Cloudflare vs Imperva Web Application Firewall (WAF)

• When you need a FREE and EASY TO SETUP SSL certificate on your page (if you don't have the locked locker icon when opening your page, you need it)
• When you want to obfuscate your webpage's IP (any connection will give the Cloudflare's IP)
• You need to speed up the connection for static content (it will not help database connections or dynamic content)
• IF your DNS isn't good (Cloudflare's DNS is amazing, quick, easy, and works pretty well)

Read full review

• Alert Aggregation - Correlates different violations into perceived correlated attacks.
• Ease of deployment - as one of the only WAFs that allow bridge mode deployment, this can be deployed with without downtime and no Network Architecture modifications. If the need for proxy is required at a later time, Transparent Reverse Proxy can be deployed within seconds and minimal configuration.
• Custom Policies - Custom security policies are easy to configure.
• Reporting - There are a good amount of pre-configured reports available by default.

Read full review

• There is a huge jump in price between the mid-tier and enterprise solutions which is hard to justify for smaller businesses, or companies owning many small businesses.
• It is difficult to convert from a CNAME installation back to a DNS based one
• Setting up page-level caching with web workers is counterintuitive for simple websites

Read full review

• The UI can use a little work (but is largely decent)

Read full review

• Uptime: With Cloudflare's website protection, we have avoided panic-inducing outages and downtime.
• Reduced hosting load: Cloudflare's CDN allows us to use smaller servers and greatly diminish bandwidth usage.
• Reduced domain renewal cost: Most of our domains could be transferred to Cloudflare, where domain renewals are as cheap as possible.
• Increased total website cost: All of Cloudflare's features aren't free, and they increase our monthly overall website cost. The protection and other features are helpful, just not free.

Read full review

• Meet compliance requirements - Check.
• Better Insight into web application - Absolutely great, checks all the traffic against RFC standards and will alert on common development mistakes that duplicate application traffic or provide attack vectors for potential attackers.
• Have had several issues blocking a customer without producing alerts, while it happened only one week out of 2 years of working with the devices, it did produce a lot of headaches.

Read full review