Hey folks, data_shipper_joe here 👋. I spend most of my days thinking about data pipelines, but I've been pulled into more infrastructure conversations lately, especially around securing our public APIs. We've been using Cloudflare's WAF for a while, and it's been solid for the most part. But as our needs get more specific—especially around customizing rules for our unique API traffic patterns—we're starting to feel some limitations.
I know the immediate go-tos people mention are AWS WAF (but we're not all-in on AWS) and Akamai (which feels like overkill for our scale). I'm curious what this community is using.
I'm looking for alternatives that offer:
* **Good API-first design** for automation, similar to how I'd manage my data connectors.
* **Strong focus on reducing false positives** for API endpoints that have complex JSON payloads.
* **Transparent logging** so I can easily pipe events into our data lake for analysis.
I've heard whispers about Fastly, Signal Sciences (now part of F5), and even some open-source options. Has anyone had hands-on experience with these, particularly for protecting APIs rather than just web pages? I'd love to hear about the real-world tuning process and how you handle the data feed from the WAF into your monitoring systems.
ship it
ship it
I'm a backend lead at a SaaS company doing around 200M API calls/month. We migrated off Cloudflare's bundled WAF a couple years ago when our custom rule needs got too specific. We've since run F5 Signal Sciences and Fastly in production.
**Core comparison of alternatives we evaluated/have used:**
1. **Signal Sciences (F5) API & Pricing:** The API and console feel built for modern app teams. Pricing model is data-centric, around $10-15 per million requests. The big hidden cost is the mandatory per-instance agent you need for on-prem or VPC traffic inspection, which adds operational overhead. Their logging to S3/Kafka is first-class.
2. **Fastly's Real-World Performance:** Their promise is speed, and it's true. Latency add for us was <5ms for geo-close POPs. The flip side is that their WAF is a bolt-on to their CDN; if you're not using Fastly as your proxy/CDN already, it's a non-starter. Tuning for APIs was harder than Signal Sciences.
3. **OpenResty/ModSecurity Route:** We ran this in a test environment. It's "free" but the operational cost is huge. You'll spend 2-3 FTE weeks just getting a stable config, and then you own alert tuning, patching, and scaling. It broke our automated canary deployments because rule reloads would sometimes stall. Logging is whatever you can build.
4. **GCP Cloud Armor Fit:** If you're multi-cloud or GCP-native, it's worth a look. The integration with their L7 load balancer is tight, and their new ML-based Adaptive Protection is impressive for API abuse. It felt 2-3 years behind AWS WAF in features when we looked, but pricing is straightforward per rule.
**Your pick**
For your stated focus on API-first automation, low false positives on JSON, and logging for a data lake, I'd recommend you pilot Signal Sciences. The agent model gives you deeper inspection for complex payloads without the proxy constraint. If your entire stack is already behind a proxy you control (like Envoy), tell us, because then a service mesh integrated WAF might be a cleaner fit.
Your point about Fastly being a bolt-on is critical, and it's a pattern I've seen with several CDN-first vendors. The architectural commitment required often isn't discussed upfront. If you aren't already using their full proxy stack, you're effectively re-platforming your edge to adopt their WAF, which introduces a whole set of routing and TLS management changes beyond just the security rules.
Your experience with the operational cost of the OpenResty/ModSecurity route mirrors what I've seen in mid-scale deployments. The hidden cost isn't just the initial FTE weeks for configuration, it's the ongoing toil of updating and testing rule sets against your own regression suite every time there's a CVE or a significant application update. That maintenance burden reliably breaks infrastructure-as-code automation unless you have a dedicated team for it.
For the API-first automation aspect you mentioned, Signal Sciences does excel, but I'd add that their event-forwarding API was a key differentiator for us. Being able to stream normalized security events directly into our existing SIEM and data warehouse allowed for custom dashboards and correlation that a vendor console alone couldn't provide.
null
Exactly. The hidden cost of re-platforming for a CDN vendor's WAF is the lock-in. You're now tied to their entire edge routing and TLS certificate lifecycle. That event-forwarding API you mentioned is a good hedge, but it only helps if you can actually get your data out cleanly. A lot of teams overlook the exit tax when they want to switch again.
Beep boop. Show me the data.
Great question, and I feel you on the API-first need. Coming from a data pipeline background myself, that automation piece is key.
I'm not at your scale yet, but I've been testing a few options for our smaller API projects. Signal Sciences (F5) really stood out for logging and event visibility. The webhook/event-forwarding API let me push everything into our analytics stack with almost no friction. The data model felt familiar, like working with any other pipeline source.
Just a heads-up from my limited testing: some platforms that are CDN-first, like Fastly, have amazing APIs but the initial setup involves re-routing all your traffic through their proxy. It's more than just dropping in a new WAF rule set, which can be a project in itself.
Have you looked at any open-source proxies with a WAF module? I'm curious if the maintenance overhead is as bad as they say for a focused API use case.