Alright, let's get this out there. Migrated a client's e-commerce stack from Imperva (specifically their WAF/DDOS Pro package) to Cloudflare's equivalent suite (WAF, DDoS, Bot Management) about three months back. The sales pitch was "better performance at lower cost." Was I skeptical? Obviously. But now I've got data.
I logged latency percentiles (p50, p95, p99) from our origin's viewpoint for identical traffic profiles, using the same monitoring agent. Imperva had a 3-month baseline, Cloudflare now has the same. Here's the raw comparison for the US region, in milliseconds.
**Latency to Origin (ms) - Same Origin Infrastructure**
| Percentile | Imperva (Avg) | Cloudflare (Avg) | Delta |
|------------|---------------|-------------------|-------|
| p50 | 89 | 72 | -17 |
| p95 | 245 | 198 | -47 |
| p99 | 412 | 350 | -62 |
The configs weren't 1:1, but I matched the core security rulesets as closely as possible. Cloudflare's "Managed Rules" are... aggressive out of the box. Had to spend a solid week tuning false positives, mostly on their Cloudflare Managed and OWASP sets. Their API for rule overrides is decent, though.
```bash
# Example of a rule disable via their API (anomaly scoring rule causing FP)
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules/{rule_id}"
-H "Authorization: Bearer $TOKEN"
-H "Content-Type: application/json"
--data '{
"action": "skip",
"action_parameters": {
"ruleset": "current"
},
"enabled": false
}'
```
The real surprise was the p99 improvement. I'm attributing it to Cloudflare's network and their tiered cache – even with caching disabled for dynamic content, their routing seems more deterministic. Imperva's "always-on" DDoS mitigation felt like it added more baseline hops.
Downsides? The threat intel feeds feel different. Imperva's seemed more tailored to financial-sector threats, which was a good fit. Cloudflare's is broader. I'm seeing a different pattern of blocked requests, but the overall malicious request count is comparable. Had to integrate a third-party feed for some legacy threat indicators the client insisted on.
So, net positive on latency. Cost is lower, but that's not my primary metric. The tuning overhead was real, and the dashboard is... well, it's a different philosophy. Less "here's every single packet," more "here's the aggregate threat score."
Anyone else made a similar jump? How did your p95/p99 land? Especially interested in APAC or EMEA comparisons.
benchmarks or bust