We recently switched our main marketing site from Imperva to Cloudflare. It was primarily a budget decision, but I want to make sure we didn't overlook a critical feature.
On the gain side, our costs are much lower and the setup felt simpler. The performance seems comparable.
I'm concerned about security. Imperva's dashboard gave us very detailed bot breakdowns and attack analytics. With Cloudflare, the reports feel more high-level. Are we missing important protections now? For those who made a similar switch, what specific security or logging features did you have to rebuild or find alternatives for?
I'm the senior platform engineer at a B2B SaaS company doing about $30M ARR, where we run our customer-facing portal and marketing site on a mix of Kubernetes and traditional CMS, handling around 80 million requests daily. We went through this exact migration two years ago.
* **Bot Protection Granularity:** Imperva's Advanced Bot Protection gives you a forensic-level breakdown, like classifying bots by known toolkits (Puppeteer-extra, Selenium) and intent (scraping, credential stuffing). Cloudflare's Bot Management (an add-on, ~$5-10/user/mo with an enterprise contract) uses machine learning for a score but is less transparent. You lose the specific "this is an automated browser instance from this ASN" detail unless you build it yourself from logs.
* **Attack Analytics and Log Immersion:** Imperva's dashboard is built around the WAF and DDoS event data. Cloudflare pushes you toward raw log ingestion (via Logpull or Logpush) for deep analysis. The hidden cost isn't just the log storage, but the engineering time to pipe Cloudflare logs to your SIEM or analytics platform and rebuild those dashboards. We spent about 40 person-hours setting up a comparable Grafana dashboard.
* **False Positive Tuning Nuance:** Imperva's rule exclusions based on traffic patterns or session identity felt more granular for complex web apps. Cloudflare's WAF exceptions, while powerful, are heavily reliant on firewall rules expression syntax, which can be brittle. We saw a 2-3% block rate on legitimate API traffic post-migration that required a week of tuning.
* **Enterprise Support Model:** With Imperva, our account team and SOC analysts were on a direct Slack channel. Cloudflare's enterprise support is ticket-based with a 1-hour SLA for P0 incidents, but the tier of engineer you get varies. For a critical false positive during a product launch, Imperva's model resolved it faster in our experience.
I would recommend Cloudflare if your primary needs are DDoS mitigation, global performance, and a consolidated platform (CDN, WAF, DNS). I would only recommend Imperva if you have a dedicated security team that relies on surgical bot intelligence and needs vendor-led tuning for a highly complex application. Tell us the size of your security team and whether your app has a high-volume, stateful API component, and the call becomes much clearer.
— Harper
Your concern about the loss of detailed bot analytics is valid, but there's a secondary data pipeline implication you need to consider. The real gap isn't just in the dashboard, it's in the granularity of data available for export to your own analytics platforms. Imperva's logs often provided structured fields for bot classification you could feed directly into a data warehouse for trend analysis.
With Cloudflare, you must reconstruct that context yourself. You'll be relying heavily on the `cf.bot_management.score` field in Logpush and then building your own lookup tables to correlate scores with traffic patterns over time. This requires additional ETL work to achieve similar internal reporting. So the cost savings are partially offset by the engineering hours needed to rebuild those analytical views.
Have you evaluated whether Cloudflare's Logpull API provides the specific HTTP request headers you need for your internal security dashboards? That's often the limiting factor.
Data doesn't lie, but folks sometimes do.