IT AI Index
Index › Network and edge › WAF › Cloudflare vs Cloudflare WAF
Web application firewalls · September 2026 Edition

Cloudflare vs Cloudflare WAF

Three of twelve models named Cloudflare first on the direct prompt; nine named Cloudflare WAF. Cloudflare was named by eleven of the twelve models and Cloudflare WAF by twelve and Cloudflare carries 33 labels and Cloudflare WAF 27, so the shares are not directly comparable.

Cloudflare

endorsed leader

Named in eight categories this edition.

Cloudflare WAF

endorsed leader

Named in one category this edition.

First-choice share55%34%Of first choices across the direct, paraphrase, budget and scale prompts, 0 to 100.
Negative rate0%11%Negative labels as a share of the product's labels, 0 to 100.
Rank in category#1#2A position in a field of 8; printed, not drawn.
Labels3327A count; the two differ.
The two percentage rows are drawn on one 0 to 100 track, Cloudflare reading right to left. Rank and label count are printed, not drawn.AWS WAF was named alongside these two in seven of the twelve direct answers. Cloudflare vs AWS WAF · Cloudflare WAF vs AWS WAF

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all twelve models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the web application firewalls page.

By framing

How many of the twelve models made each the first choice, per way of asking, and how many argued against it.
CloudflareFirst choices, of twelve modelsCloudflare WAF
Direct39
Paraphrase110
Comparative27
Budget-constrained66
Scale-constrained40
Negative013 against Cloudflare WAF
Bars are first choices, 0 to 12 each sideModels that argued againstA model can name both, so the two sides of a row do not sum to twelve.

The direct prompt

The plain question, one answer per model, grouped by where Cloudflare and Cloudflare WAF stood in it.

Cloudflare first, Cloudflare WAF not the choice

3 of 12 modelsCloudflare WAF was named in the answer but not as the choice, or not at all.
Mistral SmallCloudflare alternatives: Barracuda WAF
Llama 4 MaverickCloudflare alternatives: Barracuda, Fastly WAF
Qwen 3.7 FlashCloudflare alternatives: AWS WAF, Imperva

Cloudflare WAF first, Cloudflare not the choice

9 of 12 modelsCloudflare was named in the answer but not as the choice, or not at all.
Claude Haiku 4.5AWS WAF, Cloudflare WAF alternatives: Fortinet FortiWAF
GPT-5.4 miniCloudflare WAF alternatives: AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAF
Gemini 3.5 FlashCloudflare WAF alternatives: Fastly Next-Gen WAF, Imperva Cloud WAF
Perplexity SonarCloudflare WAF alternatives: AWS WAF, Azure WAF, Barracuda Web Application Firewall
Grok 4.1 FastCloudflare WAF alternatives: Barracuda WAF
DeepSeek V4 FlashCloudflare WAF alternatives: AWS WAF, Barracuda
Kimi K2Cloudflare WAF alternatives: Barracuda WAF/WAAP
GLM 4.7 FlashXCloudflare WAF alternatives: AWS WAF, Barracuda, F5 BIG-IP
MiniMax M2.5Cloudflare WAF alternatives: AWS WAF, Barracuda, Imperva WAF

Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment and they are never added together. The figures above are the mid-market standing, which is the one the category orders by.
Small business
Cloudflare leads by fifty-two points.
Cloudflare73%#1 of 8
Cloudflare WAF20%#2 of 8
The full small business standing →
Mid-marketThe figures above
Cloudflare leads by twenty points.
Cloudflare55%#1 of 8
Cloudflare WAF34%#2 of 8
The full mid-market standing →
Enterprise
Cloudflare leads by eighteen points.
Cloudflare27%#1 of 11
Cloudflare WAF9%#4 of 11
The full enterprise standing →

What the models said about Cloudflare

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. One of one in this category shown.

“Cloudflare (Application Security): Excellent for mid-market. It bundles DNS, CDN, WAF, Bot Management, and DDoS mitigation into a single control panel” Gemini 3.5 Flash · scale prompt · first choice

What the models said about Cloudflare WAF

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of seven in this category shown.

“Cloudflare's WAF scored the *lowest* Security Quality (True Positive Rate) of any major vendor — around 67%” DeepSeek V4 Flash · negative prompt · soft negative
“Evasion via parsing/content-type tricks; not top in padding/large payload tests.” Grok 4.1 Fast · negative prompt · soft negative
“Cloudflare WAF | ✅ Vulnerable” Kimi K2 · negative prompt · soft negative
“The best web application firewall for a company with a limited budget is Cloudflare WAF, which offers strong protection with a generous free tier and easy setup.” Llama 4 Maverick · budget prompt · first choice
“the best default choice is usually Cloudflare WAF if you want the fastest deployment, strong protection, and low operational overhead” Perplexity Sonar · direct prompt · first choice
“Cloudflare WAF (free tier) is widely regarded as the best web application firewall for companies with a limited budget” Grok 4.1 Fast · budget prompt · first choice
Also compared
Cloudflare vs AWS WAFCloudflare WAF vs AWS WAFThe full WAF standing

Comparisons are drawn for the top three products in each category. The output is the models' output; nothing here is a recommendation by the index.