Ask HN: Cloudflare WAF Alternatives?

28•rco8786•2mo ago

I don't know if we're ready to pull the trigger yet, but curious if other folks are looking at alternatives.

The WAF is great, but recent events have made it obvious that having a single point of failure entirely defeats the purpose of DNS being a distributed/decentralized service.

Is anyone doing anything creative here? We like the features that the WAF provides - but not at the expense of global outages. If you have a 3 9s availability SLA, you've just blown 90% of your allotted downtime because of Cloudflare's WAF.

Comments

yearolinuxdsktp•2mo ago

AWS Route53, built-in DDoS basic protections, plus AWS WAF (can be expensive depending on your budget).

synack•2mo ago

I've been using Cloudfront Functions to do some of the filtering that a WAF would do. It's quite flexible, but you've gotta figure out your own rules.

y-curious•2mo ago

AWS WAF has some presets you can use

mappu•2mo ago

The ability of a WAF to respond to an 0day incident is rapid rollout, 100% of endpoints, which is a SPOF no matter whether it's done via a big company or by a distributed system.

poguemahoney•2mo ago

Assuming there are still 2 WAF makers they hopefully do two mostly independent rollouts at least with separate reviewers.. It is a little shocking to me how far we have slid down the slope to letting one monopoly decide when each part of of computing environment is up.. But if bigger organizations are down it is socially acceptable to have an outage.

grim_io•2mo ago

Being down because half the internet is down is an easier sell than being down because you fucked it up yourself.

882542F3884314B•2mo ago

Akamai is a decent alternative.

BOOSTERHIDROGEN•2mo ago

CrowdSec

3rube•2mo ago

Fastly (US) and BunnyCDN (EU) are excellent options

stevefan1999•2mo ago

What about open source alternative built with Nginx/OpenResty? I forgot the name but that's the spirit

server_man3000•2mo ago

Not worth. Competitors like Bunny CDN which is much smaller will inevitably have a much worse incident as they grow. Every large company will inevitably have a couple bad incidents so asking “what other large company will never have incidents” is a moronic perspective IMO

mindcrash•2mo ago

some alternatives which can be self hosted:

open-appsec (by checkpoint), their proxy/gateway integration and your favorite firewall daemon:

https://docs.openappsec.io/getting-started/start-with-linux

appsec (by crowdsec), their proxy/gateway integration and your favorite firewall daemon:

https://docs.crowdsec.net/u/getting_started/installation/lin...

tguvot•2mo ago

imperva

dennis16384•2mo ago

Google Cloud Armor plus Load Balancer?

You can balance traffic to external networks or clouds with it too.

Carriethebest•2mo ago

I would recommend SafeLine. It's self-hosted and easy to setup

cport1•1mo ago

I have been using https://webdecoy.com and integrating it with Cloudflare WAF.

Discuss – Do AI agents deserve all the hype they are getting?

Ask HN: Anyone Using a Mac Studio for Local AI/LLM?

Ask HN: Non AI-obsessed tech forums

LLMs are powerful, but enterprises are deterministic by nature

Ask HN: Ideas for small ways to make the world a better place

Ask HN: 10 months since the Llama-4 release: what happened to Meta AI?

Ask HN: Who wants to be hired? (February 2026)

Ask HN: Who is hiring? (February 2026)

Ask HN: Non-profit, volunteers run org needs CRM. Is Odoo Community a good sol.?

AI Regex Scientist: A self-improving regex solver

Tell HN: Another round of Zendesk email spam

Ask HN: Is Connecting via SSH Risky?

Ask HN: Has your whole engineering team gone big into AI coding? How's it going?

Ask HN: Why LLM providers sell access instead of consulting services?

Ask HN: How does ChatGPT decide which websites to recommend?

Ask HN: What is the most complicated Algorithm you came up with yourself?

Ask HN: Is it just me or are most businesses insane?

Ask HN: Mem0 stores memories, but doesn't learn user patterns

Ask HN: Is there anyone here who still uses slide rules?

Kernighan on Programming

Ask HN: Anyone Seeing YT ads related to chats on ChatGPT?

Ask HN: Does global decoupling from the USA signal comeback of the desktop app?

Ask HN: Any International Job Boards for International Workers?

We built a serverless GPU inference platform with predictable latency

Ask HN: Does a good "read it later" app exist?

Ask HN: Have you been fired because of AI?

Ask HN: Anyone have a "sovereign" solution for phone calls?

Ask HN: Cheap laptop for Linux without GUI (for writing)

Ask HN: How Did You Validate?

Ask HN: OpenClaw users, what is your token spend?