Cloudflare WAF
Hacker ApprovedWeb application firewall in Privacy & security
People recommend it for fast rules against new vulnerabilities that keep attacks off your origin server. Critics say it won't stop every vulnerability and it has had outages.
People recommend it for fast rules against new vulnerabilities that keep attacks off your origin server. Critics say it won't stop every vulnerability and it has had outages.
14 people gave an opinion
- recommend it
- 10
- criticize it
- 4
- approval share
- 71%
Recommended in 6 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 10 people recommend itNeeds 10 or more, met.
- 2.5 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Rules deployed before public exploits
“It was really helpful that they had coordinated with WAF providers like cloud flare ahead of disclosure to put rules in place though.”
Comment from 9 May 2026 in “The React2Shell Story” “Cloudflare WAF proactively protects against React vulnerability”
Comment from 3 Dec 2025 in “Critical RCE Vulnerabilities in React and Next.js” “These were rolled out before the exploit became public.”
Comment from 21 Oct 2026 in “PHP 8.2.35” Fast, precise reaction to vulnerabilities
“It was really helpful that they had coordinated with WAF providers like cloud flare ahead of disclosure to put rules in place though.”
Comment from 9 May 2026 in “The React2Shell Story” “واقعاً تحسین برانگیز است که Cloudflare با این سرعت و دقت به آسیب پذیری های امنیتی واکنش نشان می دهد”
Comment from 4 Dec 2025 in “Cloudflare WAF proactively protects against React vulnerability” Seen as industry-leading WAF
“it's exceedingly unlikely a medical devices company will beat CF at this game”
Comment from 5 Dec 2025 in “Cloudflare outage on December 5, 2025” “industry leading WAFs like Akamai, Cloudflare, Imperva, or even AWS WAF”
Comment from 9 Mar 2026 in “Detection Is Not Protection: What WAF Detection Mode Does (and Doesn't)”
What people warn about
Each mark is one comment
Can be bypassed or not protect
“they admit themselves, in fine print, that this will not protect you from the vulnerability”
Comment from 21 Oct 2026 in “PHP 8.2.35” “is trivially bypassable by using the `.well-known/acme_challenge` path”
Comment from 20 Jan 2026 in “Cloudflare Zero-Day: Accessing Any Host Globally”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Cloudflare WAFThis page | 10 | 4 | 71% | 6 | — | Approved |
| AWS WAF | 5 | 6 | 45% | 5 | — | — |
What people said
All 14 comments that mention it, newest first. Each links to the original comment.
“they admit themselves, in fine print, that this will not protect you from the vulnerability”
“These were rolled out before the exploit became public.”
“plenty of weird looking PHP and WP requests happily forwarded by CloudFlare to my servers”
“It was really helpful that they had coordinated with WAF providers like cloud flare ahead of disclosure to put rules in place though.”
“the point of Cloudflare's WAF is to avoid the traffic touching the origin if the security check doesn't succeed”
“industry leading WAFs like Akamai, Cloudflare, Imperva, or even AWS WAF”
“it's actually a near first class feature in WAF”
“is trivially bypassable by using the `.well-known/acme_challenge` path”
“Even cloudflare had an outage trying to protect his customers”
“the WAF is generating anomalies that make no sense”
“it's exceedingly unlikely a medical devices company will beat CF at this game”
“Cloudflare's entire WAF depending on React is an issue in itself IMO.”
“واقعاً تحسین برانگیز است که Cloudflare با این سرعت و دقت به آسیب پذیری های امنیتی واکنش نشان می دهد”
“Cloudflare WAF proactively protects against React vulnerability”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.