WAF

The WAF is one of the best value propositions on the platform: managed rulesets that actually get updated when CVEs drop (often same-day), plus custom rules built on the same wirefilter expression language used across the whole product line. Free plans get a real baseline; paid plans get the full managed rulesets.

Custom rules are where it shines. The expression builder is genuinely pleasant, and being able to combine bot scores, ASNs, JA4 fingerprints, header inspection, and URI patterns in one rule can replace entire categories of application code.

It loses a point for debuggability. When a legitimate request gets challenged or blocked, tracing why through Security Events sometimes feels like archaeology, and false positives on webhook traffic have bitten me more than once. Still: for the price, nothing else comes close.