Subscription is a prepaid billing method suitable for scenarios with stable, predictable resource requirements or long-term protection needs. Compared with pay-as-you-go, subscription offers lower unit prices and helps reduce your web application security costs. This topic describes the billing rules for subscription WAF.
Billing principles
Subscription WAF charges consist of base service fees and value-added service fees:
Base service fee (required): Charged based on the default protection capabilities provided by your selected WAF edition (such as Pro or Enterprise). This is a prepaid item.
Value-added service fee (optional): Used to enable additional features or expand default specifications when the default WAF protection capabilities cannot meet your business needs. Specifically:
Burst QPS (Pay-As-You-Go), Bot Management: Risk Identification and Extension Plugin Traffic are billed based on actual monthly usage (pay-as-you-go);
All other value-added services use the prepaid model.
Billing items
Edition feature differences: The following describes the pricing for each billing item of subscription WAF. For the feature differences across WAF editions, see Version Guide.
Price changes: The prices of the products and services listed below are subject to change. Your final billing amount is based on your Alibaba Cloud bill.
Base service fees
Subscription edition | Unit price |
Basic Edition | CNY 980/month |
Pro Edition | CNY 3,880/month |
Enterprise Edition | CNY 9,800/month |
Ultimate Edition | CNY 29,800/month |
Value-added service fees (prepaid)
You can get a free 7-day trial of Bot Management – Web Protection, Bot Management – App Protection, and API Security with the Pro, Enterprise, or Ultimate Edition. The trial period starts from the time you enable the feature. After the trial ends, if you do not purchase the official version, the related protection configurations are automatically cleared.
Billing item | Unit price |
API Security(legacy) |
|
API Security Premium |
Note API Security Premium will launch on July 31, 2026. After this date, Legacy API Security will enter a maintenance period. You can continue to use the legacy version. Your existing features will not be affected. We recommend upgrading to API Security Premium as soon as possible to benefit from more comprehensive mitigation capabilities. For more information, see WAF API Security module upgrade. |
Bot Management - Web Application Protection |
Note WAF has launched a new Bot Management feature. If you have purchased the legacy Bot Management subscription service, you can continue to renew at the legacy price. For details, see [Announcement] Major Bot Management Upgrade and Pricing Update. |
Bot Management - App Protection |
|
Peak Traffic Throttling | CNY 8,000/month. |
Additional QPS | WAF in the Chinese mainland:
WAF outside the Chinese mainland:
Note
|
CNAME Record: Additional Domains | Tiered pricing based on the cumulative number of purchased domain names:
|
CNAME Record: Exclusive IP | CNY 200/domain/month |
CNAME Record: Intelligent Load Balancing | CNY 1,000/instance/month |
Log Service | CNY 500/TB/month Important After enabling the Log Service feature, the minimum purchasable log storage capacity is 3 TB. |
Multi-cloud/Hybrid-cloud WAF Extension Nodes (not supported by Pro Edition) | Tiered pricing based on the cumulative number of extension nodes:
Note If your business is deployed in multi-cloud, on-premises IDC, private network, or proprietary cloud environments, and you cannot connect to the public cloud WAF through CNAME but still need WAF protection capabilities, you can purchase multi-cloud/hybrid-cloud protection extension nodes to achieve protection through local WAF. The protection capabilities are differentiated by deployment mode as follows:
|
Multi-cloud/Hybrid-cloud Bot Nodes | Tiered pricing based on the cumulative number of extension nodes:
Note To enable Bot protection in a multi-cloud/hybrid-cloud cluster, purchase this number of nodes. |
Multi-cloud/Hybrid-cloud API Security Nodes | Tiered pricing based on the cumulative number of extension nodes:
Note To enable API security protection in a multi-cloud/hybrid-cloud cluster, purchase this number of nodes. |
Extension Plugins (not supported by Pro Edition) | Includes 3 plugin quotas,CNY 8,000/month. |
Critical Event Protection | Major Event Support must be enabled separately after purchasing a WAF instance. It takes effect immediately upon enabling (the effective time is independent of the WAF instance purchase time). For more information, see Major Event Support. |
Value-added service fees (pay-as-you-go)
Pay-as-you-go features may cause an overdue payment in your account. An overdue payment will affect the normal use of WAF. Monitor your costs and handle overdue payments promptly. For handling methods and detailed instructions, see Overdue payments.
Billing item | Unit price |
Bot Management: Risk Identification | Billed per hit. The unit price is CNY 0.05/hit. Note If you enable Fraud Detection but do not configure rules, or if rules are configured but no traffic matches the rules, no charges apply. |
Extension Plugin Traffic | After the Extension Plugin feature is enabled, traffic fees are charged based on the number of requests. The unit price is CNY 0.05/7,500 requests. |
Burst QPS (Pay-As-You-Go) | For detailed billing information, see Elastic pay-as-you-go. |
When you enable WAF protection for an ALB instance, in addition to the WAF charges described above, ALB will also incur charges. For more information, see Enable WAF protection for ALB.
Billing cycle
The billing cycle for the prepaid portion of subscription is the purchase cycle of the order (based on UTC+8 time). The start point of a billing cycle is the time when you enable or renew the resource (accurate to the second), and the end point is 00:00:00 on the day following the expiration date.
The pay-as-you-go portion of value-added services is settled once per day (based on UTC+8 time). A new settlement cycle begins after settlement.
The billing cycle of subscription in years or months refers to calendar years and calendar months.
The billing cycle for Major Event Support starts from the time of activation and ends at the revert time selected during activation.
Pay-as-you-go fees are generally settled in the early morning. If you need to make feature changes (such as adding domain names or enabling new protection features), it is recommended to do so after 06:00 daily. Otherwise, the changes may be counted in the previous day's bill.
If your account's available quota (including Alibaba Cloud account balance and vouchers) is less than the bill to be settled, you will receive an SMS or email notification about insufficient balance.
Instance expiration
The specific expiration rules for subscription WAF instances are as follows:
Reminders before expiration: The system will send renewal reminders via SMS or email 15, 7, 3, and 1 day before the instance expires.
Impact of expiration: If you do not complete renewal before the instance expires, the configured content in WAF will be retained for 15 days after expiration.
If you renew within 15 days, the original configuration continues to take effect.
If you do not renew within 15 days, the relevant configurations will be automatically released by the system on the 16th day, and the protection service is immediately terminated. If you want to continue using WAF, you must purchase a new instance and reconfigure it.
ImportantFor domains connected via CNAME, the CNAME record will be deleted by Alibaba Cloud when the configurations are released. If you have not yet changed the domain's DNS resolution back to the origin server, the domain will become inaccessible.
To avoid service interruption, renew promptly based on system notifications.
View bills
If you want to view the specific cost details generated by subscription instances and value-added services, as well as the actual usage of pay-as-you-go features, on the WAF 3.0 bill management page, see View bills.
FAQ
What is the difference between edition-included QPS, QPS extension, and elastic pay-as-you-go QPS?
The QPS processing capacity of WAF is the sum of edition-included QPS, Additional QPS, and Burst QPS (Pay-As-You-Go).
Billing item | Description |
QPS Included in Edition | Subscription WAF provides a certain amount of QPS processing capacity by default. For the specific values, see QPS limits by edition. |
Additional QPS | Suitable for scenarios where the required QPS is consistently higher than the edition-included QPS for the long term, and you do not need to upgrade the WAF edition. Uses the prepaid model. |
Burst QPS (Pay-As-You-Go) | This feature is enabled by default and cannot be disabled. When the actual business traffic exceeds the sum of purchased edition-included QPS and Additional QPS, the excess portion is billed on a pay-as-you-go basis. This feature is suitable for scenarios with high traffic fluctuation and bursty traffic. |
What is the maximum QPS that a subscription WAF instance can handle?
1. QPS billing and processing mechanism
Purchased QPS: Composed of edition-included QPS and Additional QPS.
Burst QPS (Pay-As-You-Go): When the actual business traffic exceeds the purchased QPS, the excess portion automatically triggers the Burst QPS (Pay-As-You-Go) feature and is billed on a pay-as-you-go basis.
2. Maximum protection water level
The sum of edition-included QPS, Additional QPS, and Burst QPS (Pay-As-You-Go) is subject to the maximum protection water level limit. The specific standards are divided by the region where the instance is located:
WAF instances in the Chinese mainland: Maximum protection water level is 100,000 QPS.
WAF instances outside the Chinese mainland: Maximum protection water level is 50,000 QPS.
If the actual QPS exceeds the maximum protection water level above, WAF will no longer guarantee the service level agreement (SLA). Protected objects connected to this instance may experience abnormal business access at any time, including but not limited to packet loss, rate limiting, connection limits, protection failure, abnormal logs or report data, and access timeouts. If you estimate that the business peak may exceed the maximum protection water level, contact your account manager for capacity expansion.