Cloudflare WAF pricing for bot protection
Cloudflare's WAF comes with every plan: Free costs $0, Pro $20 a month billed annually ($25 monthly), Business $200 ($250 monthly), Enterprise is quoted per contract. For bot protection, Free is enough for most small sites, Pro adds bot controls you can tune, Business adds regex and longer rate limits, and only Enterprise gives per-request bot scores.
Cloudflare plans and prices
Cloudflare does not sell its web application firewall (WAF) separately on the self-serve plans. You get it with the plan, and the plan decides how many rules you can write and how smart the bot detection is. Prices from Cloudflare's plans page, checked October 27, 2026:
| Plan | Price | Bot mitigation, as Cloudflare describes it |
|---|---|---|
| Free | $0 | Simple bots |
| Pro | $20/mo billed annually, $25 monthly | Easy-to-detect bots |
| Business | $200/mo billed annually, $250 monthly | Sophisticated bots, basic bot analytics |
| Enterprise | Contract, billed annually | All bots, anomaly detection, custom CAPTCHAs, advanced bot analytics |
Prices are per site (zone). Add-ons and Enterprise products such as Bot Management are priced separately. Paying annually saves $60 a year on Pro and $600 a year on Business compared with monthly billing, so if you expect to keep the plan for a year, annual billing is the cheaper choice.
WAF rules you get on each plan
For bots, two kinds of rules do most of the work: custom rules (block, challenge or skip by any condition) and rate limiting rules (act when one source sends too many requests).
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
| Custom rules | 5 | 20 | 100 | 1,000 |
| Regex in rules | No | No | Yes | Yes |
| Log action (watch without acting) | No | No | No | Yes |
| Rate limiting rules | 1 | 2 | 5 | 100 |
| Rate limiting period | 10 seconds | up to 1 minute | up to 10 minutes | up to 65,535 seconds |
| Rate limit counted by | IP | IP | IP, IP with NAT support | IP, NAT, plus headers, ASN, country, path and more with Advanced Rate Limiting |
The Enterprise rate limiting count depends on the contract. The numbers above come from Cloudflare's developer documentation for custom rules and rate limiting rules.
Bot features by plan
- Free: Bot Fight Mode. One switch for the whole domain. It challenges requests that match known bot patterns, but you cannot add exceptions, and custom rules cannot skip it. See what Bot Fight Mode blocks.
- Pro and Business: Super Bot Fight Mode. Traffic is grouped as definitely automated, likely automated and verified bots, and you choose an action for each group. Custom rules run first, so a Skip rule can exempt webhooks, APIs or partners.
- Enterprise: Bot Management. Every request gets a bot score from 1 (almost certainly automated) to 99 (likely human), which you can use in any rule. Granular scores are only available to Enterprise customers who buy Bot Management. Pro and Business only see grouped data.
Whatever the plan, Cloudflare verifies well-known bots such as Googlebot and Bingbot and marks them. Its own custom rule examples use that mark, so a rule can let them through before anything else runs:
(cf.client.bot)Use it as a Skip rule at the top of your custom rules.
Which plan you need for bot protection
| Situation | Plan | Why |
|---|---|---|
| Small site or blog, occasional scrapers | Free | 5 custom rules and one rate limit cover a skip for verified bots plus a few targeted challenges |
| Online store with webhooks, an API or a mobile app | Pro | Super Bot Fight Mode with Skip rules for the paths that must never be challenged |
| Repeated bot waves from changing networks, login or checkout abuse | Business | 100 rules, regex, 5 rate limits with periods up to 10 minutes and NAT-aware counting |
| Large store, credential stuffing, scalping, fraud | Enterprise | Bot scores per request and anomaly detection |
Most small and mid-size sites overestimate what they need. In the traffic reports we prepare, the usual problem is not a missing feature but a missing rule: one or two networks send most of the bad traffic, and a well-placed rule on Free or Pro stops it. Upgrading to Business pays off when you run out of rules or need longer rate limit windows, not before.
What upgrading will not fix
A bigger plan does not write your rules. Sites on Business still go down from bot waves when nobody looks at the traffic, and sites on Free stay stable when someone does. Three things matter more than the plan:
- A skip for verified bots first. Otherwise any new blocking rule can catch Googlebot or AdsBot.
- Rules based on your data. Which networks, user agents and paths actually cause the load. A free bot traffic report gives you that list.
- A check after every change. Look at verified search crawlers in Security Analytics after each new rule.
If you want this done for you on the plan you already have, see bot protection setup.
FAQ
Is Cloudflare WAF free?
Yes, a WAF with 5 custom rules and 1 rate limiting rule is included in the Free plan. The full Cloudflare Managed Ruleset and more rules come with Pro and above.
How much is Cloudflare Bot Management?
Bot Management is an Enterprise add-on priced per contract. Cloudflare does not publish a list price.
Can I upgrade only one site?
Yes. Plans are per zone, so you can keep most sites on Free and put one busy store on Pro or Business.
Is Pro worth it just for bots?
If you need exceptions for webhooks, an API or partners, yes: Super Bot Fight Mode supports Skip rules and Bot Fight Mode does not. If you do not, well-written custom rules on Free often do the job.