Alibaba Cloud Web Application Firewall (WAF) is upgrading bot management on August 1, 2025 (UTC+8) with a new detection architecture, AI-powered threat intelligence, and updated pricing. This page explains what changes, who is affected, and what action you need to take.
The actual upgrade time may differ slightly from the scheduled date. The actual implementation time prevails.
What's new
The new version rebuilds the detection stack across three areas.
| Area | Capability | What it does |
|---|---|---|
| Detection engine | Multi-dimensional fingerprint detection | Matches ClientID, JA3, JA4, and HTTP/2 fingerprints in rules; deduplicates traffic across multiple feature combinations to accurately identify disguised devices |
| Detection engine | Dynamic defense matrix | Rotates JavaScript challenges and dynamic token algorithms automatically to raise the cost of evasion |
| Rule management | Visualization rule center | Classifies bots into three tiers — malicious, suspicious, and legitimate — with per-rule switches, custom protection actions, and flexible schedule settings |
| AI protection | Multi-dimensional detection model | Improves detection accuracy on abnormal traffic patterns |
| AI protection | Bot AI intelligence module | Defends against Large Language Model (LLM) crawlers using exclusive threat intelligence |
| Observability | Full-traffic analysis dashboard | Displays bot feature profiles in real time to help you tune mitigation policies |
| Observability | Security report update | Adds detailed blocking reason fields to logs, making incident tracing faster |
Pricing changes
Prices on the buy page prevail over the figures listed here.
Subscription
| Billable item | Old version | New version |
|---|---|---|
| Bot management for web application protection | Pro: USD 500/month; Enterprise: USD 1,000/month; Ultimate: USD 1,720/month | USD 1,150/month |
| Bot management for app protection | USD 300/month | USD 1,750/month |
Pay-as-you-go
| Billable item | Old version | New version |
|---|---|---|
| Bot management for app protection (feature fees) | 50 security capacity units (SeCUs) per protection template | 80 SeCUs per protection template |
| Custom rule | No separate billing | 15 SeCUs per custom rule (new billable item) |
Impact by user type
Existing subscription users
No action required. Continue to renew at your current prices.
New users
Starting August 1, 2025:
All new purchases of bot management use the new version at new prices, including the AI intelligence protection system.
The old version is no longer available for new purchases.
Existing pay-as-you-go users
Your instance will be migrated automatically. No business interruption occurs during migration, and protection rules migrate seamlessly.
| Item | Details |
|---|---|
| Upgrade window | August 1, 2025 – December 30, 2025 |
| Migration method | Batch-based automatic upgrade |
| Billing | Real-time billing at new prices immediately after your instance is upgraded |
| Service continuity | No business interruption; protection rules migrate seamlessly |