# Cloudflare WAF

Hacker Approved page: https://hackerapproved.com/p/cloudflare-waf/

8 people recommended Cloudflare WAF in Hacker News comments, 2 had mixed feelings and 4 criticized it, November 2025 to October 2026. It was recommended in 6 of 12 months, in 8 threads. It does not meet the Hacker Approved badge rule.

**Verdict:** People recommend it for fast rules against new vulnerabilities that keep attacks off your origin server. Critics say it won't stop every vulnerability and it has had outages.

Summary written by Claude from 14 comments.

## Why people recommend it

- Rules deployed before public exploits (3 comments in the sample): "It was really helpful that they had coordinated with WAF providers like cloud flare ahead of disclosure to put rules in place though." ([source](https://news.ycombinator.com/item?id=48072748)) "Cloudflare WAF proactively protects against React vulnerability" ([source](https://news.ycombinator.com/item?id=46136907)) "These were rolled out before the exploit became public." ([source](https://news.ycombinator.com/item?id=50183543))
- Seen as industry-leading WAF (2 comments in the sample): "It's exceedingly unlikely a medical devices company will beat CF at this game" ([source](https://news.ycombinator.com/item?id=46164635)) "industry leading WAFs like Akamai, Cloudflare, Imperva, or even AWS WAF" ([source](https://news.ycombinator.com/item?id=47303808))
- Fast, precise reaction to vulnerabilities (1 comment in the sample): "واقعاً تحسین برانگیز است که Cloudflare با این سرعت و دقت به آسیب پذیری های امنیتی واکنش نشان می دهد" ([source](https://news.ycombinator.com/item?id=46147189))

## What people warn about

- Can be bypassed or not protect (2 comments in the sample): "they admit themselves, in fine print, that this will not protect you from the vulnerability" ([source](https://news.ycombinator.com/item?id=50183749)) "is trivially bypassable by using the `.well-known/acme_challenge` path" ([source](https://news.ycombinator.com/item?id=46699172))

## Where to get it

- [Visit the official site](https://www.cloudflare.com/products/waf/)

## The badge

A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged.

## Cite as

Hacker Approved, "Cloudflare WAF", https://hackerapproved.com/p/cloudflare-waf/ (8 recommend, 2 mixed, 4 criticize; Hacker News comments, November 2025 to October 2026).

Counts updated 2 Nov 2026, with data through October 31, 2026.