Side by side
Cloudflare Gateway vs OWASP Coraza WAF
Both stand on web security software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan AndroidAPIiPhone+4
Visit Cloudflare Gateway 
Free plan APILinuxMac+1
Coraza offers several deployment forms, a broad connector list, and Core Rule Set compatibility for API and web application protection. Teams needing persistent collections such as IP, SESSION, or RESOURCE should account for their current lack of support in v3.
Visit OWASP Coraza WAFThe facts
| Cloudflare Gateway | OWASP Coraza WAF | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | No | Not published |
| Runs on | Android, API, iPhone, Linux, Mac, Web, Windows | API, Linux, Mac, Self-hosted |
| Lowest paid plan | See the plans | Free or on request |
| Plans published | 5 | 1 |
| Maker | Not published | Not published |
| Website | cloudflare.com | coraza.io |
| On web security software | #1 of 29 | #4 of 29 |
Cloudflare Gateway: what it does well
OWASP Coraza WAF: what it does well
- Free, open-source plan.
- Compatible with the OWASP Core Rule Set.
- Can run as a sidecar, proxy, or library.
- Official connectors include NGINX and Envoy.
- Provides a sandbox for testing rules.
What to know first
- Requires Go 1.24 or later for the Quick Start.
- Persistent collections are not supported in Coraza v3.
Alternatives to Cloudflare Gateway Alternatives to OWASP Coraza WAF The whole list