This topic compares the features of the Web Application Firewall (WAF) 3.0 editions.
Version selection
WAF comes in five editions: four subscription-based (basic, advanced, enterprise, and ultimate) and a pay-as-you-go edition. Choose an edition that fits your business scenarios and security requirements.
The Pay-As-You-Go edition is ideal for users who are new to WAF or want to test its features.
Edition | Basic | Pro | Enterprise | Ultimate | Pay-as-you-go |
Scenarios | Small and personal websites with no special security requirements. | Small and medium-sized websites with no special security requirements. | Medium-sized enterprise websites or public-facing services with high security requirements. | Medium- and large-scale enterprise websites with extensive business operations or custom security requirements. | Ideal for fluctuating usage. |
Peak QPS | Includes 10 QPS. Overage is billed on a pay-as-you-go basis. | Includes 2,000 QPS, with paid limit increases available. Overage is billed on a pay-as-you-go basis. | Includes 5,000 QPS, with paid limit increases available. Overage is billed on a pay-as-you-go basis. | Includes 10,000 QPS, with paid limit increases available. Overage is billed on a pay-as-you-go basis. | Limits: Chinese mainland: 100,000 QPS Regions outside the Chinese mainland: 50,000 QPS |
Number of protected domains | Includes 3 domains and supports up to 10 additional domains. | Includes 5 domains and supports up to 500 additional domains. | Includes 10 domains and supports up to 2,000 additional domains. | Includes 50 domains and supports up to 5,000 additional domains. | Supports up to 1,000 domains. |
Protected ports | Standard ports: 80, 8080, 443, and 8443. | Standard ports: 80, 8080, 443, and 8443. | Standard and non-standard ports. | Standard and non-standard ports. | Standard and non-standard ports. Fees apply for non-standard ports. |
CC protection, IP blocklist, custom rules, scan protection, and other protection settings | Supported | ||||
Advanced security features such as Log Service, dedicated IP, bot management, and API security | Paid Support | Paid Support | Paid Support | Supported | |
Hybrid cloud access |
Version comparison
performance metrics: WAF 3.0 uses QPS (HTTP/HTTPS requests per second) as the core traffic metric, not bandwidth. This means you need to focus only on your request frequency, not bandwidth usage. If the highest available QPS option is insufficient for your business needs, contact your account manager.
domain name rules: When you add a domain, WAF 3.0 makes no distinction between domain types. A root domain, subdomain, or wildcard domain each counts as a single domain.
billing details: This document compares the features of different WAF editions but does not provide specific pricing. For detailed billing rules, see Subscription Billing Details and Pay-As-You-Go Billing Details.
Core features
Feature | Subscription - Basic | Subscription - Advanced | Subscription - Enterprise | Subscription - Ultimate | Pay-as-you-go |
QPS limit per edition | 10 QPS | 2,000 QPS | 5,000 QPS | 10,000 QPS | Paid add-ons: Chinese mainland: 100,000 QPS Outside the Chinese mainland: 50,000 QPS |
Additional QPS | Chinese mainland: 30,000 QPS Outside the Chinese mainland: 5,000 QPS | Chinese mainland: 30,000 QPS Outside the Chinese mainland: 5,000 QPS | Chinese mainland: 30,000 QPS Outside the Chinese mainland: 1,000 QPS | ||
Enabled by default and cannot be disabled | Enabled by default and cannot be disabled | Enabled by default and cannot be disabled | Enabled by default and cannot be disabled | ||
Number of domain names | 3 | 5 | 10 | 50 | Paid support for up to 1,000 domain names. |
Additional domain names | 10 | 500 | 2,000 | 5,000 | |
1 | 1 | ||||
Bonus domain names for hybrid cloud protection nodes | 100 bonus domains for one node; 200 for two or more. | 100 bonus domains for one node; 200 for two or more. | |||
Number of protected objects (cloud service instances and domain names) | 300 | 600 | 2,500 | 10,000 | 10,000 |
Number of protected object groups | 10 | 10 | 10 | 10 | 100 |
Number of protected objects per protected object group | 50 | 50 | 50 | 50 | 100 |
Multi-account management: Number of member accounts | 5 | 20 (customization supported) |
Resource onboarding
When adding ECS, CLB, or NLB instances to a cloud product, the number of traffic redirection ports must not exceed the protected objects limit.
Feature | Basic edition | Advanced edition | Enterprise edition | Ultimate edition | Pay-as-you-go |
Available at an additional cost | |||||
Chinese mainland: Regions outside the Chinese mainland: | Chinese mainland: Regions outside the Chinese mainland: | Chinese mainland: Available at an additional cost Regions outside the Chinese mainland: | |||
Available at an additional cost | Available at an additional cost | Available at an additional cost | Available at an additional cost | ||
Available at an additional cost | Available at an additional cost | Available at an additional cost | Available at an additional cost | ||
Adjustable upload file size limit (default: 2 GB) |
Basic security protection
Version notes: Core web protection rules no longer support rule groups. For details, see [Announcement] WAF 3.0 Basic Protection Rules Feature Upgrade.
Custom rule limits: Each custom rule can block up to 20,000 IP addresses. Exceeding this limit may cause the rule to fail.
Template and rule limits: For the allowlist, IP denylist, custom rule, information leakage prevention, web tamper proofing, rate limiting, and AI application protection modules, each module supports up to 500 templates, and each template supports up to 500 rules.
Feature | Subscription Basic | Subscription Advanced | Subscription Enterprise | Subscription Ultimate | Pay-as-you-go |
Number of custom rule groups for core web protection rules | 10 | 30 | 30 | ||
Number of custom protection templates for core web protection rules | 3 | 10 | 20 | 50 | 20 |
Total whitelist rules across all templates | 2,000 | 2,000 | 2,000 | 5,000 | 5,000 |
Total IP blacklist rules across all templates | 10 | 30 | 100 | 100 | |
Maximum IP addresses in IP blacklists | 2,000 | 6,000 | 20,000 | 20,000 | |
Total custom rules across all templates | 1,000 | 4,000 | 10,000 | 10,000 | |
Custom rule match fields | IP or URL | IP, URL, all headers, regex, body | IP, URL, all headers, regex, body | IP, URL, all headers, regex, body | |
Maximum IPs per custom rule | 100 | 100 | 100 | 100 | |
Custom rule actions | JS challenge | JS challenge, slider CAPTCHA | JS challenge, slider CAPTCHA | JS challenge, slider CAPTCHA | |
Rate-limiting custom rules | |||||
Total website tamper-proofing rules across all templates | 500 | 1,000 | 2,500 | 2,500 | |
Total data leak prevention rules across all templates | 500 | 1,000 | 1,000 | 1,000 | |
Number of geo-blocking templates | 10 | 20 | 20 | ||
Number of CC attack protection templates | 5 | 10 | 20 | 20 | |
Number of scanner protection templates | 5 | 10 | 20 | 20 | |
Number of custom response templates | 20 | 50 | 50 | ||
Maximum protected objects and object groups per protection template | 10 | 100 | 200 | 500 | 100 |
Advanced security
Features | Subscription Basic | Subscription Advanced | Subscription Enterprise | Subscription Ultimate | Pay-as-you-go |
Paid support | Paid support | Paid support | Paid support | ||
Total number of advanced custom rules for bot management (across all templates) | 300 | 300 | 300 | 300 | |
Paid support, available via temporary upgrade | Paid support, available via temporary upgrade | Supported, no additional fees | Paid support | ||
Paid support | Paid support | Paid support | Paid support | ||
Paid support | Paid support | Paid support | Paid support | ||
Total number of rate limiting rules (across all templates) | 25 | 25 | 25 | 25 | |
Paid support | |||||
Number of threat intelligence templates | 5 | 5 | 5 | ||
Capacity of the IP address book | 3,000 | 10,000 | 50,000 (custom quotas available) | 3,000 | |
Paid support | Paid support | Paid support |
Operations and monitoring
Feature | Basic Edition (Subscription) | Advanced Edition (Subscription) | Enterprise Edition (Subscription) | Ultimate Edition (Subscription) | Pay-as-you-go Edition |
Paid support | |||||
Paid support | Paid support | Paid support | Paid support | ||