Web Application Firewall (WAF) 3.0 offers two billing methods: subscription and pay-as-you-go. A subscription instance is ideal for long-term, stable workloads with a predictable budget. The pay-as-you-go method is better for short-term or temporary services with fluctuating usage. This topic describes the use cases, billable items, billing cycles, and activation methods for both billing options to explain how WAF billing works.
Billing methods
WAF 3.0 offers subscription and pay-as-you-go billing methods.
Billing attribute | Subscription | Pay-as-you-go |
How to activate | ||
Billing method | Pre-paid. You pay for resources before you use them. You are charged based on the subscription duration of your order. | Post-paid. You use resources first and pay for them later. Bills are generated based on your actual usage, and fees are deducted from your account balance each billing cycle. You can pair this with a pre-paid SeCU resource plan to reduce costs. |
Use cases |
|
|
Billable item Important
|
|
|
Billing cycle | The billing cycle is the subscription duration that you select when you purchase the instance. | Pay-as-you-go fees are settled daily (UTC+8). After settlement, a new billing cycle begins and continues until you terminate the WAF service. |
Billing unit | CNY | SeCU Note SeCU is the unified unit of measurement for pay-as-you-go WAF 3.0. 1 SeCU is equivalent to CNY 0.05. |
Critical event protection fee | This fee covers the critical event protection feature and its effective duration. It is pre-paid with a minimum subscription of 30 days. For details on critical event protection and its billing, see Critical event protection. | |
Details | ||
Billing process
The following sections explain the billing processes for subscription and pay-as-you-go WAF services.
Pay-as-you-go
The following diagram illustrates the billing lifecycle management for a pay-as-you-go instance.
Activate WAF service
Go to the Web Application Firewall 3.0 (Pay-as-you-go) buy page and activate a pay-as-you-go WAF instance. We recommend that you set a traffic billing protection threshold during purchase.
Go to the WAF 3.0 SeCU Resource Plan buy page to purchase a SeCU resource plan to offset request processing fees and feature fees, thereby reducing your costs.
To avoid unexpected high costs from traffic surges, we recommend that you set a traffic fee protection threshold when you activate the pay-as-you-go service. You can also manually set the traffic billing protection threshold at any time after activation.
Onboard to WAF
Fees for the critical event protection feature and its effective duration are pre-paid. For billing details, see Critical event protection.
The fees for a pay-as-you-go WAF instance primarily include request processing fees and feature fees. For billing details, see Pay-as-you-go billing.
Sandbox
If an instance enters the sandbox and its peak queries per second (QPS) in the next hour falls below the Traffic Billing Protection Threshold, the pay-as-you-go instance automatically exits the sandbox. You can also manually set the traffic billing protection threshold to prevent the instance from entering the sandbox again.
Billing and payment
You can offset fees with a SeCU resource plan or pay from your account balance.
NoteAfter a SeCU resource plan is depleted or expires, fees are automatically deducted from your account balance. A SeCU resource plan can be used for deductions only when your account has no overdue payments.
You can view daily bills and billing details.
Overdue payments
If your Alibaba Cloud account has overdue payments and you want to continue using pay-as-you-go services, go to the User Center to add funds promptly. For information on resource status after a payment is overdue, see Overdue payments.
Deactivate WAF
If you no longer need a pay-as-you-go WAF instance and it has received few or no requests in the last two days, you can release the instance. Before you do so, ensure that your data is backed up or migrated and that your business will not be affected. Billing stops the day after you release the instance (T+1). For instructions on how to release a pay-as-you-go instance, see Release a pay-as-you-go instance.
If you purchased a SeCU resource plan to offset fees for a pay-as-you-go instance, you can apply for a refund by submitting a ticket, if the plan was purchased within the last five days and has not been used.
Subscription
The following diagram illustrates the billing lifecycle management for a subscription instance.
Activate WAF service
Go to the Web Application Firewall 3.0 (Subscription) buy page to select a suitable WAF edition.
Risk identification and burstable QPS (pay-as-you-go) features are post-paid and currently available only for the Pro, Enterprise, and Ultimate editions. We recommend that you configure QPS extensions and burstable QPS when activating a subscription to prevent your instance from entering the sandbox if its peak QPS exceeds the current specification.
Onboard to WAF
Fees for the critical event protection feature and its effective duration are pre-paid. For billing details, see Critical event protection.
The fees for a subscription WAF instance primarily include basic service fees (required) and value-added service fees (optional). For billing details, see Subscription billing.
Sandbox
If your instance enters the sandbox, you must upgrade the edition, purchase a QPS extension, or enable burstable QPS (pay-as-you-go) to remove the instance from the sandbox.
Upgrades and downgrades
WAF allows you to upgrade an instance or downgrade an instance. This lets you modify your purchased WAF edition and value-added features to adapt to business changes.
View bills
You can view daily bills and billing details.
Overdue payments and renewal
Overdue payments: If your Alibaba Cloud account has overdue payments, you can continue to use your existing pre-paid subscription WAF service. However, you cannot perform operations that incur new fees, such as using post-paid features like risk identification and burstable QPS (pay-as-you-go), upgrading the instance configuration, or renewing your subscription. For information on resource status after a payment is overdue, see Overdue payments.
Renewal: You can choose to renew manually or enable auto-renewal. For specific steps, see Renewal.
Release instance
If your instance has expired and you no longer use WAF, you can release the instance. For rules and steps on how to release a subscription instance, see Release a subscription WAF instance.
Change billing method
Subscription to pay-as-you-go: Direct conversion is not supported. You can release the subscription WAF instance after it expires and then activate a new pay-as-you-go instance. For more details, see Change billing method.
Pay-as-you-go to subscription: Direct conversion is not supported. You can terminate the pay-as-you-go WAF instance and then purchase a new subscription WAF instance. For more details, see Change billing method.
Renewal
If a subscription WAF instance is not renewed on time, your website protection will be affected. To prevent service interruption, you must manually renew the instance or set up auto-renewal before it expires. If you need to renew your WAF instance, see Subscription renewal.
A pay-as-you-go WAF instance is a post-paid service billed based on actual usage and does not require renewal.
A SeCU resource plan cannot be renewed or upgraded directly. You can purchase multiple plans or a new plan with a larger specification. For instructions on how to purchase a plan, see Purchase a SeCU resource plan.
Release instance
If you no longer use WAF, you can release a subscription instance, terminate a pay-as-you-go service, or unsubscribe from a SeCU resource plan, provided that the requirements for release are met. For rules and steps on how to release WAF resources, see Release a WAF instance.
If you have activated a subscription instance with multi-cloud/hybrid cloud protection, Bot Management for Web, Bot Management for App, critical event protection, or API Security, you cannot release the instance through the console. To release the instance, submit a ticket or contact your account manager.
If you purchased a SeCU resource plan to offset fees for a pay-as-you-go instance, you can apply for a refund by submitting a ticket, if the plan was purchased within the last five days and has not been used.
Overdue payments
Your account has overdue payments if your available credit, including your account balance and coupons, does not cover the outstanding bill. Overdue payments may affect service operations, so please add funds promptly.
For a subscription WAF instance, you have already pre-paid for the resources, so you can continue to use the instance even if your account has overdue payments. However, you cannot perform operations that incur new fees, such as using post-paid features like risk identification and burstable QPS (pay-as-you-go), upgrading the instance configuration, or renewing your subscription. For a pay-as-you-go WAF instance, overdue payments will cause the instance to be suspended, and billing for related WAF resources will be paused. If you do not settle the overdue bill within the specified period, Alibaba Cloud will release the instance, and its data will be deleted and cannot be recovered.
If you have overdue payments and need to check the status of your resources and how to handle them, see Overdue payments.
View bills
After you activate WAF, you can view the actual usage and costs for both pay-as-you-go and subscription instances on the WAF bill management page. You can also view deduction bills in the User Center. To learn how to view WAF bills, see View bills.