The pay-as-you-go billing method uses security capacity units (SeCUs) to calculate bills based on actual resource usage. This topic describes the billing rules of the pay-as-you-go billing method.

Note You can purchase a SeCU resource plan to offset your SeCU usage and reduce costs. For information about SeCU resource plans, see SeCU resource plan.

Scenarios

The pay-as-you-go billing method is ideal for scenarios that have the following characteristics:
  • Business volume fluctuates frequently.
  • Your business has short-term requirements on resource usage.

Billable items

Formula

Total fee = Request processing fee + Feature fee

Billable items

Billable item Description
Request processing fee Basic request fee

Within each whole hour, you are charged 1 SeCU for every 5,000 requests. These requests include both normal requests and malicious requests, but not server responses.

Note
  • If the number of requests that are processed in an hour is zero, the request processing fee is 0 SeCU.
  • If the number of requests is not a multiple of 5,000, it is rounded up to the nearest multiple of 5,000. Then, the SeCU usage is calculated. For example, if 13,425 requests are processed in an hour, the request processing fee is 3 SeCUs.

The basic request fee includes the fees for the basic protection rule feature and the whitelist feature.The fees for the two features are not included in the feature fee.

Bot management fee

You are charged bot management fees only for requests that match protection rules.

You are charged 1 SeCU for every 10,000 requests that are matched and processed by WAF each hour.

Note If the number of requests is not a multiple of 10,000, it is rounded up to the nearest multiple of 10,000. Then, the SeCU usage is calculated. For example, if 13,425 requests are matched and processed in an hour, the request processing fee is 2 SeCUs.
Feature fee You are charged based on the actual usage of features. For example, you are charged for enabling a feature and for the number of rules that you configure for a feature. For more information, see Feature fees.
Table 1. Feature fees
Feature Billable item SeCU usage per hour
Basic protection rule N/A 0 SeCU
Basic protection rule group Number of rule groups that are configured

(The rule groups include rule groups that are associated with protection templates and rule groups that are not associated with protection templates. You can configure up to 99 basic protection rule groups.)

2 SeCUs per group
Whitelist N/A 0 SeCU
IP address blacklist Number of rules that are configured in the IP address blacklist

(The rules include enabled and disabled rules.)

2 SeCUs per rule
Custom rule Number of basic rules that are configured

(The rules include enabled and disabled rules.)

1 SeCU per rule
Number of advanced rules that are configured

(The rules include enabled and disabled rules.)

Note Custom rules that meet one of the following conditions are advanced rules. All other rules are basic rules.
  • The rule type is Throttling.
  • The following match fields are used: Body and Body Parameter.
  • The following logical operators are used: regular expression match and regular expression mismatch.
2 SeCUs per rule
Scan protection Number of scan protection rules that are configured

(The rules include enabled and disabled rules. Each scan protection template contains three rules.)

1 SeCU per rule
HTTP flood protection Number of HTTP flood protection rules that are configured

(The rules include enabled and disabled rules.)

2 SeCUs per rule
Region blacklist Number of region blacklist rules that are configured

(The rules include enabled and disabled rules.)

3 SeCUs per rule
Custom response Number of custom response rules that are configured

(The rules include enabled and disabled rules. Each custom response template contains one rule.)

10 SeCUs per rule
Bot management Number of bot management templates that are configured 50 SeCUs per template
Website tamper-proofing Number of website tamper-proofing rules that are configured

(The rules include enabled and disabled rules.)

5 SeCUs per rule
Data leakage prevention Number of data leakage prevention rules that are configured

(The rules include enabled and disabled rules.)

5 SeCUs per rule
Number of domain names that are added in CNAME record mode Number of domain names that are added in CNAME record mode

(The domain names include second-level domain names and wildcard domain names.)

  • One domain name: 0 SeCU
  • Domain names outside one domain name: 2 SeCUs per domain name
Exclusive IP address Number of domain names for which exclusive IP addresses are enabled (The domain names are added in CNAME record mode.) 15 SeCUs per domain name
IPv6 protection
Note WAF 3.0 does not support this feature.
Whether IPv6 protection is enabled for domain names that are added to WAF in CNAME record mode
  • IPv6 protection is disabled for all domain names: 0 SeCU
  • IPv6 protection is enabled for one or more domain names: 15 SeCUs
Use the intelligent load balancing feature Whether intelligent load balancing is enabled for domain names that are added to WAF in CNAME record mode
  • Intelligent load balancing is disabled for all domain names: 0 SeCU
  • Intelligent load balancing is enabled for one or more domain names: 15 SeCUs
Log Service for WAF The logging fee for WAF is included in the bill of Log Service. N/A

Billing cycle

Fees are calculated on an hourly basis (UTC+8). After fees are calculated, a new billing cycle begins.
Note
  • The bills for pay-as-you-go WAF instances are generated each day before 06:00. If you want to modify the specifications of a pay-as-you-go WAF instance, we recommend that you modify it after 06:00.
  • If the total value of your account balance and the vouchers in your Alibaba Cloud account is less than the amount billed, you are notified by text message or email.

Billing examples

Example 1

Assume that five domain names are added in CNAME record mode, two rules are created for the IP address blacklist, and no requests are processed in an hour.

The request processing fee for the hour is 0 SeCU. The feature fee is 10 SeCUs, including 8 SeCUs for the domain names added in CNAME record mode and 2 SeCUs for the two rules created for the IP address blacklist. The total fee is USD 0.1, which is calculated based on the following formula:0.01 × (8 + 2).

Example 2

Assume that 12 domain names are added in CNAME record mode, exclusive IP addresses and intelligent load balancing are enabled for two domain names, one scan protection template is created, and 50,001 requests are processed in an hour.

The request processing fee for the hour is 11 SeCUs. The feature fee is 70 SeCUs, including 22 SeCUs for the domain names added in CNAME record mode, 30 SeCUs for the domain names for which exclusive IP addresses are enabled, 15 SeCUs for the domain names for which intelligent load balancing is enabled, and 3 SeCUs for scan protection rules. The total fee is USD 0.81, which is calculated based on the following formula:0.01 × (11 + 22 + 30 + 15 + 3).