What is Cloudflare's Web Application Firewall and how does it work?
A web application firewall (WAF) checks each request to your site against a set of rules and blocks the ones that look like attacks. Every Cloudflare plan includes the Free Managed Ruleset. The fuller Cloudflare Managed and OWASP rulesets need a paid plan, from Pro upwards.
What a WAF does
A WAF sits in front of your site and looks at each request before it reaches your server. If a request matches a known attack pattern, it can be blocked, challenged or logged. This works on web traffic only, so it's separate from email or server security.
What each plan gives you
- All plans: the Cloudflare Free Managed Ruleset, plus unmetered DDoS protection.
- Pro, Business and Enterprise: the Cloudflare Managed Ruleset and the Cloudflare OWASP Core Ruleset, which cover a much wider range of known attacks.
You can also write your own rules, for example to block a country, a path or a spammy pattern.
Which plan
A marketing site on Webflow has little to attack, because there are no plugins or a database of your own to exploit. The Free ruleset is a sensible start. A paid plan makes sense when there's a reason, like a custom app, a login or a steady stream of bad traffic.
Plans and rulesets are from Cloudflare's own documentation, October 2026. See also the Cloudflare tool page.
The tools in this answer
Where this came up in our work
- Client work
The Therapy Lounge
70% more enquiries, 6.6x return on ad spend in October 2025, and 316 enquiries tracked from April 2025 to October 2026.
Read the story - Client work
Sector7
An award-winning rebuild, 177% more new users in 2025 than 2024, and Jon calls it "executed flawlessly, on time and on budget".
Read the story
Also worth asking
Other answers about the same tools.
How do you handle compliance management for my website?
We work with your cookie consent tool, or suggest one we've worked with, and connect it to your tags so they follow the visitor's choice. How that's wired depends on the project, so we test what your tags actually do. We don't write legal text or give legal advice, so your privacy policy needs sign-off from someone qualified.
Does server-side tracking with Stape make my site faster?
On our own site, moving GTM to a same-origin loader left load time unchanged, and speed isn't why we use Stape. Server-side tracking means the page doesn't have to load a separate script for every ad platform, but the GTM container still loads in the page, so don't expect a big jump. We don't promise a speed gain.
How does Webflow handle website performance and loading speeds?
Webflow serves sites through a CDN with SSL included, minifies code when you publish, and creates responsive image sizes. It can lazy-load images too. How fast a page ends up depends mostly on what's on it, such as image sizes and third-party scripts, so those are the first things to check.
What are the potential drawbacks or limitations of using Cloudflare?
A few real ones. It's another service to set up and keep an eye on. A wrong cache or firewall rule can show old pages or block real visitors. Your site depends on Cloudflare being up. And some DNS records, such as server-side tracking ones, have to stay un-proxied.
Can Cloudflare integrate with other marketing and analytics tools?
Cloudflare doesn't plug into your marketing tools directly, but it sits next to them. It holds the DNS for tracking subdomains such as the ones Stape uses, and an n8n workflow can call its API, for example to clear the cache when a Webflow site publishes.
Still have questions?Talk to us
Bring your numbers.
We'll tell you if the spend makes sense.
- A 15-minute callYour goals, your challenges, and whether we're the right fit.
- A 1-hour discovery callWe dig into your numbers. Worth a hundred emails.
- A concrete planAds, a custom build or both, as a one-off project or ongoing.