All Products
Search
Document Center

Web Application Firewall:Billing overview

Last Updated:Jan 23, 2026

Web Application Firewall (WAF) 3.0 supports the subscription and pay-as-you-go billing methods. The subscription model is ideal for customers with fixed budgets, stable business operations, and long-term requirements. The pay-as-you-go model is better suited for short-term or temporary business needs. This topic describes the scenarios, billable items, billing cycles, and activation methods for both billing methods to help you quickly understand WAF billing.

Billing methods

WAF 3.0 supports subscription and pay-as-you-go billing methods to meet user needs in different scenarios. The following table describes the differences between the two billing methods.

Billing property

Subscription

Pay-as-you-go

Activation method

Web Application Firewall 3.0 (Subscription) purchase page

Web Application Firewall 3.0 (Pay-as-you-go) purchase page

Billing model

Subscription model. You pay upfront and are billed based on the subscription duration of your order.

Pay-as-you-go model. You pay after use. Bills are generated based on your actual usage in each billing cycle, and the fees are deducted from your account. You can also use SeCU resource plans (subscription) to save costs.

Scenarios

  • Business resource requirements are stable and predictable.

  • Long-term use of WAF protection

  • Complex management scenarios and hybrid cloud access

  • Business usage frequently changes.

  • Resource usage is temporary and has traffic bursts.

Billable items

Important
  • Product and service prices are subject to change. Your Alibaba Cloud bill is the final reference.

  • If you enable WAF protection for an Application Load Balancer (ALB) instance, you are charged for the ALB WAF-enabled instance on the ALB side in addition to the preceding billable items on the WAF side. For more information about the billing of ALB WAF-enabled instances, see Enable WAF protection for an ALB instance.

  • Basic feature fee (Required): The edition, specifications, and subscription duration you select when you activate a subscription instance.

  • Value-added feature fee (Optional, billed separately): In addition to basic services, you can select one or more value-added services as needed. Elastic pay-as-you-go queries per second (QPS) and Fraud Detection are activated first and then billed monthly based on actual usage (pay-as-you-go). Other value-added services are subscription-based.

  • Request processing fee: The fee for requests within a full hour.

  • Feature fee: The fee for using different features within a full hour.

    Note

    Both the request processing fee and the feature fee can be offset by SeCU resource plans. For more information about the offset rules, see What is a SeCU resource plan?.

Billing cycle

The subscription duration of the order, which is the Subscription Duration you select when you purchase the instance.

Pay-as-you-go fees are settled daily (UTC+8). After settlement, a new billing cycle begins and continues until you unsubscribe from WAF.

Billing unit

USD

SeCU

Note

SeCU is a unified metering unit for pay-as-you-go WAF 3.0. 1 SeCU = USD 0.01

Critical event protection fee

This is the fee for the critical event protection feature and its effective duration. It is a subscription service with a minimum purchase of 30 days. For more information about security protection for critical events during specific periods and the billing for this feature, see Critical event protection.

Details

Subscription billing

Billing flow

The following sections describe the detailed billing flows for the subscription and pay-as-you-go billing methods in WAF. This will help you understand the potential fees that you may incur.

Pay-as-you-go

This section describes billing cycle management for pay-as-you-go instances.

image

Activate the WAF service

  • Go to the Web Application Firewall 3.0 (Pay-as-you-go) purchase page to activate pay-as-you-go WAF. During the purchase, you must set a traffic billing protection threshold.

  • Note

    When you activate the pay-as-you-go billing method, you must set a protection threshold for traffic fees. This prevents unexpected high fees caused by traffic spikes. You can also manually set a traffic billing protection threshold at any time after the service is activated to adapt to changing business needs.

  • Go to the WAF 3.0 SeCU Resource Plan purchase page to purchase a SeCU resource plan. You can use the plan to offset request processing fees and feature fees that are generated in pay-as-you-go mode and reduce your costs.

Onboard to WAF

  • The critical event protection feature is subscription-based. For more information, see Critical event protection.

  • The instance fee for a pay-as-you-go WAF instance consists mainly of the request processing fee and the feature fee. For more information, see Billing details.

Sandbox

If an instance enters the sandbox state, it automatically exits the sandbox state if the peak QPS in the next hour is lower than the Traffic Billing Protection Threshold. You can also manually set the traffic billing protection threshold to prevent the instance from entering the sandbox again.

Fee deduction and billing

  • Fees can be offset by SeCU resource plans or deducted from your account balance.

    Note

    After a SeCU resource plan is used up or expires, fees are automatically deducted from your account balance. SeCU resource plans can be used for offsets only when your account has no overdue payments.

  • You can view daily bills and usage details.

Overdue payments

If your Alibaba Cloud account has an overdue payment and you want to continue using Alibaba Cloud pay-as-you-go services, you must promptly top up your account in the User Center. For more information about the status of your resources after a payment is overdue, see Overdue payments.

Deactivate WAF

  • If you no longer need a pay-as-you-go WAF instance and it has received few or no requests in the last two days, you can release the instance. Before you release the instance, make sure that you have backed up or migrated your data and that the release will not affect your business. Billing stops on the day after you deactivate the instance (T+1). For more information about how to unsubscribe from a pay-as-you-go instance, see Unsubscribe from a pay-as-you-go instance.

  • If you purchased a SeCU resource plan to offset fees for a pay-as-you-go instance, you can submit a ticket to request a refund. A refund is available only if you purchased the SeCU resource plan within the last five days and have not used it.

Subscription

Billing cycle management for subscription instances

image

Activate the WAF service

Go to the Web Application Firewall 3.0 (Subscription) purchase page and select a suitable WAF edition.

Note

Fraud Detection and elastic pay-as-you-go QPS are pay-as-you-go items. They are currently supported only by the Pro, Enterprise, and Ultimate editions. When you activate a subscription instance, you can set the QPS extension and enable elastic pay-as-you-go QPS in advance. This prevents the instance from entering the sandbox state if the actual peak QPS exceeds the QPS specification.

Add to WAF

  • The critical event protection feature is subscription-based. For more information, see Critical event protection.

  • The instance fee for a subscription WAF instance consists mainly of the basic service fee (required) and the value-added service fee (optional). For more information, see Subscription instance fees.

Sandbox

If an instance enters the sandbox state, you must upgrade its edition, purchase a QPS extension, or enable elastic pay-as-you-go QPS to remove the instance from the sandbox state.

Upgrade and downgrade items

WAF provides instance upgrade and instance downgrade features. You can upgrade the edition of your WAF instance or upgrade or downgrade its value-added services based on your business needs.

View bills

You can view daily bills and usage details.

Overdue payments and renewal

  • Overdue payments: If your Alibaba Cloud account has an overdue payment, you can still use your existing subscription WAF service because you have already paid the resource fees. However, you cannot perform operations that incur fees, such as using pay-as-you-go services like Fraud Detection and elastic pay-as-you-go QPS, upgrading instance configurations, or renewing orders. For more information about the status of your resources after a payment is overdue, see Overdue payments.

  • Renewal: You can choose manual renewal or auto-renewal. For more information about the renewal procedure, see Renewal policy.

Unsubscribe from WAF

If your instance has expired and you no longer use WAF, you can unsubscribe from it. For more information about the unsubscription rules and procedure for subscription instances, see Unsubscribe from a subscription instance.

Switch between billing methods

Subscription to pay-as-you-go: Immediate switching is not supported. You can unsubscribe from the subscription instance after it expires and then activate a new pay-as-you-go instance. For more information, see Switch between billing methods.

Pay-as-you-go to subscription: Immediate switching is not supported. You can deactivate the pay-as-you-go instance and then purchase a new subscription WAF instance. For more information, see Switch between billing methods.

Renewal policy

If a subscription WAF instance is not renewed on time, the protection for your website is affected. To prevent the protection service from being automatically stopped after the instance expires, you must manually renew the instance or enable auto-renewal before the expiration date. For more information about how to renew your WAF instance, see Subscription renewal policy.

Note
  • Pay-as-you-go WAF instances are billed based on the actual usage of billable items. You pay after you use the service, so no renewal is required.

  • SeCU resource plans do not support direct renewal or upgrades. You can purchase multiple SeCU resource plans or a larger SeCU resource plan. For more information about how to purchase a SeCU resource plan, see Purchase a SeCU resource plan.

Unsubscription policy

If you no longer use WAF, you can unsubscribe from a subscription instance, deactivate a pay-as-you-go instance, or unsubscribe from a SeCU resource plan, provided that the unsubscription requirements are met. For more information about the unsubscription rules and procedure for WAF, see Unsubscription policy.

Note
  • If you have activated a subscription instance for multi-cloud/hybrid-cloud protection, bot management for web protection, bot management for app protection, a critical event protection package, or API security, you cannot unsubscribe from the instance in the console. You can submit a ticket or contact your account manager for assistance.

  • If you purchased a SeCU resource plan to offset fees for a pay-as-you-go instance, you can submit a ticket to request a refund. A refund is available only if you purchased the SeCU resource plan within the last five days and have not used it.

Overdue payments

Your Alibaba Cloud account is considered to have an overdue payment if your available credit, which includes your Alibaba Cloud account balance and coupons, is less than the amount of the bill to be settled. Overdue payments may affect the normal operation of your instances. You must top up your account promptly.

For a subscription WAF instance, you have already paid the resource fees. Therefore, you can still use your existing instance even if your account has an overdue payment. However, you cannot perform operations that incur fees, such as using pay-as-you-go services like Fraud Detection and elastic pay-as-you-go QPS, upgrading instance configurations, or renewing orders. For a pay-as-you-go WAF instance, an overdue payment on your Alibaba Cloud account causes the instance to be suspended. Billing for the related WAF resources is paused during the suspension. If you do not settle the overdue bill within the specified period, Alibaba Cloud releases the instance. The data on the instance is deleted and cannot be recovered.

If your account has an overdue payment, see Overdue payments for information about the corresponding resource status and how to resolve the issue.

View bills

After you activate WAF, you can view the actual usage and fees for pay-as-you-go and subscription instances on the WAF bill management page. You can also view deduction bills in the User Center. For more information about how to view WAF bills, see View bills.