IT AI Index
Index › Network and edge › WAF › Cloudflare vs AWS WAF
Web application firewalls · September 2026 Edition

Cloudflare vs AWS WAF

Three of twelve models named Cloudflare first on the direct prompt; one named AWS WAF. Cloudflare was named by eleven of the twelve models and AWS WAF by twelve and Cloudflare carries 33 labels and AWS WAF 38, so the shares are not directly comparable.

Cloudflare

endorsed leader

Named in eight categories this edition.

AWS WAF

accepted challenger

Named in two categories this edition.

First-choice share55%5%Of first choices across the direct, paraphrase, budget and scale prompts, 0 to 100.
Negative rate0%13%Negative labels as a share of the product's labels, 0 to 100.
Rank in category#1#3A position in a field of 8; printed, not drawn.
Labels3338A count; the two differ.
The two percentage rows are drawn on one 0 to 100 track, Cloudflare reading right to left. Rank and label count are printed, not drawn.Cloudflare WAF was named alongside these two in nine of the twelve direct answers. Cloudflare vs Cloudflare WAF · Cloudflare WAF vs AWS WAF

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all twelve models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the web application firewalls page.

By framing

How many of the twelve models made each the first choice, per way of asking, and how many argued against it.
CloudflareFirst choices, of twelve modelsAWS WAF
Direct311 against AWS WAF
Paraphrase110
Comparative20
Budget-constrained60
Scale-constrained41
Negative014 against AWS WAF
Bars are first choices, 0 to 12 each sideModels that argued againstA model can name both, so the two sides of a row do not sum to twelve.

The direct prompt

The plain question, one answer per model, grouped by where Cloudflare and AWS WAF stood in it.

Cloudflare first, AWS WAF an alternative

3 of 12 modelsAWS WAF was named in the answer but not as the choice, or not at all.
Mistral SmallCloudflare alternatives: Barracuda WAF
Llama 4 MaverickCloudflare alternatives: Barracuda, Fastly WAF
Qwen 3.7 FlashCloudflare alternatives: AWS WAF, Imperva

AWS WAF first, Cloudflare not the choice

1 of 12 modelsCloudflare was named in the answer but not as the choice, or not at all.
Claude Haiku 4.5AWS WAF, Cloudflare WAF alternatives: Fortinet FortiWAF

Neither was the first choice, one was named

5 of 12 modelsThe answer put something else first and named one of the two as an alternative.
GPT-5.4 miniCloudflare WAF alternatives: AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAF
Perplexity SonarCloudflare WAF alternatives: AWS WAF, Azure WAF, Barracuda Web Application Firewall
DeepSeek V4 FlashCloudflare WAF alternatives: AWS WAF, Barracuda
GLM 4.7 FlashXCloudflare WAF alternatives: AWS WAF, Barracuda, F5 BIG-IP
MiniMax M2.5Cloudflare WAF alternatives: AWS WAF, Barracuda, Imperva WAF

Neither was named

3 of 12 modelsThe answer made no first choice from these two in this category.
Gemini 3.5 FlashCloudflare WAF alternatives: Fastly Next-Gen WAF, Imperva Cloud WAF
Grok 4.1 FastCloudflare WAF alternatives: Barracuda WAF
Kimi K2Cloudflare WAF alternatives: Barracuda WAF/WAAP

Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment and they are never added together. The figures above are the mid-market standing, which is the one the category orders by.
Small business
Cloudflare leads by seventy-three points.
Cloudflare73%#1 of 8
AWS WAF0%#4 of 8
The full small business standing →
Mid-marketThe figures above
Cloudflare leads by fifty points.
Cloudflare55%#1 of 8
AWS WAF5%#3 of 8
The full mid-market standing →
Enterprise
Cloudflare leads by twenty-five points.
Cloudflare27%#1 of 11
AWS WAF2%#6 of 11
The full enterprise standing →

What the models said about Cloudflare

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. One of one in this category shown.

“Cloudflare (Application Security): Excellent for mid-market. It bundles DNS, CDN, WAF, Bot Management, and DDoS mitigation into a single control panel” Gemini 3.5 Flash · scale prompt · first choice

What the models said about AWS WAF

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of eight in this category shown.

“Out of the box, AWS WAF is essentially a blank canvas... It requires deep cloud-engineering expertise to manage, meaning high operational overhead” Gemini 3.5 Flash · direct prompt · soft negative
“Be cautious of cloud WAFs unless you configure specific rules to block or inspect oversize/padded request bodies.” Gemini 3.5 Flash · negative prompt · soft negative
“Complicated rules hard to maintain; support delays; frequent evasions (e.g., parsing bugs).” Grok 4.1 Fast · negative prompt · soft negative
“Cloudflare WAF and AWS WAF are recommended for most clients because they have low false‑positive rates” GLM 4.7 FlashX · negative prompt · first choice
“I'd suggest evaluating Cloudflare WAF or AWS WAF (if using AWS) as starting points” Claude Haiku 4.5 · direct prompt · first choice
“Fastest time-to-value | Cloudflare or AWS WAF” Kimi K2 · scale prompt · first choice
Also compared
Cloudflare vs Cloudflare WAFCloudflare WAF vs AWS WAFThe full WAF standing

Comparisons are drawn for the top three products in each category. The output is the models' output; nothing here is a recommendation by the index.