All Products
Search

This Product

    Web Application Firewall:Change billing method

    Document Center

    Web Application Firewall:Change billing method

    Last Updated:Feb 11, 2026

    Web Application Firewall (WAF) offers both subscription and pay-as-you-go billing. This topic explains how to change between them and helps you choose the right approach for your scenario.

    Quick decision guide

    Billing method

    Best for

    Subscription

    • Long-term usage: Planning to use WAF for 6+ months to optimize costs.

    • Budget stability: Preferring predictable monthly expenses for financial planning.

    • Commitment discounts: Seeking to lock in lower rates through long-term commitment.

    Pay-as-you-go

    • Maximum flexibility: Transitioning from an expiring subscription with no fixed term.

    • Strategic shifts: Adjusting infrastructure or cloud strategies frequently.

    • Variable traffic: Scaling protection based on unpredictable or seasonal traffic spikes.

    Understand the impact

    The two directions have very different impacts on your business:

    Aspect

    Pay-as-you-go → Subscription

    Subscription → Pay-as-you-go

    Process

    • Seamless (requires approval)

    • Manual

    Manual only

    Service interruption

    None (with seamless change)

    Required (plan for low-traffic periods)

    Configuration

    Preserved (with seamless change)

    All configurations lost

    Refund

    Not applicable

    Full refund: contact account manager; Partial refund: self-service

    Prepare for a change

    Important

    The following steps are only required for manual billing changes (which involve instance termination). If you are performing a seamless change (pay-as-you-go to subscription), skip this section.

    To prevent service interruption, you must complete the following:

    1. Update origin server security policies.

      Modify your server's security group rules to allow direct traffic from the Internet to your web service ports (such as 443). Crucially, you must disable or delete any rules that only allow access to WAF's origin-facing IP ranges. For an example using ECS, see Add, modify, or delete security group rules.

    2. Route traffic back to your origin server.

      1. CNAME Record: In your DNS provider's console, change your domain's DNS record from the WAF CNAME address back to your origin server's IP address. For an example using Alibaba Cloud DNS, see Modify a DNS record.

      2. Cloud Native Mode: In the WAF console, go to Onboarding > Cloud Native. Find your instance (such as ECS) and click Batch Cancel. This will stop the cloud product from redirection traffic to WAF. No DNS changes are required.

    Change from pay-as-you-go to subscription

    To use the seamless change, first contact your account manager for approval.

    Seamless change (recommended)

    1. Locate the instance: Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland). In the left navigation pane, click Overview.

    2. Initiate the billing change: In the Edition Information section, click More > Change to Subscription.

    3. Complete the purchase: Select a subscription edition that matches your current features and complete the payment. See Editions for details.

      Important

      If you enabled Simple Log Service (SLS), the Logstore changes after the billing change. Re-enable logging and reselect log fields afterward. The original Logstore is retained, and SLS bills its fees separately.

    Manual change (if seamless is unavailable)

    1. Back up your configuration: Document all WAF rules, protected domains, and other configurations. We recommend using WAF API to get your configurations.

    2. Terminate the instance: Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance. In the left navigation pane, click Overview. On the Overview page, find the Edition Information section. Click Terminate WAF Service.

    3. Purchase a new instance: Go to the WAF 3.0 (Subscription) purchase page, select a subscription edition that supports the features you have enabled in your pay-as-you-go instance, then complete the payment. See Editions for details.

    Important

    If you have a SeCU resource plan, request unsubscription by contacting your account manager within 5 days of purchase, provided it has not been used.

    Change from subscription to pay-as-you-go

    This direction does not support seamless change. You must terminate your subscription instance and purchase a new pay-as-you-go instance, which causes service interruption.

    1. Back up your configuration: Document all WAF rules, protected domains, and other configurations. We recommend using WAF API to get your configurations. Plan the change during a low-traffic maintenance window.

    2. Request unsubscription:

      • Unsubscription within 5 days (unused instance): Contact your account manager for a full refund.

      • Partial unsubscription: Submit a request on the Unsubscribe page for a partial refund. See Refund rules for details.

        After unsubscription is confirmed, your instance is terminated.

    3. Purchase a new instance: Go to the WAF 3.0 (Pay-as-you-go) purchase page and purchase a new instance.

    Note

    Consider adding a Security Capacity Unit (SeCU) resource plan to your pay-as-you-go instance. It offsets request processing fees and reduces overall costs. For more information, see SeCU resource plans.

    Next steps

    After changing your billing method, reconfigure your WAF and then route your traffic to it. The steps vary based on your onboarding mode.

    • CNAME Record:

      • Reconfigure WAF: In the WAF console, add your domains and configure the necessary protection rules for the new instance. See Add a domain name for details.

      • Update DNS: Log on to your DNS provider's console and change your domain's CNAME record to point to the new WAF instance's CNAME address.

    • Cloud Native Mode (ECS example):

      • Reconfigure WAF: Similar to the CNAME Record, add your assets and configure protection rules in the new WAF instance. See Cloud native mode for details.

      • Re-enable protection for ECS instances: In the WAF console, find your ECS instance and re-add its service ports (such as 443) to direct their traffic to the new WAF instance for protection. See Enable WAF protection for ECS instances for details.

    FAQ

    • Can I change billing methods without downtime?

      Yes, but only when changing from pay-as-you-go to subscription via the seamless change process. Changing from subscription to pay-as-you-go requires instance termination, which will cause downtime.

    • How long does the seamless change process take?

      It takes several minutes.

    • Why is the seamless change option not available in my console?

      Seamless change requires approval. Contact your account manager to apply for this feature.

    • What happens to my rules during the change?

      With seamless change, all configurations are preserved. With manual change, all configurations are deleted upon instance termination. Always back up your configurations before a manual change.

    • Why is my website down after changing billing methods?

      Traffic may still be routing to the terminated instance. Update your DNS/CNAME records to point to your origin server or the new WAF instance.

    References