This topic compares the capabilities of each Web Application Firewall (WAF) 3.0 edition.
Use cases by version
WAF 3.0 is available in five versions with different billing methods and service capabilities to suit various business scenarios:
Basic Edition: Ideal for small and personal websites without special security requirements.
Advanced Edition: Ideal for small to medium-sized websites without special security requirements.
Enterprise Edition: Ideal for medium-sized enterprise websites or public-facing services with high security requirements.
Ultimate Edition: Ideal for medium- to large-scale enterprise websites or those with custom security requirements. Contact your account manager to customize specifications.
Pay-As-You-Go Edition: This edition uses a postpaid billing model, making it ideal for fluctuating business usage.
Version comparison
Performance metrics: WAF 3.0 uses QPS (HTTP/HTTPS requests per second) as its core traffic metric instead of bandwidth. This lets you focus on your service's request rate without worrying about bandwidth limits. If the maximum available QPS is insufficient for your business needs, contact your account manager.
Domain name rules: WAF counts each primary domain, subdomain, and wildcard domain as a single domain name.
Billing description: For detailed billing information, see Subscription billing and Pay-as-you-go billing.
Core features
Feature | Subscription basic edition | Subscription advanced edition | Subscription enterprise edition | Subscription ultimate edition | Pay-as-you-go edition |
Included QPS | 10 QPS | 2,000 QPS | 5,000 QPS | 10,000 QPS | Chinese mainland: 30,000 QPS Regions outside the Chinese mainland: 3,000 QPS |
Purchasable QPS expansion | Chinese mainland: 30,000 QPS Regions outside the Chinese mainland: 5,000 QPS | Chinese mainland: 30,000 QPS Regions outside the Chinese mainland: 5,000 QPS | Chinese mainland: 30,000 QPS Regions outside the Chinese mainland: 5,000 QPS | ||
Chinese mainland: 60,000 QPS Regions outside the Chinese mainland: 1,000 QPS | Chinese mainland: 60,000 QPS Regions outside the Chinese mainland: 1,000 QPS | Chinese mainland: 60,000 QPS Regions outside the Chinese mainland: 1,000 QPS | |||
Number of domains | 3 | 5 | 10 | 50 | 1,000 |
Additional domains | 10 | 500 | 2,000 | 5,000 | |
1 | 1 | ||||
Bonus domains with hybrid cloud node expansion | 100 for one additional node; 200 for two or more. | 100 for one additional node; 200 for two or more. | |||
Number of protected objects (cloud service instances and domain names) | 300 | 600 | 2,500 | 10,000 | 10,000 |
Number of protected object groups | 10 | 10 | 10 | 10 | 100 |
Number of protected objects per protected object group | 50 | 50 | 50 | 50 | 100 |
Number of member accounts for multi-account management | 5 | 20 (customizable) |
Resource access
When you add ECS, CLB, and NLB instances, the number of traffic redirection ports cannot exceed the number of protected objects.
Feature | Basic | Advanced | Enterprise | Ultimate | Pay-as-you-go |
Supported for an additional fee | |||||
Chinese mainland: Regions outside the Chinese mainland: | Chinese mainland: Regions outside the Chinese mainland: | Chinese mainland: Supported for an additional fee Regions outside the Chinese mainland: | |||
Supported for an additional fee | Supported for an additional fee | Supported for an additional fee | Supported for an additional fee | ||
Supported for an additional fee | Supported for an additional fee | Supported for an additional fee | Supported for an additional fee | ||
Maximum upload file size (default: 2 GB) |
Basic security protection
Version notes: In the new release, core protection rules no longer support rule groups. For more information, see [Announcement] WAF 3.0 basic protection rule feature upgrade.
Custom rule limits: A custom rule can block up to 20,000 IP addresses. If you exceed this limit, the rule may not function as expected.
Template and rule limits: For the whitelist, IP blacklist, custom rule, data leakage prevention, website tamper-proofing, HTTP flood protection, and AI protection modules, you can create a maximum of 500 templates per module and 500 rules per template.
Feature | Subscription - Basic | Subscription - Advanced | Subscription - Enterprise | Subscription - Ultimate | Pay-as-you-go |
Number of custom rule groups for web core protection | 10 | 30 | 30 | ||
Number of custom protection templates for web core protection | 3 | 10 | 20 | 50 | 20 |
Total number of allowlist rules (sum of rules across all protection templates) | 2,000 | 2,000 | 2,000 | 5,000 | 5,000 |
Total number of IP blocklist rules (sum of rules across all protection templates) | 10 | 30 | 100 | 100 | |
Total number of IP addresses in the IP blocklist | 2,000 | 6,000 | 20,000 | 20,000 | |
Total number of custom rules (sum of rules across all protection templates) | 1,000 | 4,000 | 10,000 | 10,000 | |
Match fields for custom rules | IP or URL | IP, URL, all headers, regular expression, and request body | IP, URL, all headers, regular expression, and request body | IP, URL, all headers, regular expression, and request body | |
Maximum IP addresses per custom rule | 100 | 100 | 100 | 100 | |
Actions for custom rules | JS Challenge | JS Challenge, Slider Challenge | JS Challenge, Slider Challenge | JS Challenge, Slider Challenge | |
Rate-based custom rules | |||||
Total number of web tamper proofing rules (sum of rules across all protection templates) | 500 | 1,000 | 2,500 | 2,500 | |
Total number of data leakage prevention rules (sum of rules across all protection templates) | 500 | 1,000 | 1,000 | 1,000 | |
Number of geo-blocking protection templates | 10 | 20 | 20 | ||
Number of CC protection templates | 5 | 10 | 20 | 20 | |
Number of scan protection templates | 5 | 10 | 20 | 20 | |
Number of custom response templates | 20 | 50 | 50 | ||
Maximum protected objects and groups per protection template | 10 | 100 | 200 | 500 | 100 |
Advanced security protection
Feature | Subscription Basic | Subscription Advanced | Subscription Enterprise | Subscription Ultimate | Pay-as-you-go |
Paid | Paid | Paid | Paid | ||
Total advanced custom rules for bot management (across all templates) | 300 | 300 | 300 | 300 | |
Paid temporary upgrade | Paid temporary upgrade | Included | Paid | ||
Paid | Paid | Paid | Paid | ||
Paid | Paid | Paid | Paid | ||
Total rules for rate limiting for traffic bursts (across all templates) | 25 | 25 | 25 | 25 | |
Paid | |||||
Threat intelligence templates | 5 | 5 | 5 | ||
IP address book capacity | 3,000 | 10,000 | 50,000 (customizable) | 3,000 |
Operations and monitoring
Feature | Subscription basic edition | Subscription advanced edition | Subscription enterprise edition | Subscription ultimate edition | Pay-as-you-go edition |
Available at an additional cost | Available at an additional cost | Available at an additional cost | |||