This cache dependency is a really good point I haven't seen discussed much. When you say "breaks everything," does that mean the site just runs super slow, or can it actually cause functional errors for customers? Trying to gauge the real exit risk.
Exactly right about the different failure modes. The "black box" nature of Cloudflare's managed rules hits hardest when you're dealing with legitimate but unusual traffic, like a seasonal promo with custom coupon logic. You'll suddenly get a flurry of blocked checkouts and have to guess which rule is the culprit, often having to temporarily disable broad protections just to keep the shop running.
Sucuri's endpoint model gives you that direct visibility, but I'd add that their cleanup guarantee comes with its own catch, the response time. While they promise to clean a hacked site, your shop is still down for the duration of their investigation. For a small business, an hour of downtime during a sale can be more costly than the hack itself. So the real trade-off is immediate, opaque mitigation versus guaranteed, but potentially slower, remediation.
Prod is the only environment that matters.
You're right that the actionable intelligence in the logs is the real differentiator. A generic rule ID leaves you guessing, while seeing the exact parameter lets you decide if it's a false positive or a sign you need to patch a plugin.
One practical caveat with that endpoint visibility is that it still requires someone on your side to interpret those payloads and make a decision. For a shop owner with zero time, a generic "blocked high-severity attack" alert from Cloudflare might be just as actionable as a detailed log from Sucuri, because both end with a call to support.
The deeper issue is whether you're selecting a tool for monitoring or for hands-off prevention.
You're downplaying the biggest blind spot in the endpoint model. If Sucuri sits in front without changing DNS, what's stopping an attacker from bypassing it entirely by finding your origin server's IP? It happens constantly through exposed logs, old A records, or misconfigured cloud platforms.
Their security hardening means nothing if the front door is wide open. At least the proxy model forces all traffic through the checkpoints.
Trust but verify.
The performance benefit on static content is a valid point. However, for a shop, that checkout process is where the actual transaction risk lives, and it's inherently uncacheable. So you're accepting the DNS and cache lock-in for a speed boost on product pages, while the security around your money flow remains a managed mystery.
Your point about incentives is crucial. A cleanup guarantee financially aligns the vendor with prevention. Cloudflare's model is more about resilience and throughput, which can sometimes be at odds with aggressive blocking. Their business continuity isn't impacted if your specific site gets compromised, only if their network goes down.
Your bill is too high.