Hi everyone, I'm new to the community and to AWS security services in general. I'm a marketing ops manager, so I'm used to thinking about costs and ROI for our martech stack, but I'm now helping a friend set up protection for a simple, low-traffic WordPress blog. The traffic is maybe a few hundred visitors a day, tops.
I've been reading about AWS WAF and Shield Standard, and I'm trying to figure out the most budget-conscious way to get essential protection. My primary goal is to block common web exploits and maybe some basic DDoS mitigation without the bill becoming more than the site's revenue.
From a marketing perspective, I understand layered tools, but I'm unsure where the line is for a tiny site. For example, is AWS WAF alone (with the managed rule groups) sufficient, or is Shield Standard's always-on DDoS protection for ELB/CloudFront a must-have for this scale? I'm also curious about real-world cost examples—like, what does a typical monthly charge look like for a setup like this with minimal rules and very low request volume?
I'd love to hear from anyone who's gone through this evaluation for a small site. What was your setup, and were there any unexpected costs or configuration pitfalls?
For a few hundred visitors a day, I'd actually skip AWS WAF entirely at first. The managed rule groups are great, but the per-request cost plus the fixed monthly cost for each rule group can easily be $20-30/month. For a tiny static blog, that's often overkill.
Shield Standard is automatic and free for CloudFront and ELB, so you get that basic DDoS protection regardless. I'd start by just putting CloudFront in front of your origin, which is cheap and gives you Shield Standard. Enable some basic security headers and maybe a free Cloudflare tier if you need a WAF-like layer later. The real cost comes from logging, by the way - if you turn on WAF logs to S3, you'll pay for that storage and potentially for log ingestion if you analyze them elsewhere. That's where small setups get surprised.
grep is my friend.
You've zeroed in on the right question: where's the line for a tiny site? The problem is, you're starting from the vendor's menu of services instead of the actual threat model. For a static low-traffic blog, the most common "web exploits" are going to be automated scanners probing for default WordPress paths and outdated plugins. A managed WAF rule group is essentially a sledgehammer for that nut.
> what does a typical monthly charge look like
That's the trap. It's never minimal. The base $5 for the WAF web ACL, plus $1 per rule group per month, plus $0.60 per million requests. Sounds trivial. Then you enable logging because you want to see what's being blocked, and now you're paying for S3 storage, potentially Glue tables, and Athena queries. That's where the $20-30 estimate from the other poster is optimistic. I've seen bills creep to $50 for a "simple" setup because someone left verbose logging on during a botnet scan that sent a few million requests.
Shield Standard is free, yes, but only if your origin is already behind CloudFront or an ELB. If you're just pointing a domain at an EC2 instance, you don't get it. So the real question is whether you've architected for CloudFront from the start. If not, you're comparing the cost of re-architecting versus the cost of the WAF.
The small print is where the fun is.
I'm in a similar boat, trying to protect our startup's landing page without overspending. Your line about the bill not exceeding revenue hits home.
The previous comments about skipping AWS WAF at first are solid. Shield Standard is free on CloudFront, so that's your baseline DDoS coverage without any decision. For common exploits on a WordPress blog, I found that using a simple plugin to restrict login attempts and hide the default wp-admin path cut out most of the automated noise for free. That might get you 80% of the way there before you even touch a paid service.
Your real-world cost question is key. I got a quote for a basic WAF setup from a different provider, and the "platform fee" alone was $25 before any requests. That's where the AWS per-request model can actually look better, until the logging catches you. Did your friend look at any all-in-one security plugins as a first step?
Everyone's already telling you to skip AWS WAF for now, and they're right. But I'd take it a step further and ask why you're even thinking about ELB/CloudFront for a low-traffic blog? That's the AWS hamster wheel.
For that scale, just run the blog on a $5-$10 VM somewhere else and forget most of this. Put it behind Cloudflare's free tier, which gets you a basic WAF and DDoS protection. You're over-complicating it before you even know what you need to block.
If you're set on AWS, Shield Standard is indeed free with CloudFront. The WAF is where the costs hide, like the others said. The logging will get you.
yaml all the things