Cloudflare Application Security and Performance Reviews & Product Details

I find Cloudflare Application Security and Performance awesome for keeping my sites protected from bots and random attacks while speeding up load times without extra steps. I love the DDoS protection and CDN. My favorite features include the WAF, DDoS protection, Bot management, and security controls. The Global CDN caching and traffic optimization are also great for maintaining fast and reliable performance. These features enhance both security and performance without much human intervention. The WAF helps protect against common web attacks, allowing us to control which requests are allowed. During unexpected traffic spikes or suspicious activity, the WAF and DDoS protection automatic filtering of malicious requests stands out. Transitioning to Cloudflare gave us a unified platform, and the initial setup was easier than with previous vendors like Akamai. Review collected by and hosted on G2.com.

I think troubleshooting and visibility could be worked on. When something goes wrong, it can be difficult to determine if it's a Cloudflare rule or origin behavior. I think unified request tracing and clear 'WHY WAS THIS BLOCKED' explanations would help clear it up. Review collected by and hosted on G2.com.

I like how Cloudflare Application Security and Performance combines security and performance in one platform. The WAF and security rules give us good control over suspicious traffic, while the CDN helps improve website loading times and reduces the number of requests reaching our origin servers. I also appreciate the visibility it provides. Being able to quickly check traffic patterns, security events, and blocked requests from one dashboard makes troubleshooting much easier. The flexibility to create custom rules is a feature we use often, especially with specific applications or unusual traffic. The WAF and custom rules are particularly useful, allowing us to control incoming traffic. The security event dashboard is great for troubleshooting as it helps us understand where suspicious traffic is coming from. The ability to adjust rules without making changes directly on the server is a big advantage. The initial setup was quite straightforward, particularly for those familiar with DNS and server configurations. Review collected by and hosted on G2.com.

One area that could be improved is the complexity of some of the advanced security and WAF settings. There are many options available, which is useful for experienced users but can take some time to understand and configure correctly. It would also be helpful to have more detailed explanations or recommendations when creating custom rules, especially around the potential impact of a rule before applying it. In some cases, finding the right balance between blocking unwanted traffic and avoiding false positives requires some trial and error. I think the WAF experience could be made more intuitive by providing clearer explanations alongside advanced rule options, especially for users who are configuring them for the first time. A guided rule builder with more practical examples would make it easier to understand what a rule will actually do before applying it. It would also be useful to have a preview or simulation mode that shows which existing requests would be affected by a new rule. Better recommendations based on observed traffic and clearer warnings about possible false positives would make rule creation safer and reduce the amount of trial and error involved. Review collected by and hosted on G2.com.

I like that Cloudflare Application Security and Performance handles both security and performance in one place. It's easy to manage, keeps the site fast, reliable, and provides an extra layer of protection against threats and unwanted traffic. It works in the background without needing a lot of maintenance, making it fast, secure, and reliable. The dashboard is easy to see what's happening. I also like the visibility it gives us into traffic and analytics, which are helpful. Features like caching and automatic threat protection work well without requiring constant attention. Together, these features make the site faster and more secure without needing a lot of hands-on management from us. Review collected by and hosted on G2.com.

The dashboard can feel a little overwhelming at first because there are so many settings and features. Some of the more advanced security options could also be explained more clearly, especially for people who aren't highly technical. Making the setup and customization process more intuitive would be a big improvement. I think the setup would be easier if Cloudflare offered more guided recommendations based on what you're trying to accomplish. A simpler onboarding flow that suggests the most important security settings and explains what each one does in plain language, while clearly showing the impact of turning a feature on or off, would be beneficial. It would also help to have a beginner-friendly preset so you don't feel like you need technical expertise to figure everything out. Review collected by and hosted on G2.com.

I like most about this product because it provides both security and performance into a single platform and also it gives us WAF and DDoS protection for our application traffic. Review collected by and hosted on G2.com.

I dislike about this product is that it is time-consuming and complex while creating WAF rules and also need to configure the WAF rules, bot protection, and more that takes more time and also need more experience to configure rules. Review collected by and hosted on G2.com.

Cloudflare offers a strong mix of security, performance, and reliability. The WAF and DDoS protection are especially helpful for shielding applications from malicious traffic, and the CDN improves response times and overall application performance. I also appreciate the visibility and control available in the dashboard, as well as the flexibility to tailor security and traffic rules to specific requirements. Review collected by and hosted on G2.com.

There’s a bit of a learning curve when you start configuring some of the more advanced security and routing features. With so many options available, the dashboard can feel overwhelming at first until you get used to where everything is. Also, some of the more advanced capabilities are only available on higher-tier plans. Review collected by and hosted on G2.com.

The global edge network speed and immediate mitigation capabilities are top-tier. The UI / UX of the dashboard is remarkably clean and well-organized, allowing us to manage DNS, SSL/TLS, and WAF rules from a single interface. The Performance impact is immediate—caching and edge routing significantly reduce origin latency, while its Integrations via API and Terraform provider make infrastructure-as-code deployments effortless. Review collected by and hosted on G2.com.

While the base tiers offer great value, the Pricing / ROI jump to Enterprise plans for advanced features like Bot Management, custom rate limiting, or raw log streaming can be steep. Additionally, during initial Support / Onboarding, troubleshooting false positives on complex, custom WAF firewall rules requires a bit of fine-tuning and log analysis before reaching optimal tuning. Review collected by and hosted on G2.com.

What I like the most is the security. I like that it processes everything in a single step on the server closest to the user, also its global-scale DDoS mitigation without any problem and its intelligent performance.

It allows me to manage DNS, SSL certificates, firewall rules, ... Review collected by and hosted on G2.com.

What I like the least is the WAF and the false positives, as well as the gap between the features of the plans offered, since there is a big difference between choosing one or the other, the technical support is quite basic in the basic plans, and the loss of direct visibility. Review collected by and hosted on G2.com.

What I like most about Cloudflare Application Security and Performance is how it brings security and performance together in a single platform. Features like the Web Application Firewall (WAF), DDoS protection, Bot Management, Rate Limiting, and SSL/TLS help protect applications against a broad range of threats while keeping operational overhead low. At the same time, Cloudflare’s global CDN, intelligent caching, image optimization, and content delivery noticeably improve website performance and reduce latency for users around the world. I also appreciate the intuitive dashboard, flexible rules engine, and detailed analytics, along with the seamless integration with DNS and Zero Trust services, which makes it straightforward to manage and monitor applications from one place. Overall, it feels like a reliable, scalable, and easy-to-manage solution for securing and accelerating web applications. Review collected by and hosted on G2.com.

While Cloudflare provides a broad and capable feature set, some of the more advanced capabilities are limited to higher-tier plans, which can make enterprise deployments relatively expensive. The Rules Engine, WAF policies, and caching configurations are powerful, but they come with a learning curve, especially for teams that are new to the platform. Troubleshooting caching-related issues, complex rule interactions, or unexpected traffic behavior can also take time and often requires careful, methodical analysis. In addition, since Cloudflare releases new features frequently, staying current with changes and evolving best practices requires ongoing learning. Overall, these feel like manageable trade-offs given the platform’s capabilities and reliability. Review collected by and hosted on G2.com.

It allows you to disable and enable WAF rules that have custom firewall rules. For example: I can block specific user agents, browsers, locations and also machine learning is applied to it as well. Review collected by and hosted on G2.com.

It would be nice to be able to tailor the experience by specific user IDs or associate some sort of risk score / behavioral analysis. For example if someone is moving through the experience and passes the WAF rules BUT is still fraudulent, they may do different things than a specific user. Review collected by and hosted on G2.com.

What I like most about Cloudflare Application Security and Performance is that it brings strong security and fast performance together in one platform. Features like the Web Application Firewall (WAF), DDoS protection, and the CDN work seamlessly as a set, so it’s easy to protect applications while also improving load times and the overall user experience. The dashboard feels intuitive, and managing security rules is straightforward without adding unnecessary complexity. Review collected by and hosted on G2.com.

One thing I dislike is that some of the more advanced security features are only available on higher-tier plans, which can get expensive for smaller businesses. On top of that, the sheer number of configuration options can feel overwhelming at first. When issues come up, troubleshooting sometimes means digging through the documentation to find the right details. Review collected by and hosted on G2.com.