What can a free WAF do, and what are its features and limitations?

A free WAF can monitor and filter traffic coming into a website. Depending on the product and plan, it may also offer features such as allowlists and blocking logs. But “free” does not mean the same features are included: some WAFs come bundled with specific hosting plans, while others are part of WordPress security plugins. Support for custom rules and exceptions also varies. The overview below draws on the product descriptions and configuration examples in the supplied material, without treating historical articles as commitments about current plans.

Beyond traffic filtering, check whether you can review logs and address false positives

A hosting overview on Mobile01 describes the main purpose of a WAF as monitoring and filtering website traffic. The free service covered in that article also offers two specific features, but this does not mean all free WAFs provide them:

• Blocking logs: These let users check which pages have been blocked, providing clues for reviewing how the protection is working.
• Allowlists: The article demonstrates adding a page to an allowlist after discovering that it was incorrectly blocked.

This example shows that evaluating features involves more than asking whether protection can be enabled. It also means asking whether you can see what was blocked and make adjustments after a false positive. However, this is a guide to using a specific service, not a set of configuration steps that applies to other products.

Not every feature in a security plugin is a WAF capability

An article by Welly dated January 2025 describes the free version of Wordfence as including a website firewall, malware scanning, real-time traffic monitoring, two-factor authentication, and reCAPTCHA. This serves as an example of a WordPress security plugin’s features, but not every feature in the plugin should be attributed to its WAF, nor should other free WAFs be assumed to offer the same features.

The article also cautions that Wordfence consumes hosting resources, which may affect performance on lower-spec hosting, and recommends using a caching plugin alongside it. This is the article’s usage advice, not a claim that every website will slow down. It provides no measurements for estimating the extent of any impact.

Free access may depend on your hosting plan, with advanced rules requiring an upgrade

The free WAF described in the Mobile01 article mentioned above is available only with the “WordPress hosting” and “semi-dedicated hosting” plans specified in that article. Here, “free” means an extra included with particular hosting services, not a standalone free tool available to any website.

The author also suggests considering the paid version if additional custom security rules or more advanced features are needed. This does not mean every free plan lacks custom rules. When choosing a service, check each required feature and whether access is tied to a hosting plan.

An allowlist does not necessarily bypass every protection

A technical article on iThome states that, in the Cloudflare configuration it describes, the Skip action in WAF custom rules can apply to Browser Integrity Check and Super Bot Fight Mode, but cannot bypass the free version’s Bot Fight Mode because the latter does not run on the Ruleset Engine.

This example highlights that whether a rule works depends on which protection it applies to. Having an allow rule does not mean every check will allow the traffic through. The supplied material does not provide the article’s date, so it is included here only as a technical example, not as a guarantee about configuration options in current plans.