Cloudflare waf now free?

I checked my free plan websites and noticed that the WAF is on and can’t be turned off nor are there any rulesets, but when i check the api it says the waf is off. Is the WAF now free and automated?

1 Like

That is interesting. I see the same thing on my free plans. But the pricing and features pages still show no WAF on the free plans. I wonder if it includes OWASP.

That’s probably a bug (or more accurately to the extent certain WAF rules are available universally to all customers including free, they still are) but the UI reflection of “On” is not accurate. There’s an open ticket internally and waiting on feedback but as far as I know there has been know change in behavior, nor is one planned.

Will update as more info becomes available.

The UI change has been reverted so it should now be set to off to reflect the actual state.

Sorry for any confusion.