Billing rules of subscription and pay-as-you-go WAF 3.0 instances - Web Application Firewall

Web Application Firewall (WAF) 3.0 supports the subscription and pay-as-you-go billing methods. The subscription billing method is more suitable for budget-conscious customers, customers whose resource usage is relatively stable, and customers who require resources for long-term use. The pay-as-you-go billing method is more suitable for customers who require resources for short-term use. This topic describes the scenarios, billable items, billing cycles, and activation methods of subscription and pay-as-you-go WAF instances.

Billing methods

WAF 3.0 supports the subscription and pay-as-you-go billing methods to meet your requirements in different scenarios. The following table describes the differences between the billing methods.

Billing attribute	Subscription	Pay-as-you-go
Activation method	Web Application Firewall 3.0 (Subscription) buy page	Web Application Firewall (Pay as you go) buy page
Billing method	The subscription billing method requires you to pay for resources before you can use the resources. You are charged based on the subscription duration in the order.	The pay-as-you-go billing method allows you to use resources before you pay for the resources. You are charged based on your resource usage. Bills are generated and fees are deducted from the balance of your Alibaba Cloud account at the end of each billing cycle. When you use the pay-as-you-go billing method, you can also use security capacity unit (SeCU) resource plans to help reduce costs.
Scenario	Your resource usage is stable and predictable. Your web services require long-term WAF protection. Your web services are added to WAF in hybrid cloud mode or management of your web services is complex.	Your resource usage frequently fluctuates. Your resource usage is temporary and sudden.
Billable item Important The product and service prices may change. Refer to your Alibaba Cloud bill for the final amount. If you enable WAF protection for an Application Load Balancer (ALB) instance, you are charged by WAF and ALB. For more information about the billing rules of WAF-enabled ALB instances, see Activate and manage WAF-enabled ALB instances.	Basic feature fees (required): fees for the edition, specifications, and subscription duration that you specify when you purchase the subscription WAF instance. Value-added feature fees (optional): fees for value-added features. You can enable one or more value-added features based on your business requirements. You must pay for value-added features before you can use the features. This does not apply to the burstable QPS (pay-as-you-go) and risk identification features, which are billed on a pay-as-you-go basis.	Request processing fees: fees for request processing within an hour. Feature fees: fees for different features within an hour. Note You can use SeCU resource plans to offset request processing fees and feature fees. For more information about the offset rules, see SeCU resource plans.
Billing cycle	The billing cycle of a subscription WAF instance is the subscription duration that you specify when you purchase the WAF instance.	Bills for pay-as-you-go WAF instances are generated and settled on a daily basis based on UTC+8 time. After a bill is settled, a new billing cycle begins until you terminate your WAF service.
Billing unit	USD	SeCU Note Pay-as-you-go WAF 3.0 uses SeCUs as billing units. 1 SeCu = USD 0.01.
Major event protection fee	If you enable the major event protection feature, you are charged based on the subscription duration of the feature. The minimum subscription duration is 30 days. For more information about the major event protection feature and the fees for the feature, see Major event protection.
Details	Subscription billing overview	Pay-as-you-go billing overview SeCU resource plans

Billing processes

This section describes the billing processes of WAF based on the subscription and pay-as-you-go billing methods.

Pay-as-you-go

The following figure shows the billing cycle management of a pay-as-you-go WAF instance.

Purchase a WAF instance

Visit the Web Application Firewall (Pay as you go) buy page to purchase a pay-as-you-go WAF instance. We recommend that you configure the Traffic Billing Protection Threshold parameter when you purchase the instance.

Note

To avoid unexpected fees caused by traffic surges when you use a pay-as-you-go WAF instance, we recommend that you configure the Traffic Billing Protection Threshold parameter when you purchase the instance. You can also configure the Traffic Billing Protection Threshold parameter after you purchase the instance to meet your business requirements. For more information, see Specify a threshold value for traffic billing protection.

Visit the WAF 3.0 SeCU Resource Plan buy page to purchase SeCU resource plans. You can use SeCU resource plans to offset traffic processing fees and feature fees when you use a pay-as-you-go WAF instance. This helps reduce costs.

Add web services to WAF for protection

If you enable the major event protection feature, you are charged based on the subscription duration of the feature. For more information, see Major event protection.
If you use a pay-as-you go WAF instance, you are charged request processing and feature fees. For more information, see Billing overview.

Sandbox

If a WAF instance is added to the sandbox and the peak queries per second (QPS) of the WAF instance is less than the value of the Traffic Billing Protection Threshold parameter, the WAF instance is automatically removed from the sandbox. You can reconfigure the Traffic Billing Protection Threshold parameter to prevent the WAF instance from being added to the sandbox again. For more information, see Sandbox overview.

Generate bills and deduct fees

You can use SeCU resource plans or account balance to offset fees.
Note
When a SeCU resource plan is exhausted or expires, fees are deducted from your Alibaba Cloud account balance to settle your bill. You can use SeCU resource plans to offset fees only if no overdue payments exist within your Alibaba Cloud account.
You can view daily bills and billing details. For more information, see View daily bills and View billing details.

Overdue payments

If overdue payments exist within your Alibaba Cloud account and you want to use the pay-as-you-go billing method, we recommend that you add funds to your account in the Expenses and Costs console at the earliest opportunity. For more information about the status changes of resources when overdue payments exist, see Overdue payments.

Terminate the WAF service

If you no longer use a WAF instance and no requests or a few requests are redirected to the WAF instance, you can terminate the WAF service. Before you terminate the WAF service, make sure that your business data is backed up or migrated and your workloads are not affected. You are no longer charged from the second day after you terminate the WAF service. For more information about how to terminate a WAF service, see Terminate a WAF service.
If you purchased a SeCU resource plan within the previous five days for a pay-as-you-go WAF instance and the SeCU resource plan was not used, you can submit a ticket to apply for a refund.

Subscription

The following figure shows the billing cycle management of a subscription WAF instance.

Purchase a WAF instance

Visit the Web Application Firewall 3.0 (Subscription) buy page to select a WAF edition based on your business requirements.

Note

You can use the risk identification and burstable QPS (pay-as-you-go) features before you pay for the features. Only the Pro, Enterprise, and Ultimate editions support the features. For more information, see Risk identification and Burstable QPS (pay-as-you-go). We recommend that you configure the Extended QPS and Threshold of Burstable QPS (Pay-as-you-go) parameters when you purchase a subscription WAF instance. This prevents the WAF instance from being added to the sandbox when the actual peak QPS of the WAF instance exceeds the current QPS specifications. For more information, see Sandbox overview.

Add web services to WAF for protection

If you enable the major event protection feature, you are charged based on the subscription duration of the feature. For more information, see Major event protection.
If you use a subscription WAF instance, you are charged basic feature fees and value-added feature fees. Basic feature fees are required, and value-added feature fees are optional. For more information, see Subscription WAF instance fees.

Sandbox

If a WAF instance is added to the sandbox, you must upgrade the WAF instance, purchase an additional QPS quota, or enable the burstable QPS (pay-as-you-go) feature to remove the WAF instance from the sandbox. For more information, see Remove a WAF instance from the sandbox.

Upgrade or downgrade a WAF instance

You can upgrade or downgrade the edition of your WAF instance. You can also upgrade or downgrade the specifications of the value-added features that you purchased. For more information, see Upgrade and Downgrade.

View bills

You can view daily bills and billing details. For more information, see View daily bills and View billing details.

Overdue payments and renewal

Overdue payments: You can use your subscription WAF instance as expected even if overdue payments exist within your Alibaba Cloud account because you already paid for the resources. However, you cannot perform operations that generate fees, such as upgrading the instance specifications and renewing the instance. In addition, you cannot perform operations related to the risk identification and burstable QPS (pay-as-you-go) features. For more information about the status changes of resources when overdue payments exist, see Overdue payments.
Renewal: You can renew a WAF instance. WAF supports manual renewal and auto-renewal. For more information, see Renewal policy.

Release a WAF instance

If a WAF instance that you no longer use expires, you can release the WAF instance. For more information about the release rules and how to release a subscription WAF instance, see Release a subscription WAF instance.

Switch between billing methods

Switch the billing method from subscription to pay-as-you-go: This operation is not supported. You can purchase a pay-as-you-go WAF instance after your subscription WAF instance expires and is released. For more information, see Switch between billing methods.

Switch the billing method from pay-as-you-go to subscription: This operation is not supported. You can purchase a subscription WAF instance after you terminate the pay-as-you-go WAF service. For more information, see Switch between billing methods.

Renewal

If you do not renew a subscription WAF instance after the WAF instance expires, the protection effect of your website is affected. If your WAF instance expires, the instance no longer provides services. To ensure service continuity, we recommend that you enable auto-renewal or manually renew your instance before your instance expires. For more information about how to renew a subscription WAF instance, see Renewal policy.

Note

If you use a pay-as-you-go WAF instance, you are charged based on your actual resource usage. You do not need to renew your pay-as-you-go WAF instance.
You cannot renew or upgrade a SeCU resource plan. You can purchase multiple SeCU resource plans or a SeCU resource plan that has a high specification. For more information about how to purchase a SeCU resource plan, see Purchase a SeCU resource plan.

Release a WAF instance

If you no longer use WAF for protection, you can release your subscription WAF instance, terminate the WAF service for your pay-as-you-go WAF instance, or unsubscribe from SeCU resource plans if specific requirements are met. For more information, see Release a WAF instance.

Note

If you purchase a subscription WAF instance and enable hybrid cloud protection, bot management for web application protection, bot management for app protection, major event protection, or API security, you cannot release the WAF instance in the WAF console. To release a WAF instance in this scenario, submit a ticket or contact your account manager.
If you purchased a SeCU resource plan within the previous five days for a pay-as-you-go WAF instance and the SeCU resource plan was not used, you can submit a ticket to apply for a refund.

Overdue payments

If the credits in your Alibaba Cloud account, including your account balance and vouchers, are insufficient to cover the bill amount to be settled, the bill is considered overdue. Overdue payments may result in service interruptions. We recommend that you regularly check your account balance and ensure that you have sufficient funds to ensure business continuity.

You can use your subscription WAF instance as expected even if overdue payments exist within your Alibaba Cloud account because you already paid for the resources. However, you cannot perform operations that generate fees, such as upgrading the instance specifications and renewing the instance. In addition, you cannot perform operations related to the risk identification and burstable QPS (pay-as-you-go) features. If you use a pay-as-you-go WAF instance and overdue payments exist within your Alibaba Cloud account, instance suspension occurs. In this case, WAF resources become unavailable and billing for the resources stops. If you do not settle your overdue payments within a specified period of time, Alibaba Cloud releases your WAF instance and deletes its data. The deleted data cannot be restored.

For more information about how to view resource status and the related handling methods if overdue payments exist within your Alibaba Cloud account, see Overdue payments.

View bills

After you purchase a subscription or pay-as-you-go WAF instance, you can view the resource usage and fees on the Bills page in the WAF console and view bills in the Expenses and Costs console. For more information about how to view WAF bills, see View bills.