WAF rules that stop attacks, not customers.
We set up and tune your web application firewall, testing every rule before it blocks.
In Managed Cloudflare, ₹12,999 a month; Cloudflare billed separately. Under attack? Call the 24/7 desk.
| Rule | Matches | Action | Status |
|---|---|---|---|
| Cloudflare managed rules | Known exploits: SQLi, XSS, RCE | Block | Enforced |
| Cloudflare OWASP Core Ruleset | Threat score over threshold | Log | Testing |
| Login rate limit | /login, over 5 tries a minute per IP | Challenge | Enforced |
| Admin lockdown | /admin from outside office IPs | Block | Enforced |
| Verified search bots | Googlebot, Bingbot (verified) | Skip bot rules | Enforced |
| Payment callbacks | Signed gateway webhooks only | Skip selected rules | Enforced |
Every change is tested first and has a rollback noted.
Businesses we’ve hosted and supported since 2009
What is a WAF?
A web application firewall (WAF) checks web requests before they reach your server and helps block attacks such as SQL injection, cross-site scripting and bot floods. We set up and tune the rules for your site, testing each one before it blocks.
- SQL injection
- Cross-site scripting
- Login stuffing
- Scrapers and bad bots
- Exploit scans
Test first. Block second.
Untested rules break checkouts. We test each one on real traffic before it blocks.
- 01
Map
Your domains, origin, login, checkout, APIs and the callbacks that must never be blocked.
- 02
Test
New rules start narrow: log mode where your plan has it, or a challenge on one path.
- 03
Tune
Exceptions for real customers, bots you want and payment callbacks.
- 04
Enforce
Switch to block, with a rollback for every change, then review monthly.
Cloudflare WAF or AWS WAF?
| Cloudflare WAF | AWS WAF | |
|---|---|---|
| Best when | Your site is behind Cloudflare, or can be | Your app runs on AWS: CloudFront, Application Load Balancer or API Gateway |
| Also gives you | DDoS protection, caching, plan-dependent bot controls | Tight fit with AWS logging and IAM |
| Rules | Managed rule sets, custom rules, rate limits | Managed rule groups, custom rules, rate limits |
| With us | Managed Cloudflare, ₹12,999 a month | Setup quoted |
Not sure? The free WAF check tells you which fits.
Get a free WAF check.
From the outside, we check the WAF signals we can see and whether your server is exposed around it. One page in 2 business days.
WAF service pricing.
Cloudflare WAF
Rules set up, tuned and reviewed monthly
₹12,999a month · $150 on US invoices
Get startedPer website · Cloudflare subscription billed by Cloudflare · WAF is one part of Managed Cloudflare, with DDoS and bot control. See Managed Cloudflare · Holes in your code need a VAPT.
Common questions
What is a WAF?
A web application firewall checks each request to your site before it reaches the server and blocks attacks such as SQL injection, cross-site scripting and bot floods. A network firewall controls connections; a WAF reads the web traffic itself.
Cloudflare WAF or AWS WAF?
If your site is behind Cloudflare, use Cloudflare WAF: you also get DDoS protection and caching. If the app runs on AWS behind CloudFront, an Application Load Balancer or API Gateway, AWS WAF fits. We manage Cloudflare WAF as Managed Cloudflare and quote AWS WAF setup.
Will a WAF block my customers?
Badly tuned rules do. We test each rule first: in log mode where your plan allows, otherwise on a narrow path. Then we add exceptions for real traffic and switch to block, with a rollback for every change.
Do I need a paid Cloudflare plan?
The free plan includes the Cloudflare Free Managed Ruleset and a few custom rules. The full Cloudflare Managed Ruleset and the OWASP Core Ruleset need Pro or above. We check what your plan includes before we start.
How much does WAF management cost?
Cloudflare WAF is managed as part of Managed Cloudflare: ₹12,999 a month per website ($150 on US invoices). Cloudflare bills its own subscription. AWS WAF and other platforms: setup quoted.
Does a WAF replace a VAPT?
No. A WAF filters known attack patterns; it does not fix the holes in your code. A VAPT finds them so your developers can fix them.