WAF

The WAF is one of the platform’s best-value products. Managed rulesets are often updated the same day a CVE appears, and custom rules use the wirefilter expression language found elsewhere on the platform. Free plans get a useful baseline, while paid plans get the full rulesets.

Custom rules are the highlight. The expression builder is pleasant, and one rule can combine bot scores, ASNs, JA4 fingerprints, headers, and URI patterns. That can replace whole categories of application code.

It loses a point for debugging. Tracing why a legitimate request was challenged or blocked through Security Events can feel like archaeology, and false positives on webhook traffic have caught me more than once. Nothing else comes close for the price.