Subcategory research

Web Application Firewall (WAF) Software

Software for protecting web applications and APIs by filtering, monitoring, and blocking malicious HTTP traffic. Includes cloud and appliance-based WAF capabilities; excludes general CDN services, load balancing, and application performance monitoring.

View tool shortlist Compare tools

Web Application Firewall (WAF) Software product list

10 published tools. Filter the complete list below.

#1Compare

Fortinet FortiWeb

Fortinet FortiWeb is a self-managed web application and API firewall delivered as hardware, virtual, container, and public-cloud appliances, with machine-learning detection, API discovery and schema controls, bot mitigation, and Fortinet Security Fabric integrations.

81Consider

Pricing

Custom quote required for some paid plans
Quote required

Best for

Enterprise
Mid-market
Small business

#2Compare

Barracuda Web Application Firewall

Barracuda Web Application Firewall is a customer-operated web application and API firewall available as a physical appliance or virtual appliance for on-premises, private-cloud, AWS, and Azure deployment.

79Consider

Pricing

Custom quote required for some paid plans
Quote required

Best for

Enterprise
Mid-market

#3Compare

Fastly Next-Gen WAF

Fastly Next-Gen WAF is a hybrid web application and API firewall that uses contextual request detection, shared threat intelligence, signals, rules, thresholds, and centralized visibility across edge, Fastly-hosted cloud, and customer-managed deployments.

79Consider

Pricing

Custom quote required for some paid plans
Quote required

Best for

Enterprise
Mid-market

#4Compare

Azure Web Application Firewall

Azure Web Application Firewall provides managed and custom web-traffic protection through Application Gateway WAF v2, Application Gateway for Containers WAF, and Azure Front Door WAF deployment routes, with deployment-specific rules, scaling, monitoring, and pricing meters.

78Consider

Pricing

Some paid plan amounts are unverified — check official pricing
Usage charges

Best for

Enterprise

#5Compare

Google Cloud Armor

Google Cloud Armor is Google Cloud's edge security service for applying WAF, access-control, rate-limiting, and DDoS protections to supported load-balanced applications, APIs, CDN origins, and selected network endpoints.

77Consider

Pricing

Paid · Cloud Armor Standard · $0.006849315 USD · per security policy · per hour · Standard security-policy usage · usage based · no commitment
Paid · Cloud Armor Standard · $0.001369863 USD · per rule · per hour · Standard rule usage · usage based · no commitment
Usage charges

Best for

Enterprise
Mid-market

#6Compare

Cloudflare Web Application Firewall

Cloudflare Web Application Firewall is a cloud-delivered edge WAF that filters web and API requests with managed rulesets, custom rules, rate limiting, analytics, and plan-dependent security controls.

76Consider

Pricing

Free plan available — see plan limits
Paid · Pro · $20 USD · per domain · per month · Monthly rate billed annually · discounted · billed annually
Paid · Pro · $25 USD · per domain · per month · Monthly billing · billed monthly
Custom quote required for some paid plans
Quote required
Free plan — check scope

Best for

Small business
Enterprise

#7Compare

F5 Distributed Cloud WAF

F5 Distributed Cloud WAF is a SaaS-delivered web application firewall that combines attack signatures, behavioral analysis, threat campaigns, signature-based bot controls, AI risk scoring, automatic signature tuning, policy controls, and centralized observability.

75Consider

Pricing

Custom quote required for some paid plans
Quote required

Best for

Enterprise

#8Compare

Akamai App & API Protector

Akamai App & API Protector is a cloud-delivered web application and API protection service that combines an adaptive WAF, Layer 7 DDoS defense, API discovery, basic bot controls, security analytics, and DevOps automation at Akamai's edge.

74Consider

Pricing

Custom quote required for some paid plans
Quote required

Best for

Enterprise
Mid-market

#9Compare

AWS WAF

AWS WAF is a cloud-native web application firewall for CloudFront and supported regional AWS resources, priced by web ACLs, rules or attached rule groups, and inspected requests, with separately charged intelligent threat-mitigation features.

73Watchlist

Pricing

Paid · AWS WAF pay-as-you-go · $5.00 USD · per web ACL · per month · Web ACL monthly component · usage based · no commitment
Paid · AWS WAF pay-as-you-go · $1.00 USD · per rule or attached rule group · per month · Rule and rule-group monthly component · usage based · no commitment · Rules inside customer-created rule groups are also charged individually
Usage charges

Best for

Enterprise
Mid-market
Small business

#10Compare

Imperva Web Application Firewall

Imperva Web Application Firewall is a WAF product family with SaaS Cloud WAF, locally managed WAF Gateway, and Kubernetes-based Elastic WAF deployment offers for protecting web applications and API traffic.

72Watchlist

Pricing

Custom quote required for some paid plans
Quote required

Best for

Enterprise