Plans and Editions
Last updated:2026-03-13 16:06:36
Web Application Firewall (WAF) supports two payment models: yearly/monthly subscription (prepaid only) and yearly/monthly subscription with elastic postpaid (hybrid billing). It is available in two instance types: SaaS and CLB instances. This document describes the features supported under different WAF instance types and subscription plans.
SaaS WAF Instance (Non-Mainland China Region)
Feature | Item | Premium | Enterprise | Ultimate |
Plan Basic Information | Applicable Scenario | Standard protection for small and medium-sized non-business websites. | Custom Protection Service for Small and Medium-sized Ordinary Business Sites and Medium and Large-sized Official Websites | Custom Protection Service for Large and Extra-large Business Websites and Complex Business Sites |
| QPS Peak Note: If you need custom specifications, please contact your business manager or architect. | Plan Default QPS: 2,500 QPS Supports business expansion package to extend QPS: 5,000 QPS. | Plan Default QPS: 5,000 QPS Supports business expansion package to extend QPS: 10,000 QPS. | Plan Default QPS: 10,000 QPS Supports business expansion package to extend QPS: 20,000 QPS. |
| Peak Bandwidth Note: If you need custom specifications, please contact your business manager or architect. | Plan Default Bandwidth: 50 Mbps Supports business expansion package to extend bandwidth: 125 Mbps. | Plan Default Bandwidth: 100 Mbps Supports business expansion package to extend bandwidth: 250 Mbps. | Plan Default Bandwidth: 200 Mbps Supports Business Extension Package to extend bandwidth: 500 Mbps. |
| Dedicated IP | Supported. | Supported | Supported |
| Supports primary domains | 2 | 3 | 4 |
| Supports the total number of domains (including primary domains and their subdomains) | 20 | 30 | 40 |
| Wildcard Domain Protection | Not supported | Supported | Supported |
| IPv6 Protection | Not supported | Supported | Supported |
Access management | Access port support | Support access via standard ports 80, 8080, 443, and 8443. | In addition to standard ports, protection for specific ranges of non-standard ports services is supported, with a limit of 5/domain/protocol type. | In addition to standard ports, protection for specific ranges of non-standard ports services is supported, with a limit of 10/domain/protocol type. |
| Dedicated IP address | Supported. | Supported | Supported |
| Traffic tagging | Not supported | Supported | Supported |
| Client information transmission. | Not supported | Supported | Supported |
| HTTP2/WebSocket | Supported. | Supported | Supported |
Basic security protection | Rule protection engine. | Supported. | Supported | Supported |
| 0Day vulnerability virtual patching. | Supported. | Supported | Supported |
| Custom Allow Rule | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Rule allowlist. | 200 entries/domain | 400 entries/domain | 500 entries/domain |
| IP Blocklist/Allowlist | 1000 entries/domain | 5000 entries/domain | 20000 entries/domain |
| Regional Blocking | Supported. | Supported | Supported |
| Access Control (Custom Policy) | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Emergency Mode CC Protection | Supported. | Supported | Supported |
| Custom CC protection based on IP address/Session | 5 entries/domain | 20 entries/domain | 50 entries/domain |
| Data leakage prevention | 5 entries/domain | 10 entries/domain | 50 entries/domain |
| Webpage anti-tampering | 10 entries/domain | 20 entries/domain | 50 entries/domain |
| Batch protection | Not supported | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. |
| Advanced Vulnerability Protection feature (AI Engine) | Not supported | Not supported | Not supported |
Advanced Value-Added Security Protection | BOT Traffic Management | Paid Support | Paid Support | Paid Support |
| API Security | Paid Support | Paid Support | Paid Support |
| Business Security | Paid Support | Paid Support | Paid Support |
Log management | Search for and download attack logs | Supported. | Supported | Supported |
| Attack log shipping | Not supported | Supported | Supported |
| Storage of attack logs for all attack types | Supported. | Supported | Supported |
| Access log shipping | Paid Support | Paid Support | Paid Support |
| Access log search and download (requires purchase of log package) | Supported. | Supported | Supported |
Professional Services | One-on-one Pre-sales Support Service | Not supported | Supported | Supported |
| Support for WeChat or WeCom groups | 5*8 hours | 7*12 hours | 7*12 hours |
| 7*24-hour ticket support for pre-sales and post-sales | Supported. | Supported | Supported |
CLB WAF Instance (Non-Mainland China Region）
Feature | Item | Premium | Enterprise | Ultimate |
Plan Basic Information | Applicable Scenario | Standard protection for small and medium-sized non-business websites. | Customized protection services for small to medium general business sites and large official websites. | Customized protection services for large and extra-large business websites and complex business sites. |
| QPS Peak Note: If you need custom specifications, please contact your business manager or architect. | Plan Default QPS: 2,500 QPS Supports business expansion package to extend QPS: 10,000 QPS. | Plan Default QPS: 5,000 QPS. Supports Business Expansion Package to Extend QPS: 20,000 QPS. | Plan Default QPS: 10,000 QPS Business expansion package supports QPS expansion: 40,000 QPS. |
| Cross-region collaboration support | Not supported | Not supported | supports 10 regions. |
| Number of bound CLB listeners | 200 | 300 | 500 |
| Supports primary domains | 2 | 3 | 4 |
| Supports the total number of domains (including protected primary domains and their subdomains). | 20 | 30 | 40 |
| Wildcard domains supported | Not supported | Supported | Supported |
| IPv6 Protection | Supported. | Supported | Supported |
Access management | Object access | Not supported | Supported | Supported |
Basic security protection. | Rule protection engine. | Supported. | Supported | Supported |
| 0Day vulnerability virtual patching. | Supported. | Supported | Supported |
| Custom Allow Rule | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Rule allowlist. | 200 entries/domain | 400 entries/domain | 500 entries/domain |
| IP Blocklist/Allowlist | 1000 entries/domain | 5000 entries/domain | 20000 entries/domain |
| Regional Blocking | Supported. | Supported | Supported |
| Access Control (Custom Policy) | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Custom CC protection based on IP address/Session | 5 entries/domain | 20 entries/domain | 50 entries/domain |
| Batch protection | Not supported | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. |
| Advanced Vulnerability Protection feature (AI Engine) | Not supported | Not supported | Not supported |
Advanced Value-Added Security Protection | BOT Traffic Management | Paid Support | Paid Support | Paid Support |
| API Security | Paid Support | Paid Support | Paid Support |
Log management | Search for and download attack logs | Supported. | Supported | Supported |
| Attack log shipping | Not supported | Supported | Supported |
| Storage of attack logs for all attack types | Supported. | Supported | Supported |
| Access log shipping | Paid Support | Paid Support | Paid Support |
| Access log search and download (requires purchase of log package) | Supported. | Supported | Supported |
Professional Services | Mutual certificate authentication | Supported. | Supported | Supported |
| One-on-one Pre-sales Support Service | Not supported | Supported | Supported |
| Support for WeChat or WeCom groups | 5*8 hours | 7*12 hours | 7*12 hours |
| 7*24-hour ticket support for pre-sales and post-sales | Supported. | Supported | Supported |
SaaS WAF Instance (Mainland China Region)
Feature | Item | Premium | Enterprise | Ultimate |
Plan Basic Information | Applicable Scenario | Standard protection for small and medium-sized non-business websites. | Customized protection services for small to medium general business sites and large official websites. | Customized protection services for large and extra-large business websites and complex business sites. |
| QPS Peak Note: If you require customized specifications, please reach out to your Account Manager or Solution Architect. | Plan Default QPS: 2,500 QPS Supports Business Expansion Package to Extend QPS: 20,000 QPS. Supports elastic postpaid to extend QPS: 100,000 QPS. | Plan Default QPS: 5,000 QPS Supports business expansion package to extend QPS: 30,000 QPS. Supports elastic postpaid to extend QPS: 150,000 QPS. | Plan Default QPS: 10,000 QPS Supports Business Extension Package to Extend QPS: 40,000 QPS. Supports Elastic Postpaid Extension QPS: 200,000 QPS. |
| Peak Bandwidth Note: If you require customized specifications, please reach out to your Account Manager or Solution Architect. | Plan Default Bandwidth: 50 Mbps Supports Business Extension Package to extend bandwidth: 500 Mbps. | Plan Default Bandwidth: 100 Mbps Supports Business Extension Package to Extend Bandwidth: 750 Mbps. | Plan Default Bandwidth: 200 Mbps Supports Business Extension Package to Extend Bandwidth: 1,000 Mbps. |
| Dedicated IP address | Supported. | Supported | Supported |
| Supports primary domains | 2 | 3 | 4 |
| Supports the total number of domains (including primary domains and their subdomains) | 20 | 30 | 40 |
| Wildcard Domain Protection | Not supported | Supported | Supported |
| IPv6 Protection | Not supported | Supported | Supported |
Access management | Access port support | Support access via standard ports 80, 8080, 443, and 8443. | In addition to standard ports, protection for specific ranges of non-standard ports services is supported, with a limit of 5/domain/protocol type. | In addition to standard ports, protection for specific ranges of non-standard ports services is supported, with a limit of 10/domain/protocol type. |
| Dedicated IP address | Supported. | Supported | Supported |
| Traffic tagging | Not supported | Supported | Supported |
| Client information transmission. | Not supported | Supported | Supported |
| HTTP2/WebSocket | Supported. | Supported | Supported |
Basic security protection. | Rule protection engine. | Supported. | Supported | Supported |
| 0Day vulnerability virtual patching. | Supported. | Supported | Supported |
| Custom Allow Rule | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Rule allowlist. | 200 entries/domain | 400 entries/domain | 500 entries/domain |
| IP Blocklist/Allowlist | 1000 entries/domain | 5000 entries/domain | 20000 entries/domain |
| Origin return concurrent long connections | No limit | No limit | No limit |
| Regional Blocking | Supported. | Supported | Supported |
| Access Control (Custom Policy) | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Emergency Mode CC Protection | Supported. | Supported | Supported |
| Custom CC protection based on IP address/Session | 5 entries/domain | 20 entries/domain | 50 entries/domain |
| Data leakage prevention | 5 entries/domain | 10 entries/domain | 50 entries/domain |
| Webpage anti-tampering | 10 entries/domain | 20 entries/domain | 50 entries/domain |
| Batch protection | Not supported | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. |
| Advanced Vulnerability Protection feature (AI Engine) | Not supported | Not supported | Supported |
Advanced Value-Added Security Protection | BOT Traffic Management | Paid Support | Paid Support | Paid Support |
| API Security | Paid Support | Paid Support | Paid Support |
| Business Security | Paid Support | Paid Support | Paid Support |
Log management | Search for and download attack logs | Supported. | Supported | Supported |
| Attack log shipping | Not supported | Supported | Supported |
| Storage of attack logs for all attack types | Supported. | Supported | Supported |
| Access log shipping | Paid Support | Paid Support | Paid Support |
| Access log search and download (requires purchase of log package) | Supported. | Supported | Supported |
Professional Services | One-on-one Pre-sales Support Service | Not supported | Supported | Supported |
| Support for WeChat or WeCom groups | 5*8 hours | 7*12 hours | 7*12 hours |
| 7*24-hour ticket support for pre-sales and post-sales | Supported. | Supported | Supported |
CLB WAF Instance (Mainland China Region)
Feature | Item | Premium | Enterprise | Ultimate |
Plan Basic Information | Applicable Scenario | Standard protection for small and medium-sized non-business websites. | Customized protection services for small to medium general business sites and large official websites. | Customized protection services for large and extra-large business websites and complex business sites. |
| QPS Peak Note: If you require customized specifications, please reach out to your Account Manager or Solution Architect. | Plan Default QPS: 2,500 QPS Business expansion package supports QPS expansion: 40,000 QPS. Elastic postpaid expansion supports QPS up to 200,000 QPS. | Plan Default QPS: 5,000 QPS Business expansion package supports QPS expansion up to 60,000 QPS. Elastic postpaid expansion supports QPS up to 300,000 QPS. | Plan Default QPS: 10,000 QPS Business expansion package supports QPS expansion up to 80,000 QPS. Elastic postpaid expansion supports QPS up to 400,000 QPS. |
| Cross-region collaboration support | Not supported | Not supported | supports 10 regions |
| Number of bound CLB listeners | 200 | 300 | 500 |
| Supports primary domains | 2 | 3 | 4 |
| Supports the total number of domains (including protected primary domains and their subdomains) | 20 | 30 | 40 |
| Wildcard domains supported | Not supported | Supported | Supported |
| IPv6 Protection | Supported. | Supported | Supported |
Access management | Object access | Not supported | Supported | Supported |
Basic security protection. | Rule protection engine. | Supported. | Supported | Supported |
| 0Day vulnerability virtual patching. | Supported. | Supported | Supported |
| Custom Allow Rule | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Rule allowlist. | 200 entries/domain | 400 entries/domain | 500 entries/domain |
| IP Blocklist/Allowlist | 1000 entries/domain | 5000 entries/domain | 20000 entries/domain |
| Regional Blocking | Supported. | Supported | Supported |
| Access Control (Custom Policy) | 100 entries/domain | 120 entries/domain | 150 entries/domain |
| Custom CC protection based on IP address/Session | 5 entries/domain | 20 entries/domain | 50 entries/domain |
| Batch protection | Not supported | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. | The maximum number of rules supported is limited by the domain name quotas, meaning batch protection rules occupy the rule configuration quota for a single domain. |
| Advanced Vulnerability Protection feature (AI Engine) | Not supported | Not supported | Supported |
Advanced Value-Added Security Protection | BOT Traffic Management | Paid Support | Paid Support | Paid Support |
| API Security | Paid Support | Paid Support | Paid Support |
Log management | Search for and download attack logs | Supported. | Supported | Supported |
| Attack log shipping | Not supported | Supported | Supported |
| Storage of attack logs for all attack types | Supported. | Supported | Supported |
| Access log shipping | Paid Support | Paid Support | Paid Support |
| Access log search and download (requires purchase of log package) | Supported. | Supported | Supported |
Professional Services | Mutual certificate authentication | Supported. | Supported | Supported |
| One-on-one Pre-sales Support Service | Not supported | Supported | Supported |
| Support for WeChat or WeCom groups | 5*8 hours | 7*12 hours | 7*12 hours |
| 7*24-hour ticket support for pre-sales and post-sales | Supported. | Supported | Supported |
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No
Feedback