protected assets may experience access issues, such as packet loss, rate limiting, connection limits, protection failures, log or report anomalies, and access timeouts. If you anticipate that your peak traffic might exceed this limit, contact your account manager to arrange a capacity expansion.