Web application firewalls · September 2026 Edition
Cloudflare WAF vs AWS WAF
Nine of twelve models named Cloudflare WAF first on the direct prompt; one named AWS WAF. Both were named by all twelve models and Cloudflare WAF carries 27 labels and AWS WAF 38, so the shares are not directly comparable.
Named in one category this edition.
Named in two categories this edition.
First-choice share34%5%Of first choices across the direct, paraphrase, budget and scale prompts, 0 to 100.
Negative rate11%13%Negative labels as a share of the product's labels, 0 to 100.
Rank in category#2#3A position in a field of 8; printed, not drawn.
Labels2738A count; the two differ.
The two percentage rows are drawn on one 0 to 100 track, Cloudflare WAF reading right to left. Rank and label count are printed, not drawn.Cloudflare vs Cloudflare WAF · Cloudflare vs AWS WAF
Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all twelve models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the web application firewalls page.
By framing
How many of the twelve models made each the first choice, per way of asking, and how many argued against it.
Cloudflare WAFFirst choices, of twelve modelsAWS WAF
Direct911 against AWS WAF
Paraphrase00
Comparative70
Budget-constrained60
Scale-constrained01
Negative113 against Cloudflare WAF · 4 against AWS WAF
Bars are first choices, 0 to 12 each sideModels that argued againstA model can name both, so the two sides of a row do not sum to twelve.
The direct prompt
The plain question, one answer per model, grouped by where Cloudflare WAF and AWS WAF stood in it.
Both were the first choice
1 of 12 modelsThe answer named them together, and the judge labeled each a first choice.Claude Haiku 4.5AWS WAF, Cloudflare WAF alternatives: Fortinet FortiWAF
Cloudflare WAF first, AWS WAF an alternative
8 of 12 modelsAWS WAF was named in the answer but not as the choice, or not at all.GPT-5.4 miniCloudflare WAF alternatives: AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAF
Gemini 3.5 FlashCloudflare WAF alternatives: Fastly Next-Gen WAF, Imperva Cloud WAF
Perplexity SonarCloudflare WAF alternatives: AWS WAF, Azure WAF, Barracuda Web Application Firewall
Grok 4.1 FastCloudflare WAF alternatives: Barracuda WAF
DeepSeek V4 FlashCloudflare WAF alternatives: AWS WAF, Barracuda
Kimi K2Cloudflare WAF alternatives: Barracuda WAF/WAAP
GLM 4.7 FlashXCloudflare WAF alternatives: AWS WAF, Barracuda, F5 BIG-IP
MiniMax M2.5Cloudflare WAF alternatives: AWS WAF, Barracuda, Imperva WAF
Neither was the first choice, one was named
1 of 12 modelsThe answer put something else first and named one of the two as an alternative.Qwen 3.7 FlashCloudflare alternatives: AWS WAF, Imperva
Neither was named
2 of 12 modelsThe answer made no first choice from these two in this category.Mistral SmallCloudflare alternatives: Barracuda WAF
Llama 4 MaverickCloudflare alternatives: Barracuda, Fastly WAF
Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment and they are never added together. The figures above are the mid-market standing, which is the one the category orders by.
Small business
Cloudflare WAF leads by twenty points.
Cloudflare WAF20%#2 of 8AWS WAF0%#4 of 8Mid-marketThe figures above
Cloudflare WAF leads by thirty points.
Cloudflare WAF34%#2 of 8AWS WAF5%#3 of 8Enterprise
Cloudflare WAF leads by seven points.
Cloudflare WAF9%#4 of 11AWS WAF2%#6 of 11What the models said about Cloudflare WAF
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of seven in this category shown.
“Cloudflare's WAF scored the *lowest* Security Quality (True Positive Rate) of any major vendor — around 67%” DeepSeek V4 Flash · negative prompt · soft negative
“Evasion via parsing/content-type tricks; not top in padding/large payload tests.” Grok 4.1 Fast · negative prompt · soft negative
“Cloudflare WAF | ✅ Vulnerable” Kimi K2 · negative prompt · soft negative
“The best web application firewall for a company with a limited budget is Cloudflare WAF, which offers strong protection with a generous free tier and easy setup.” Llama 4 Maverick · budget prompt · first choice
“the best default choice is usually Cloudflare WAF if you want the fastest deployment, strong protection, and low operational overhead” Perplexity Sonar · direct prompt · first choice
“Cloudflare WAF (free tier) is widely regarded as the best web application firewall for companies with a limited budget” Grok 4.1 Fast · budget prompt · first choice
What the models said about AWS WAF
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of eight in this category shown.
“Out of the box, AWS WAF is essentially a blank canvas... It requires deep cloud-engineering expertise to manage, meaning high operational overhead” Gemini 3.5 Flash · direct prompt · soft negative
“Be cautious of cloud WAFs unless you configure specific rules to block or inspect oversize/padded request bodies.” Gemini 3.5 Flash · negative prompt · soft negative
“Complicated rules hard to maintain; support delays; frequent evasions (e.g., parsing bugs).” Grok 4.1 Fast · negative prompt · soft negative
“Cloudflare WAF and AWS WAF are recommended for most clients because they have low false‑positive rates” GLM 4.7 FlashX · negative prompt · first choice
“I'd suggest evaluating Cloudflare WAF or AWS WAF (if using AWS) as starting points” Claude Haiku 4.5 · direct prompt · first choice
“Fastest time-to-value | Cloudflare or AWS WAF” Kimi K2 · scale prompt · first choice
Comparisons are drawn for the top three products in each category. The output is the models' output; nothing here is a recommendation by the index.