Web Application Firewall

Stop attacks before they reach your application

A network firewall sees packets. A web application firewall sees requests – and detects SQL injection, cross-site scripting, bot waves and abused forms before they arrive at your application. With an OWASP rule set, multi-stage captcha and AI automation: the rule set and a trained scoring model check every request together.

View plans Feature comparison
Starting at
€14.27 / month
Rule set
OWASP • custom rules
Operations
Automatic HTTPS • live logs
All prices incl. 19% VAT. Larger setups run on the business tenant with usage-based billing.

What a WAF protects against

Application-layer attacks reach your application despite a network firewall – they look like normal web traffic.

Attacks on the application
Detected by the content of the request, not by its origin.
  • SQL injection, cross-site scripting, command injection
  • Path manipulation and access to files outside the web root
  • OWASP rule set as the baseline, extended with your own rules
Bots and abuse
Without locking out real visitors.
  • Multi-stage captcha instead of a hard block
  • Rate limiting globally and per path
  • IP lists and GeoIP / network blocking
AI automation
Rule set and trained model score every request together.
  • The model learns from your domain's traffic and is retrained continuously
  • Six operating modes – from observation only to strict, switchable per domain
  • Adaptive challenge in the Max plan
Visibility instead of a black box
You see what was blocked – and why.
  • Live dashboard with request logs, 7, 30 or 90 days depending on the plan
  • Alerts by email, from Pro also via Slack, Discord, Telegram and webhooks
  • Branded block and maintenance pages in the design of your application
  • Automatic HTTPS – certificates without manual work

Plans

Tiered by domains and feature set. All prices per month, incl. 19% VAT.

Starter

1 domain
€14.27/ month
Good for: a single website, shop or application
  • OWASP rule set + multi-stage captcha
  • Operating modes incl. AI automation
  • Rate limiting (global/path) & IP lists
  • Branded pages in system design
  • Live dashboard + 7-day logs
  • Email alerts, automatic HTTPS
  • Support by email
Request Starter
The entry plan for a single application.

Pro

Recommended
up to 5 domains
€59.49/ month
Good for: multiple projects, customer websites, production workloads
  • Everything in Starter, plus:
  • Custom & combined rules + redirects
  • Custom themes, GeoIP / network blocking
  • Public status pages
  • Slack, Discord, Telegram + scheduled reports
  • Anomaly alerts, self-pentest, 30-day logs
  • Priority email support
Request Pro
The plan for ongoing production use.

Max

up to 20 domains
€178.49/ month
Good for: critical applications, APIs, high protection requirements
  • Everything in Pro, plus:
  • AI strict mode & adaptive challenge
  • API protection, virtual waiting room
  • Response and upload inspection against data leaks
  • Edge caching, reputation feeds, SIEM export
  • 90-day logs
  • Priority support
Request Max
The full feature set, including for APIs.

Feature comparison

Every feature in detail – Starter, Pro and Max side by side.

Business tenant Request a consultation
Feature Starter Pro Max
Price / month €14.27 €59.49 €178.49
Included domains 1 up to 5 up to 20
OWASP rule set + multi-stage captcha
Operating modes incl. AI automation
Rate limiting (global + per path), IP lists
Branded pages (system design)
Live dashboard + request logs 7 days 30 days 90 days
Email alerts · automatic HTTPS
Custom & combined rules + redirect rules –
Custom themes & page layouts –
GeoIP / network blocking –
Public status pages –
Slack/Discord/Telegram/webhooks + scheduled reports –
Traffic anomaly alerts (countries/bursts/fingerprints) –
Self-pentest + shadow/test rules –
AI strict mode & adaptive challenge – –
Response & upload inspection (data leak protection) – –
API protection (keys, plans, usage analytics) – –
Virtual waiting room – –
Edge caching & compression – –
Reputation feeds (IP / TLS fingerprint) – –
SIEM export – –
Support Email Email (priority) Priority

All prices per month, incl. 19% VAT. Log retention indicates how long request logs remain visible in the dashboard.

WAF business tenant

Usage-based – for companies, IT service providers, agencies and resellers.

Base fee from
€236.81/ month

incl. 19% VAT

  • 25 domains included
  • 25 million requests per month
  • Full feature set like Max

Your own tenant with team management, roles, API protection and automation tokens.

Usage-based billing

Anything beyond the included quota is billed by consumption.

Beyond the quota€0.58 per additional 1 million requests / month
Additional domains€5.94 per domain / month
From 250 million requests / monthVolume pricing on request
  • Transparent usage billing: consumed requests and active domains are itemized per billing period
  • For IT service providers, agencies & resellers: your own tenant with multiple users and roles
Request business tenant Reseller program

Frequently asked questions

Not sure which plan fits? Briefly describe what you need – we'll give you a concrete answer.

Ask a question

A network firewall decides based on IP addresses, ports and protocols – it sees where a connection comes from. A web application firewall reads the content of the HTTP request and can therefore detect attacks that look like perfectly normal web traffic: manipulated form fields, injected database commands, scripts in comments. To a filter based on IP, port and protocol there is nothing unusual about such requests – they travel over the regular port 443.

That is the real challenge, and it is exactly what the operating modes and the multi-stage captcha are for: suspicious requests are not blocked immediately but verified first. In AI automation, the rule set and the model score every request together; in the Max plan, the challenge difficulty also rises after repeated failed attempts. With shadow/test rules (from Pro), you can also run a new rule in observation mode and see what it would have blocked before enforcing it.

No, the two work on different layers and complement each other. DDoS protection absorbs volumetric attacks in the network before they saturate your uplink. The WAF filters individual requests at the application layer. Against a bot wave that brute-forces your login form, the WAF helps – against 100 Gbit/s of junk traffic, the network does.

In the Starter, Pro and Max plans, domains count – not requests. The business tenant includes 25 million requests per month; beyond that, €0.58 is charged per additional million. Consumed requests and active domains are itemized per billing period, so you can always see how your invoice is calculated. From 250 million requests per month, volume pricing is available on request.

Yes. The business tenant is a dedicated tenant with team management, roles and automation tokens – designed for IT service providers, agencies and resellers that manage multiple customer projects under one roof. Branded block pages and custom themes are available from Pro anyway. Details on the partner model can be found in our reseller program.
Which plan fits your application?

Tell us briefly how many domains you want to protect and what it's about – we'll get back to you with a recommendation.

Request without obligation Managed services