All customers on a paid CloudFlare plan for a domain will have access to CloudFlare's Web Application Firewall. The functionality of the WAF does depend on the particular pricing plan the domain is on.
- Pro customers have a WAF with Cloudflare WAF rules, rules for a variety of platforms and the open source OWASP rule set.
- Business customers have the same functions as Pro and also get the ability to write their own custom rule sets (up to 25 custom rulesets).
- Enterprise customers will have the additional functions available at the Business level of service and the ability to write their own rule set with no limit on the number of rule sets.
- Enterprise customers also have access to additional reporting via the Firewall app under the Overview tab:
- Events by action: Identify requests that are blocked, logged/simulated, or challenged
- Events by service Identify requests that where Access Rules, Hotlink Protection, WAF, Firewall Rules, etc were applied
- View recent amount of DDoS attack requests mitigated