No more typing reviews! Try our Samantha, our new voice AI agent.

Cloudflare vs F5 Shape Security comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cloudflare Web Application ...
Sponsored
Average Rating
8.6
Reviews Sentiment
7.4
Number of Reviews
26
Ranking in other categories
Web Application Firewall (WAF) (6th)
Cloudflare
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
79
Ranking in other categories
CDN (1st), WAN Optimization (4th), Web Application Firewall (WAF) (9th), Distributed Denial-of-Service (DDoS) Protection (2nd), Managed DNS (1st), Domain Name System (DNS) Security (5th), Cloud Security Posture Management (CSPM) (14th)
F5 Shape Security
Average Rating
8.6
Reviews Sentiment
7.5
Number of Reviews
2
Ranking in other categories
Fraud Detection and Prevention (21st)
 

Mindshare comparison

Web Application Firewall (WAF) Mindshare Distribution
ProductMindshare (%)
Cloudflare5.2%
Imperva Application Security Platform7.6%
Fortinet FortiWeb4.4%
Other82.8%
Web Application Firewall (WAF)
Fraud Detection and Prevention Mindshare Distribution
ProductMindshare (%)
F5 Shape Security1.6%
ThreatMetrix4.6%
Riskified3.2%
Other90.6%
Fraud Detection and Prevention
 

Featured Reviews

DB
CTO at PlayNirvana
Advanced security reporting has protected high-traffic betting platforms from constant attacks
I don't see room for improvement to Cloudflare Web Application Firewall. One thing I don't know much about because we have a dedicated IT team for that, and I'm not involved with Cloudflare much anymore. But if I were to compare them to F5, I would like to see more features that F5 offers. F5 has an option to bring the whole infrastructure, the whole WAF and all their packages, Bot Management, and everything else on your infrastructure. You need to install certain services from their side, and then you can choose if you would like requests to hit your servers immediately or if requests need to be proxied through F5 backbone. That would be a nice addition because we have 90% of the traffic as legit traffic coming from whitelisted servers. If it comes from whitelisted servers, I don't need to go every request through the backbone; I could easily just IP whitelist everything. Then I could maybe have Bot Management on my infrastructure that drastically reduces the price of Cloudflare. I would like to see Push CDN more improved in the next release of Cloudflare Web Application Firewall. And maybe something similar to Pushpin that Fastly has, which is an option where you can push messages that then can be scaled globally over the network. From our perspective, if we have a listener that listens for stock updates, I would just need to have one processor that pushes those updates to the Cloudflare API, and then Cloudflare would broadcast that message to all listeners. Cloudflare will check the order of the message, and if you, as a customer, are not connected or have some kind of network issue, when you reconnect, you will receive the latest state and missing updates.
M.A. Faisal - PeerSpot reviewer
General Manager at bKash Limited
Advanced protection has secured critical web workloads and provides clear traffic visibility
From a security perspective, there remains a security loophole, as some browsers in the market can bypass the Turnstile solution, which requires approximately 40 seconds to do so. From a performance perspective, this is acceptable. We also tried Google reCAPTCHA, and that can also be bypassed. From a security perspective, I would say neither solution is completely secured. Regarding uptime, we have faced a couple of incidents due to Cloudflare in recent years, so I cannot say we receive 100% uptime for our region. We sometimes face challenges, including downtime and other issues. As a result, we are not receiving 100% uptime from Cloudflare's solution. Since most of our customers are in this region, we need alternatives. We need something more competitive than Cloudflare. Unfortunately, in Bangladesh, Cloudflare has three points of presence already, and we cannot find any other solution provider in Bangladesh as an alternative, which presents another challenge. Competitor solutions have more attack signatures, which ensure better security compared to Cloudflare's predefined configurations. Customers do not have options to modify any configuration parameters in Cloudflare, whereas other competitor solutions, such as F5 Distributed Cloud, allow customers to tune configurations according to their requirements. Cloudflare could improve in this area. Additionally, regarding visibility, Cloudflare has static visibility, but they could adopt dynamic graph features for their customers.
Nikolay Dimitrov - PeerSpot reviewer
Cyber Security Engineer at Paysafe / IBM
Easy to configure and blocks bot attacks for web users
The solution is deployed on the F5 cloud. The solution's real-time analytics help you see what has been blocked. It helps to see whether the attack category was an automation attack or a fake browser. F5 Shape Security has a normal dashboard. We are doing F5 Shape Security migrations for 30 customers. F5 Shape Security uses Javascript. For a lot of competitors, the Javascript can be reverse-engineered by attackers to bypass the protection. F5 Shape Security has machine learning authentication of the Java script. If you had hacked it, the encryption would have been changed. It's really hard for attackers to reverse engineer the F5 Shape Security JavaScript. Overall, I rate the solution a nine out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The impact of Cloudflare Web Application Firewall's integration with existing web technologies on our site's performance and security measures is quite great, actually."
"We like that there's load balancing, firewall capabilities, DDoS protection, et cetera, all covered by Cloudflare."
"Cloudflare WAF provides protection through rules and functionalities like Cloudflare's SDRAP."
"Someone with a basic understanding of networking and security will be able to implement the firewall's basic features within 15 minutes."
"The security features are valuable. The particular feature we use is called OWASP."
"The initial setup process is simple."
"Caching is the most valuable feature of Cloudflare Web Application Firewall."
"For us, the key feature of Cloudflare is DDoS protection and IP hiding, especially since we are a crypto company."
"In my opinion, CloudFlare is one of the best CDN networks I have ever used."
"For businesses that don't have a dedicated security team, I think it's a better product; it's more intuitive for people like us."
"Cloudflare is very straightforward."
"There are key things that are used for our enterprise customers, such as Lambda and DNS."
"It's a reasonably priced solution that meets customers' needs and it's not too difficult to deploy."
"DDoS protection is this product’s most valuable feature."
"Its most significant benefit to date is the speed with which it refreshes DNS records on the internet once you change it. If you are changing a website or registering a new record, it is very quick."
"The API gives us the ability to remote control our DNS settings."
"The most valuable feature of the solution is the ease of configuration."
"F5 Shape Security's most valuable feature is performance."
 

Cons

"Support can be challenging at times."
"We don't even use Cloudflare Bot Management because it's too expensive; you need to pay per request, and it's much cheaper to get one or two additional machines."
"If they add logs history within the Cloudflare offering, that would be a great benefit."
"The ModSecurity core rules need to be updated."
"Their documentation could be better. They don't have documentation that explains everything well."
"The blocked logs are difficult to read at times."
"I have experienced some difficulties with Cloudflare's support as a customer based in India."
"The learning curve was steep initially."
"However, what I still fail to understand is that why aren't they offering domains themselves."
"It would be helpful if the solution could continue evolving to compete with the other solutions on the market."
"One area of improvement is in the Access Rules. Hypothetically, if we wanted to block or challenge traffic outside of the United States, the only way to currently do that (as far as I know) is to enter every single country outside of the United States. That could be a labor intensive job. A solution could be to enable users to create a rule where traffic is only allowed within a certain country."
"More insight into analytics and threats would be a good place to start improving Cloudflare."
"It looks like they don't support as many TLDs as other registrars, but since they are very new as a registrar, I expect this may improve soon."
"We had to do a lot of digging and back-and-forth with technical support for specific use cases, and it might be helpful to have more screencasts or screenshots for common situations."
"There are some issues with the CDN services."
"It should be easier to collect the logs with companies like Sumo. However, based on my discussions with the salespeople, I understand that's how they make their money. With the enterprise product, they want people doing those kinds of enterprise features to do the logging. They want them to pay a lot of money, and that's where I have an issue with them. That should be a default. You should be able to get the log no matter what. The logging should be universal."
"The tool's price is high."
"I want the solution's custom exclusion rules to be more granular."
 

Pricing and Cost Advice

"We pay $210 per month for CloudFlare WAF."
"The solution is expensive."
"Cloudflare Web Application Firewall is more affordable than other solutions."
"It is not too pricey."
"The solution's pricing option needs to be more transparent for enterprise clients."
"The pricing model is very straightforward compared to the competition. You just pay per month for the product and usage."
"It starts at $20 and can easily go up to $200 monthly"
"Cloudflare offers different types of subscriptions for businesses, enterprises, and personal users, and the pricing is negotiable."
"The solution has many features but there are ones that you need to pay for. Sometimes you have to find out which is available for free and which you have to pay for."
"I give the price a five out of ten."
"For Cloudflare, I recommend it heavily for small businesses with revenue under a couple of million dollars. Onboarding is easy, and they even have a free plan. This makes it simple for businesses in the $100,000-$500,000 range to try it out and see its value, allowing them to scale up their infrastructure as needed."
"In terms of licensing costs, we don't pay for licensing for Cloudflare. We only establish communication, then for peering, Cloudflare takes care of the cross-connection in different data centers."
"There are no additional costs beyond the standard licensing fees."
"I think the pricing is competitive. I think as far as licensing is concerned it's pretty straightforward because it's based on domain. It's just that sometimes domains could be tricky with some customers."
"I believe their performance has improved, but I'd like to refrain from discussing the pricing aspect related to the cloud. The pricing, in my opinion, could be simplified, and I think they should consider reevaluating the pricing for support, as it can be quite high. At times, this cost can make it challenging to choose CARFAGuard or opt for the support."
"The solution is expensive when compared to other products but offers unlimited bandwidth."
"The solution is moderately priced."
report
Use our free recommendation engine to learn which Web Application Firewall (WAF) solutions are best for your needs.
908,800 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
17%
Comms Service Provider
9%
Financial Services Firm
9%
Outsourcing Company
7%
Financial Services Firm
10%
Comms Service Provider
10%
Manufacturing Company
8%
Computer Software Company
8%
Financial Services Firm
29%
Healthcare Company
9%
Comms Service Provider
8%
Retailer
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise6
Large Enterprise6
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise11
Large Enterprise26
No data available
 

Questions from the Community

What needs improvement with Cloudflare Web Application Firewall?
I don't see room for improvement to Cloudflare Web Application Firewall. One thing I don't know much about because we...
What is your primary use case for Cloudflare Web Application Firewall?
We are using Cloudflare Web Application Firewall's advanced reporting and analytics tools with their Zero Trust, so e...
Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Cloudflare. We are moving from Akamai prolexic to Cloudflare. Cloudflare anycast network outperforms Akamai static GR...
Which would you choose - Cloudflare DNS or Quad9?
Cloudflare DNS is a very fast, very reliable public DNS resolver. It is an enterprise-grade authoritative DNS service...
What is your experience regarding pricing and costs for Cloudflare DNS?
The pricing, setup cost, and licensing for Cloudflare are a bit on the higher side overall.
Ask a question
Earn 20 points
 

Also Known As

Cloudflare WAF
Cloudflare DNS
Shape Security
 

Overview

 

Sample Customers

crunchbase, udacity, marketo, okcupid, zendesk
Trusted by over 9,000,000 Internet Applications and APIs, including Nasdaq, Zendesk, Crunchbase, Steve Madden, OkCupid, Cisco, Quizlet, Discord and more.
Wells Fargo, Loblaw, JetBlue, Zoosk
Find out what your peers are saying about Imperva, Fortinet, F5 and others in Web Application Firewall (WAF). Updated: August 2026.
908,800 professionals have used our research since 2012.