Purchase a subscription WAF 3.0 instance

Purchase a WAF instance

1. Go to the Web Application Firewall 3.0 (Subscription) purchase page.

2. Set Billing Method to Subscription and configure the following parameters.

   Basic instance

   Parameter	Description
   Version	Select the edition that meets your needs.
   Region	The region determines the location of the WAF protection nodes, which affects access latency and data compliance. If your origin server is in the Chinese mainland, select Chinese Mainland. Otherwise, select Outside Chinese Mainland.
   Burstable QPS (Pay-as-you-go)	This feature is enabled by default and cannot be disabled. When your peak traffic exceeds the purchased QPS limit, the overage is billed on a pay-as-you-go basis. This ensures service continuity during sudden traffic spikes from attacks or promotional events.
   Additional Domains	Purchase this add-on if you need to protect more domains than your selected edition allows.
   Service-Linked Role	WAF requires access to your cloud resources to provide services such as traffic access control and monitoring. Click Create Service-Linked Role. The system automatically creates the AliyunServiceRoleForWaf role. You do not need to manually modify this role.
   Duration	Select a subscription period for the WAF 3.0 instance and specify whether to enable Auto-Renewal. Note To conduct a Proof of Concept (POC) test, contact your account manager and set Duration to 7-day POC.

   Purchase a Pro instance

   Parameter	Description
   Version	Select the edition that meets your needs.
   Region	The region determines the location of the WAF protection nodes, which affects access latency and data compliance. If your origin server is in the Chinese mainland, select Chinese Mainland. Otherwise, select Outside Chinese Mainland.
   Agentic API security	Enable this module if your services involve a high volume of API calls and require protection against sensitive data leaks or malicious attacks.
   Agentic Bot Management - Web Protection	Enable this module to protect your web services from malicious bot traffic, such as data scraping, spam registrations, and fraudulent activities. This applies to webpages and H5 pages accessed through browsers, including H5 pages in mobile apps.
   Agentic Bot Management - App Protection	Enable this module to protect your mobile app services from malicious bot traffic, such as data scraping, spam registrations, and fraudulent activities. This applies to native iOS and Android apps, but not H5 pages used within apps.
   Risk Identification	If you enable a bot management module, you can also enable this feature. It uses WAF's built-in mobile number reputation database to prevent spam registrations and fraudulent marketing activities.
   Peak Traffic Throttling	Enable this feature to handle traffic spikes during promotional events. It ensures service stability by allowing only a fixed QPS or a specific ratio of requests to reach your origin server.
   Additional QPS	Purchase this add-on if your peak QPS exceeds the quota of your selected edition.
   Burstable QPS (Pay-as-you-go)	This feature is enabled by default and cannot be disabled. When your peak traffic exceeds the purchased QPS limit, the overage is billed on a pay-as-you-go basis. This ensures service continuity during sudden traffic spikes from attacks or promotional events.
   Additional Domains	Purchase this add-on if you need to protect more domains than your selected edition allows.
   Exclusive IP	In CNAME access mode, domains on the same WAF instance share an IP address by default. If a high-volume DDoS attack targets any of these domains, the shared IP address is blackholed, which interrupts traffic for all associated domains. To prevent service disruptions for a critical domain, assign an exclusive IP address to it.
   Intelligent Load Balancing	Use this feature for services in CNAME access mode that require high availability, automatic disaster recovery, and low-latency access.
   Log Service	Enable this feature to meet security compliance requirements, such as Classified Protection, or to perform in-depth security analysis.
   Log Storage Capacity	Select the maximum storage capacity for Log Service, starting from 3 TB. Unit: TB. Purchase sufficient storage capacity for your business needs. If the storage limit is reached, WAF stops writing new logs.
   Service-Linked Role	WAF requires access to your cloud resources to provide services such as traffic access control and monitoring. Click Create Service-Linked Role. The system automatically creates the AliyunServiceRoleForWaf role. You do not need to manually modify this role.
   Duration	Select a subscription period for the WAF 3.0 instance and specify whether to enable Auto-Renewal. Note To conduct a POC test, contact your account manager and set Duration to 7-day POC.

   Purchase Enterprise and Ultimate instances

   Parameter	Description
   Version	Select the edition that meets your needs.
   Region	The region determines the location of the WAF protection nodes, which affects access latency and data compliance. If your origin server is in the Chinese mainland, select Chinese Mainland. Otherwise, select Outside Chinese Mainland.
   Agentic API security	Enable this module if your services involve a high volume of API calls and require protection against sensitive data leaks or malicious attacks.
   Agentic Bot Management - Web Protection	Enable this module to protect your web services from malicious bot traffic, such as data scraping, spam registrations, and fraudulent activities. This applies to webpages and H5 pages accessed through browsers, including H5 pages in mobile apps.
   Agentic Bot Management - App Protection	Enable this module to protect your mobile app services from malicious bot traffic, such as data scraping, spam registrations, and fraudulent activities. This applies to native iOS and Android apps, but not H5 pages used within apps.
   Risk Identification	If you enable a bot management module, you can also enable this feature. It uses WAF's built-in mobile number reputation database to prevent spam registrations and fraudulent marketing activities.
   Extension plugin	Write custom Lua scripts to customize the web request processing flow. This allows you to implement personalized security logic and complex business rules.
   Peak Traffic Throttling	Enable this feature to handle traffic spikes during promotional events. It ensures service stability by allowing only a fixed QPS or a specific ratio of requests to reach your origin server.
   Additional QPS	Purchase this add-on if your peak QPS exceeds the quota of your selected edition.
   Burstable QPS (Pay-as-you-go)	This feature is enabled by default and cannot be disabled. When your peak traffic exceeds the purchased QPS limit, the overage is billed on a pay-as-you-go basis. This ensures service continuity during sudden traffic spikes from attacks or promotional events.
   Additional Domains	Purchase this add-on if you need to protect more domains than your selected edition allows.
   Exclusive IP	In CNAME access mode, domains on the same WAF instance share an IP address by default. If a high-volume DDoS attack targets any of these domains, the shared IP address is blackholed, which interrupts traffic for all associated domains. To prevent service disruptions for a critical domain, assign an exclusive IP address to it.
   Intelligent Load Balancing	Use this feature for services in CNAME access mode that require high availability, automatic disaster recovery, and low-latency access.
   Log Service	Enable this feature to meet security compliance requirements, such as Classified Protection, or to perform in-depth security analysis.
   Log Storage Capacity	Select the maximum storage capacity for Log Service, starting from 3 TB. Unit: TB. Purchase sufficient storage capacity for your business needs. If the storage limit is reached, WAF stops writing new logs.
   Hybrid cloud WAF extension node	If your services are deployed in third-party public clouds, private clouds, or on-premises data centers, you can use the hybrid cloud access mode to add your services to WAF for centralized protection. To use this feature, contact your account manager.
   Service-Linked Role	WAF requires access to your cloud resources to provide services such as traffic access control and monitoring. Click Create Service-Linked Role. The system automatically creates the AliyunServiceRoleForWaf role. You do not need to manually modify this role.
   Duration	Select a subscription period for the WAF 3.0 instance and specify whether to enable Auto-Renewal. Note To conduct a POC test, contact your account manager and set Duration to 7-day POC.

3. Click Purchase Now and complete the payment.

Next steps

After you purchase an instance, you can refer to the following steps to use WAF 3.0:

1. Add your services to WAF 3.0. For more information, see Add services to WAF.

2. Configure protection rules for your assets in WAF 3.0. For more information, see Configure protection rules.

3. View security data. For more information, see View security reports.