WAF 3.0 supports two billing methods: subscription and pay-as-you-go. Subscription charges a fixed upfront fee based on the edition and duration you select; pay-as-you-go charges hourly fees in SeCU units based on actual request volume and feature usage. Choose subscription for stable, long-term workloads, or pay-as-you-go for variable or short-term needs.
Billing methods
| Property | Subscription | Pay-as-you-go |
|---|---|---|
| Activation | WAF 3.0 (Subscription) purchase page | Web Application Firewall 3.0 (Subscription) purchase pageWAF 3.0 (Pay-as-you-go) purchase page |
| Billing model | Pay upfront. Billed based on the subscription duration you select. | Pay after use. Bills are generated daily based on actual usage, and fees are deducted from your account. SeCU resource plans (subscription) are available to offset costs. |
| Best for | Stable, predictable traffic with long-term WAF requirements, or complex management scenarios such as hybrid cloud access. | Frequently changing usage, temporary deployments, or traffic-burst scenarios. |
| Billable items | Basic feature fee (required): Determined by the edition, specifications, and subscription duration you select. Value-added feature fee (optional): Billed separately. Fraud Detection and elastic pay-as-you-go QPS are billed monthly based on actual usage (pay-as-you-go). Other value-added services are subscription-based. | Request processing fee: Fee for requests processed within each full hour. Feature fee: Fee for features used within each full hour. Both fees can be offset by SeCU resource plans. |
| Billing cycle | The subscription duration you select at purchase (Subscription Duration). | Settled daily (UTC+8). A new billing cycle begins after each settlement and continues until you deactivate WAF. |
| Billing unit | USD | SeCU (1 SeCU = USD 0.01) |
| Critical event protection | Subscription add-on available for both billing methods. Minimum purchase: 30 days. See Critical event protection. | Same as subscription. |
| Details | Subscription billing | Pay-as-you-go billing and SeCU resource plans |
Product and service prices are subject to change. Your Alibaba Cloud bill is the final reference. If you enable WAF protection for an Application Load Balancer (ALB) instance, you are also charged for the ALB WAF-enabled instance on the ALB side. For details, see Enable WAF protection for an ALB instance.
Billing flow
Pay-as-you-go
Activate WAF
Go to the WAF 3.0 (Pay-as-you-go) purchase page to activate WAF. During activation, set a traffic billing protection threshold to prevent unexpected charges from traffic spikes. You can also update the threshold at any time after activation.
To reduce costs, purchase a SeCU resource plan to offset request processing fees and feature fees.
Add assets to WAF
Critical event protection is subscription-based. See Critical event protection for details.
Instance fees consist of the request processing fee and the feature fee. See Billing details for the full breakdown.
Sandbox state
If your instance enters the sandbox state, it exits automatically when peak QPS in the next hour drops below the Traffic Billing Protection Threshold. To prevent the instance from entering the sandbox again, update the traffic billing protection threshold.
Fee deduction and billing
Fees are offset by SeCU resource plans first, then deducted from your account balance.
SeCU resource plans can only be used when your account has no overdue payments. After a plan is used up or expires, fees are automatically deducted from your account balance.
View your daily bills and usage details on the WAF bill management page.
Overdue payments
If your account has an overdue payment, top up your account in the User Center to continue using pay-as-you-go services. For details on resource status during overdue periods, see Overdue payments.
Deactivate WAF
If you no longer need a pay-as-you-go WAF instance and it has received few or no requests in the last two days, release the instance. Back up or migrate your data before releasing. Billing stops on the day after you deactivate the instance (T+1).
For deactivation steps, see Unsubscribe from a pay-as-you-go instance.
If you purchased a SeCU resource plan and want a refund, submit a ticketticketticket. Refunds are available only if you purchased the plan within the last five days and have not used it.
Subscription
Activate WAF
Go to the WAF 3.0 (Subscription) purchase page and select a WAF edition.
Fraud Detection and elastic pay-as-you-go QPS are pay-as-you-go items available on the Pro, Enterprise, and Ultimate editions. When activating a subscription instance, you can configure a QPS extension and enable elastic pay-as-you-go QPS upfront to prevent the instance from entering the sandbox state if peak QPS exceeds your plan's QPS specification.
Add assets to WAF
Critical event protection is subscription-based. See Critical event protection for details.
Instance fees consist of the basic service fee (required) and the value-added service fee (optional). See Subscription instance fees for the full breakdown.
Sandbox state
If your instance enters the sandbox state, exit by upgrading your edition, purchasing a QPS extension, or enabling elastic pay-as-you-go QPS. See Remove an instance from the sandbox state for steps.
Upgrade and downgrade
Adjust your WAF instance edition or value-added services at any time based on your business needs:
View bills
View your daily bills and usage details on the WAF bill management page.
Overdue payments and renewal
Overdue payments: If your account has an overdue payment, your existing subscription WAF instance continues to run — you have already paid for the resource. However, you cannot use pay-as-you-go services (such as Fraud Detection and elastic pay-as-you-go QPS), upgrade instance configurations, or renew orders. For details on resource status, see Overdue payments.
Renewal: Choose manual or auto-renewal before your instance expires to avoid service interruption. For renewal steps, see Renewal policy.
Unsubscribe from WAF
If your instance has expired and you no longer use WAF, unsubscribe from it. For unsubscription rules and steps, see Unsubscribe from a subscription instance.
Switch between billing methods
Switching between billing methods requires deactivating your current instance first, then purchasing a new one. Immediate switching is not supported in either direction.
Subscription to pay-as-you-go: Wait for the subscription to expire, unsubscribe, then activate a new pay-as-you-go instance.
Pay-as-you-go to subscription: Deactivate the pay-as-you-go instance, then purchase a new subscription instance.
For the full procedure, see Switch between billing methods.
Renewal policy
If a subscription WAF instance is not renewed before it expires, the protection for your website is affected. Renew manually or enable auto-renewal before the expiration date. For details, see Subscription renewal policy.
Pay-as-you-go instances are billed based on actual usage and do not require renewal.
SeCU resource plans do not support renewal or upgrades directly. Purchase additional SeCU resource plans or a larger plan as needed. See Purchase a SeCU resource plan.
Unsubscription policy
If you no longer use WAF, unsubscribe from a subscription instance, deactivate a pay-as-you-go instance, or unsubscribe from a SeCU resource plan, provided unsubscription requirements are met. For rules and procedures, see Unsubscription policy.
If you have activated multi-cloud or hybrid cloud protection, bot management for web or app protection, a critical event protection package, or API security, you cannot unsubscribe in the console. Submit a ticketticketticket or contact your account manager.
If you purchased a SeCU resource plan and want a refund, submit a ticketticketticket. Refunds are available only if you purchased the plan within the last five days and have not used it.
Overdue payments
Your account has an overdue payment when your available credit (account balance plus coupons) is less than the outstanding bill. Overdue payments affect your instances differently depending on the billing method:
Subscription: Your existing instance continues to run. However, you cannot use pay-as-you-go services (such as Fraud Detection and elastic pay-as-you-go QPS), upgrade configurations, or renew orders.
Pay-as-you-go: Your instance is suspended and billing is paused. If the overdue bill is not settled within the specified period, the instance is released and all data is permanently deleted.
Top up your account promptly to restore full access. For details on resource status and resolution steps, see Overdue payments.
View bills
After activating WAF, view actual usage and fees for your instances on the WAF bill management page. Deduction bills are also available in the User Center. For details, see View bills.