# Cloudflare WAF vs an in-app firewall for Node.js - ApiTraffic

> Cloudflare decides whether a request gets in. ApiTraffic records what happened after it did, with a firewall inside your Node.js app.

Source: https://dev.apitraffic.io/vs/cloudflare-waf

ApiTraffic vs Cloudflare WAF

# ApiTraffic vs Cloudflare WAF for Node.js APIs

Cloudflare decides whether a request gets in. We record what happened after it did. Those are different jobs, and the gap between them is where most API incidents live.

[Start your free trial](https://dev.app.apitraffic.io/signup?src=vs-cloudflare-waf)[See pricing](/pricing)

The honest version

## Which one fits

### Choose Cloudflare WAF if

- **Volumetric DDoS:** by the time a request reaches middleware it has already cost you a connection, so an edge is the place to absorb a flood.
- **Telling browsers from bots** with JavaScript and CAPTCHA challenges, which an in-app firewall cannot issue.

- **Strangers:** unknown IPs, bad signatures and known-bad patterns, stopped before they reach your servers.

### Choose ApiTraffic if

- **A legitimate key behaving unlike itself:** enumerating IDs one at a time, pulling fifty times its normal volume on a Sunday, or walking endpoints it has never touched. That traffic passes every edge check, because it is a customer.
- **The parsed request your handler is about to see,** inspected as middleware, with OWASP managed rules, rate limits, IP and country lists and behavioral protection.

- **Every verdict on the same record as the trace,** so you can find every other request from that caller in one click and decide whether the block was right.
- **Monitor first, enforce when ready:** see exactly what a rule would have blocked before it blocks anything.

Pricing

## How each one bills

Cloudflare’s WAF comes with Cloudflare’s own plans; compare the current numbers there.

ApiTraffic’s firewall is part of the same product as its logging, APM and alerting; the published [pricing page](/pricing) shows what each plan includes.

Switching

## Running both, or moving over from Cloudflare WAF

**Keep Cloudflare.** We’re the layer inside your app where the caller has a name, a history, and a bill.

Turn the ApiTraffic firewall on in monitor mode, read what it would have blocked for a week, then enforce the rules you agree with.

## Know what your API did - before your customers tell you.

One npm install and one line of code. Your first requests arrive in minutes, with their queries, their firewall verdict and a baseline for every endpoint already building.

[Start your free trial](https://dev.app.apitraffic.io/signup?src=vs-cloudflare-waf-closing)

Free trial · No credit card · Set up in minutes