WAF + CDN

WAF + CDN Bundles 2026 Verified: Cloudflare Bundled, AWS $5/mo + $0.60/Million

The CDN vs WAF split changes which vendor is cheapest. Cloudflare bundles WAF into Pro+; AWS, Fastly, Bunny, KeyCDN meter separately. Akamai bundles into enterprise quotes.

Verified 17 June 2026

Direct answer

Which CDNs include WAF in the per-GB price?

Cloudflare Pro ($25/mo) and above include managed WAF rules. AWS WAF is $5/mo per Web ACL + $1/rule + $0.60 per million requests on top of CloudFront. Fastly Next-Gen WAF (Signal Sciences) is quote-driven. Akamai bundles Kona/App and API Protector into enterprise. Bunny and KeyCDN offer no first-party WAF.

Bundled (one SKU)

Cloudflare Pro $25/mo: managed WAF rules, OWASP, basic DDoS, free SSL.
Cloudflare Business $250/mo: adds custom WAF rules, image polish, prioritized SLA.
Cloudflare Enterprise: adds Bot Management, API Shield, custom contract terms (quote).

Metered separately

AWS WAF: $5/mo per Web ACL + $1/rule + $0.60 per million requests.
AWS Bot Control: $1 per million Bot Control requests + standard WAF fees.
Fastly Next-Gen WAF: quote-driven; commonly $4-$6 per million requests on enterprise.
Bunny: no first-party WAF; use Cloudflare in front or origin-level WAF.
KeyCDN: no first-party WAF.

Bundled into enterprise quote

Akamai: Kona Site Defender, Bot Manager, API Security included in enterprise contracts.
Edgio (continuity uncertain): historically bundled WAF + delivery; confirm current state.
Azure Front Door Premium: includes WAF and Bot Protection at higher per-GB rate than Standard.

Last verified June 2026.