The content of this document and billing standards apply only to regions not in the Chinese mainland. If your business is deployed in the Chinese mainland region, please refer to the Chinese mainland edition. The two editions differ in features and capabilities as well as billing models. Instance Package Price Description
|
SaaS WAF / Cloud-native WAF | Advanced Edition | 800 | SaaS WAF: After purchasing the WAF basic plan, you can upgrade the plan in Instance Management. Downgrading the plan is currently not supported. Cloud-native WAF: None. |
|
| Enterprise Edition | 2,180 |
|
| Ultimate Edition | 6,380 |
|
| Exclusive Edition | Pricing is only available upon submission of a ticket. |
Plan Add-ons Feature Price Description
Mini Program Security and Protection
The billing for value-added feature of Mini Programs Security and Protection consists of the mini program business extension package, elastic billing for mini programs, and mini program node extension package.
Note:
For regions outside the Chinese mainland, only the Hong Kong (China) region supports purchasing and enabling the MMPS capability by default. For other regions, please submit a ticket to apply for activation. Mini Program Business Expansion Package
|
Combining the access of Weixin Gateway, it supports WeChat mini programs' nearby security protection and dynamic acceleration capability, providing a unified security protection scheme for the mini program. Each mini program extension package includes 100 QPS and the corresponding access bandwidth of 2 Mbps. The Advanced Edition WAF instances with the feature enabled support the access of 3 mini programs by default. Editions later than the Advanced Edition support the access of 4 mini programs. To access more mini programs, you need to purchase the mini program node extension package. You can purchase up to 500 mini program security and protection extension packages at a time. If you require more packages, contact the business manager or us by submitting a Ticket. | 1 - 3 units | USD 195/unit/month |
| 4 - 5 units | USD 185/unit/month |
| 6 - 9 units | USD 175/unit/month |
| 10 - 49 units | USD 165/unit/month |
| 50 - 99 units | USD 155/unit/month |
| 100 - 499 units | USD 135/unit/month |
| 500 - 999 units | USD 115/unit/month |
| 1,000 units or more | USD 95/unit/month |
Mini Program Elastic Billing
When the peak QPS of a mini program accessing the mini program security and protection feature exceeds the QPS specification value purchased in the mini program business expansion package for the instance, you can enable elastic billing to further expand the supported QPS specification for protecting mini programs.
|
Mini program security and protection elastic scaling is suitable for traffic protection against service peaks caused by inaccurate traffic assessment for mini program services, short-term business activities, or unexpected traffic surges. After this feature is enabled, postpaid protection beyond the capacity of the prepaid mini program service is supported to prevent business impact or degradation of protection capabilities. | 0 - 5,000QPS | USD 0.19/QPS/day |
| 5,001 - 10,000QPS | USD 0.17/QPS/day |
| 10,001 - 50,000QPS | USD 0.15/QPS/day |
| 50,001 - 100,000QPS | USD 0.13/QPS/day |
| 100,001 QPS or more | USD 0.11/QPS/day |
Mini Program Node Expansion Package
If the number of mini programs requiring access exceeds the supported capacity of the instance edition, you can purchase an expansion pack for mini program nodes to further expand the number of protected mini programs.
|
The mini program node extension pack is suitable for scenarios where more mini programs need to be accessed for protection. Each purchased mini program node extension pack supports accessing one mini program. | USD 28/unit/month |
Management of BOT Traffic
|
After purchase, users can use BOT Traffic Management to identify and classify friendly and malicious bots, and adopt targeted traffic management policies. For example, allow traffic from search engine bots, and adopt non-response, delayed response, or differentiated response policies for malicious product information scraping traffic. It can also address issues such as resource consumption, information leakage, and ineffective marketing caused by malicious bot crawling, while ensuring the normal operation of friendly bots (such as search engines and ad bots). | USD 2,000/month |
Note
After BOT traffic management is enabled, the unit price of each business extension pack will increase by USD 300 per pack per month.
BOT Security Service
BOT Security Service provides professional BOT attack protection and security operation support. It covers three types of services: emergency protection, continuous escort, and intelligence monitoring, helping users effectively respond to various BOT attack threats.
|
BOT Security Emergency Protection Service: Provides rapid response and analysis for a single BOT attack, along with professional BOT rule configuration and tuning recommendations. The service model is single-use, single-domain. | USD 5,600/unit/time |
BOT Security Escort Service: Provides continuous BOT risk mitigation, BOT policy tuning, and regular BOT analysis reports. The service model is monthly subscription, single-domain. | USD 8,400/unit/month |
BOT Security Intelligence Monitoring Service: Provides continuous security dynamic monitoring, industry security threat monitoring, and security threat early warning services. The service model is monthly subscription. | USD 14,000/unit/month |
Note:
The above is an overview of the standard service content. If you need to learn more about the detailed service content or obtain one-on-one exclusive consultation, please submit a ticket to contact us. A professional security consultant will provide you with tailored solution recommendations. API Security
After purchasing API Security, users can perform security analysis on relevant API assets and configure policies based on risks identified through traffic analysis. The pricing for enabling API Security across different instance editions is as follows:
|
SaaS WAF | Advanced Edition | Enabled | 1,890 | After the WAF basic plan is purchased, you can upgrade the plan in Instance Management. Downgrading the plan is not supported. |
|
| Not enabled | 800 |
|
| Enterprise Edition | Enabled | 4,500 |
|
|
| Not enabled | 2,180 |
|
| Ultimate Edition | Enabled | 10,650 |
|
|
| Not enabled | 6,380 |
|
| Exclusive Edition | Enabled | Pricing is only available upon submission of a ticket. |
|
|
| Not enabled |
|
|
Cloud Native WAF | Advanced Edition | Enabled | 1,890 | None |
|
| Not enabled | 800 |
|
| Enterprise Edition | Enabled | 4,500 |
|
|
| Not enabled | 2,180 |
|
| Ultimate Edition | Enabled | 10,650 |
|
|
| Not enabled | 6,380 |
|
| Exclusive Edition | Enabled | Pricing is only available upon submission of a ticket. |
|
|
| Not enabled |
|
|
Note
After API Security is enabled, the unit price of each business extension pack will increase by300 US dollars/pack/month.
Extended Configuration Price Description
Extra Domain Name Package
|
Each domain package can protect up to 10 domains, including 1 primary domain and its subdomains, for a total of 10 domains (that is, the sum of the primary domain and subdomains). Note: When object access is enabled for a Cloud-native WAF instance of the Enterprise edition and above, each object instance is counted as one primary domain toward the primary domain quota. Therefore, the one primary domain quota from an extension pack can also be used to add one object. | USD 285/month |
Extra Capacity Package (Extra QPS Package)
|
Each service expansion pack supports an additional 1,000 QPS, and the service bandwidth for SaaS-based instance protection is expanded by 25 Mbps. | USD 142/month |
| This price applies to users who purchased WAF before September 27, 2023. |
Each service expansion pack supports an additional 1,000 QPS, and the service bandwidth for SaaS-based instance protection is expanded by 25 Mbps. | Advanced Edition | USD 350/month | This price applies to users who purchase WAF for the first time after September 27, 2023. |
| Enterprise Edition | USD 480/month |
|
| Ultimate Edition | USD 600/month |
|
Note:
After BOT traffic management or API Security is enabled, the unit price of the business extension pack will increase by USD 300/pack/month accordingly.
When the peak service QPS exceeds the instance QPS specification value, the instance may enter quarantine state in the sandbox according to the isolation mechanism for QPS overage. For instances entering quarantine state in the sandbox, WAF will no longer guarantee service SLA. For more information about the overage isolation mechanism, see Sandbox Isolation Status. To avoid affecting your normal capacity operations, it is recommended to purchase extra capacity package promptly when capacity demands arise to scale up the instance QPS specification value. The expandable specifications for instances of different plan editions under each WAF type are as follows:
|
SaaS WAF | Advanced Edition | 20 (20,000 QPS) | 20 (500 Mbps) | 1. If you need to purchase more customized packages for extra capacity package, please contact your commercial manager or directly Contact Us to customize the upgrade quantity of extra capacity package, including more QPS specifications for capacity protection or bandwidth specifications. 2. After the upgrade quantity of the business extension pack is customized, its sandbox isolation threshold is also a customized value. For detailed calculation, see Sandbox Isolation Status. 3. When customizing a business extension pack, the expanded prepaid QPS specification must not be lower than the currently effective elastic post-paid QPS usage, ensuring that high-specification resources can promptly handle business traffic. |
| Enterprise Edition | 30 (30,000 QPS) | 30 (750 Mbps) |
|
| Ultimate Edition | 40 (40,000 QPS) | 40 (1,000 Mbps) |
|
Cloud Native WAF | Advanced Edition | 40 (40,000 QPS) | Not involved |
|
| Enterprise Edition | 60 (60,000 QPS) |
|
|
| Ultimate Edition | 80 (80,000 QPS) |
|
|
Hybrid Cloud Node
Hybrid Cloud Nodes support deploying WAF protection capabilities to your private environments (your own IDC or private cloud), enabling centralized configuration delivery, unified log reporting, and centralized monitoring of protection status.
Only Cloud-native WAF instances of the Enterprise edition and above support purchasing Hybrid Cloud Nodes. One Hybrid Cloud Node is included by default upon purchase. To use the Hybrid Cloud Management feature, you need to submit a ticket to apply for purchasing additional Hybrid Cloud Nodes. When the number of Hybrid Cloud Nodes > 2, the console will automatically enable the Hybrid Cloud Management feature. |
Each hybrid cloud node includes 10,000 QPS protection capacity and 30 domain protection quotas. | 1 - 3 units | USD 1,400/unit/month |
| 4 - 10 units | USD 1,260/unit/month |
| 11 units or more | USD 1,120/unit/month |
Note:
The deployment resources (servers, network, and so on) for Hybrid Cloud Protection Nodes are provided by users themselves and are not included in the WAF billing scope.
When Hybrid Cloud Nodes exceed their capacity, an alarm is triggered if the peak actual inbound traffic reaches the sandbox threshold. After the capacity is exceeded, the product cannot guarantee the compliance of SLA. It is recommended to adjust the specifications promptly.
Elastic Billing (Postpaid)
When the peak service QPS exceeds the instance QPS specification (default QPS specification of the plan edition, or default QPS of the plan edition + extended QPS specification of business expansion pack), you can further extend the instance QPS specification by enabling elastic billing.
When the peak service bandwidth of a SaaS WAF instance exceeds the measured bandwidth value, elastic billing can be enabled to extend the service bandwidth specification of the SaaS WAF instance through postpaid bandwidth. The measured service bandwidth of the instance = default bandwidth specification of the plan edition + (number of packs for capacity expansion * 1,000 + actual postpaid QPS billing value) / 40.
Note:
The elastic billing for postpaid bandwidth is being gradually rolled out in batches. The specific supported time is subject to the update completion time on the purchase page.
By default, only the Hong Kong (China) region supports elastic billing. For other regions, please submit a ticket to apply for activation. If multiple SaaS WAF or cloud-native WAF instances are purchased under the same account, the elastic protection consumption of each instance type is calculated independently and billed separately.
If the peak actual service QPS of an instance exceeds the instance QPS specification value, the instance may enter quarantine state in the sandbox according to the isolation mechanism for QPS overage. For instances entering quarantine state in the sandbox, WAF will no longer guarantee the compliance of SLA. For more information about the overage isolation mechanism, see Sandbox Isolation Status. By purchasing packs for capacity expansion or enabling elastic protection, you can extend the QPS specification value of the instance. When the QPS specification value of the instance exceeds the peak service traffic during overage periods, the instance automatically ends the sandbox quarantine state.
When the peak actual service bandwidth of a SaaS-based WAF instance exceeds the measured bandwidth value, you can expand it by purchasing packs for capacity expansion or enabling elastic billing. If the peak service bandwidth exceeds the specification value for the instance bandwidth, bandwidth throttling may be triggered, affecting service stability.
|
The postpaid elastic billing for services supports basic security protection for business QPS exceeding the basic plan or the basic plan + extra capacity package. | USD 0.04/QPS/day |
The postpaid elastic billing for services supports basic security + BOT traffic management protection for QPS exceeding the base plan or the base plan + extra capacity package. | USD 0.0695/QPS/day |
The postpaid elastic billing for services supports basic security + API security protection for QPS exceeding the basic plan or the basic plan + extra capacity package. | USD 0.0695/QPS/day |
The postpaid elastic billing for services supports basic security + BOT traffic management + API security protection for QPS exceeding the basic plan or the basic plan + extra capacity package. | USD 0.0974/QPS/day |
Bandwidth postpaid elastic billing: When the peak of actual service bandwidth for a SaaS WAF instance exceeds the measured bandwidth value, elastic expansion of the exceeded service bandwidth is supported to ensure the stability of connected services. | USD 1.5/Mbps/day |
Postpaid Tag-Based Cost Allocation
For WAF instances with elastic billing (postpaid) enabled, you can allocate the postpaid elastic billing costs by configuring cost allocation tags.
After users set cost allocation tags for domains, WAF pushes the peak QPS data of each domain to the Tencent Cloud billing center and calculates the postpaid allocation value corresponding to each tag according to the Overage Ratio Allocation model. This feature can be used in conjunction with prepaid manual cost allocation, covering the cost allocation requirements for both prepaid and postpaid billing methods.
Postpaid tag-based cost allocation uses the Overage Ratio Allocation model. The calculation steps are as follows:
1. Determine the total postpaid amount: Total Postpaid QPS = Actual Total QPS - Prepaid Instance Specification.
2. Calculate the overage for each domain:
Domain Overage = Max(0, Actual Domain QPS - Baseline QPS)
The baseline can be the prepaid average QPS (for example, 500 QPS).
3. Calculate the postpaid QPS to be allocated to each domain: Domain Allocation Value = Total Postpaid QPS × (Overage of the Domain / Sum of Overages of All Domains).
Note:
For regions outside the Chinese mainland, the postpaid tag-based cost allocation feature is supported by default only in the Hong Kong (China) region. For other regions, please submit a ticket to apply for activation. Exclusive IP
Note:
Only SaaS WAF supports exclusive IP. If you need to enable it, please submit a ticket or contact your dedicated account manager to apply for purchase. |
Exclusive IP resources can be allocated to specific domains to meet customized requirements for business stability, network performance, and resource exclusivity. Exclusive IP does not guarantee a fixed VIP, and each enable or disable operation may result in VIP address changes. A single instance can purchase up to 100 exclusive IPs. | USD 30/month/unit |
Log Storage Package
|
A security log service package includes: 1 TB of CLS storage capacity: Provides the feature to search for and download access logs of domain names protected by SaaS WAF within the user-configured log retention period (up to 184 days). However, if the log size corresponding to the configured retention period exceeds the 1 TB storage capacity, the feature to search for and download access logs is only available for logs within the 1 TB storage capacity. | USD 150/month |
Note
Security log storage packages are sold in quantities of at least 2, with a maximum purchase limit of 500 per transaction.
WAF supports adding third-level and fourth-level domain names, but each added third-level or fourth-level domain name will occupy one subdomain quota.To disable the auto-renewal of a domain package separately, please Contact Us for assistance.
To disable the QPS extension pack, locate the corresponding billing item in Renewal Management and cancel its renewal. If you need to disable the automatic renewal of the domain package separately, please contact us for assistance. It is recommended to purchase the log capacity of the security log storage package based on business QPS usage, with 1 TB of log capacity suggested for every 800 QPS per month.
Log Shipping Service
The log shipping service is designed to record and deliver logs generated by WAF (currently only the header fields of access logs are supported) to your Tencent Cloud CLS service or CKafka service.
Note
To use the log shipping service, you must purchase a CLS or CKafka instance in advance.
During log storage and delivery, WAF charges based on the actual log size, measured in GB. The billing cycle is daily, meaning the fees for usage generated on a given day are billed and settled at 00:00 the following day. Currently, tiered pricing is supported based on your actual usage (this pricing does not include CLS or CKafka fees). The specific prices are shown in the table below:
|
0 - 29GB | USD 0.006/GB/day |
30 - 99GB | USD 0.005/GB/day |
100 - 499GB | USD 0.004/GB/day |
500 GB or more | USD 0.003/GB/day |
Note:
If any exceptions occur during log shipping , please Contact Us for assistance. The feature of the log shipping service records logs in uncompressed format, and the WAF recorded value size differs from the CLS platform recorded value size.
The log shipping service feature does not conflict with the Security Log Service Package feature. You can purchase and use the log shipping service regardless of whether you have purchased the Security Service Log Package.