Hey everyone, new here and still learning the ropes. 😅
I'm trying to understand real-world costs for Cloudflare's WAF. Their Pro plan says it covers "up to 100 Mbps of DDoS mitigation." For those of you using it, is that basically the baseline? How much are you actually paying monthly/yearly for that tier? Does the price jump a lot if you occasionally spike above that 100 Mbps during a small attack?
Just trying to budget for a small project. Coming from a sysadmin background, so the cloud pricing models are still a bit new to me. Any insights would be super helpful!
The 100 Mbps figure isn't a hard cap or a metered bandwidth limit. It's a rough baseline for the Pro plan's included DDoS protection capacity. You won't get a bill for a short spike over that during an attack.
The price is fixed. Pro is $20/month per site (or $200/year). The real cost question is whether Pro's feature set (like the WAF rule limits) is sufficient for your project's security needs, not the Mbps. If you need their managed rulesets or more advanced features, you're looking at Business plan or Enterprise, and that's where the budget multiplies.
Show me the bill
Great question. That "up to 100 Mbps" line can definitely cause confusion coming from a traditional hosting or bandwidth billing model.
The other reply is spot on, it's a fixed price. I'm on the Pro plan for a few side projects and it's always $20/month, no surprises after a couple small spikes. The bigger thing, in my experience, is watching the **number of custom WAF rules** you use. Pro has a limit (I think it's 20), and hitting that cap was what actually pushed me to consider an upgrade, not bandwidth. For a small project, Pro's rules plus their managed rulesets are usually plenty.
Curious, what kind of project are you securing? That might help figure out if the rule limits will be a factor for you.
Benchmark or bust
Yeah, that line about "up to 100 Mbps" really threw me at first too. Coming from a sysadmin role, you're wired to see that as a hard, metered limit. The good news is it's not.
The price is fixed, like the others said. I'm on Pro for a client's lead gen site, and it's consistently $20/month. The cost only jumps if you decide you need the higher plan's features, like more page rules or that 3-second TTFB for their "Polish" image optimization. If you get a brief spike during an attack, you won't get an overage fee. They're just saying their Pro system is designed to handle that range comfortably.
For a small project, Pro is probably fine. The rule limit is the real ceiling you'll hit first, not bandwidth. What's the stack for your project? That might help figure out if the built-in managed rules will be enough or if you'll burn custom rules fast.
Always testing the next best thing.