This document describes WAAP billing structure, plan capabilities, Domain / Zone definition, and plan management.
Detailed pricing information is available on the Security pricing page.
Plan details
The following table outlines feature availability across WAAP plans. Features marked as Add-on are available as separately purchasable additions to the base plan.
| Feature | Free | Start | Pro | Enterprise |
|---|
| IP Firewall | | | | |
| DenyList / AllowList | ❌ | ✅ | ✅ | ✅ |
| IP Reputation | ❌ | ❌ | ✅ | ✅ |
| Default Rules | | | | |
| OWASP Threats | ✅ | ✅ | ✅ | ✅ |
| Behavioral WAF | ❌ | ❌ | Add-on | Add-on |
| CMS Protection | ❌ | ❌ | Add-on | Add-on |
| Custom Rules | | | | |
| WAF Rules | ❌ | ✅ | ✅ | ✅ |
| Basic rate-limits | ❌ | ✅ | ✅ | ✅ |
| Advanced rules | ❌ | ❌ | Add-on | Add-on |
| Bot Management | | | | |
| Automated threats | ❌ | ❌ | Add-on | Add-on |
| Known Bots | ❌ | ❌ | Add-on | Add-on |
| Threat Intelligence | | | | |
| Security Insights | ❌ | ❌ | ❌ | Add-on |
| IP Spotlight | ❌ | ❌ | ❌ | Add-on |
| API Security | | | | |
| API Discovery | ❌ | ❌ | ❌ | Add-on |
| API Protection | ❌ | ❌ | ❌ | Add-on |
Domains / Zones
A Domain / Zone is a WAAP billing and configuration unit.
It represents one CDN resource with a single WAAP configuration. Multiple domains and aliases can be grouped into the same Domain / Zone when they:
- Redirect to the same origin.
- Share the same CDN configuration.
- Use the same WAAP security settings.
In this case, all linked domains are managed as one configuration and billed as one Domain / Zone.
A single domain can also be split into multiple configurations. For example:
portal.domain.comadmin.domain.comapi.domain.com
If these subdomains are mapped to different CDN resources and require separate WAAP configurations, each one is counted and billed as a separate Domain / Zone.
Plan management
WAAP plans are available as either self-serve or sales-assisted offerings.
- Free, Start, and Pro plans are self-serve and can be activated directly through the Gcore Customer Portal.
- The Enterprise plan is available through direct engagement with Gcore Sales and supports custom terms and enterprise agreements.
Trial
When a WAAP plan is activated, a trial period applies according to the selected plan.
- Paid plans include a 30-day trial with full access to the features available in that plan.
- Service usage is limited by the included traffic and plan quotas.
- The trial ends when 30 days have elapsed or when the included quota is exceeded.
A credit card is not required to start.
If no payment method is added and the included quota is reached, service consumption is stopped.
If a credit card is added, service continues without interruption. Usage remains free until the included quota is reached. Any usage beyond the included quota is billed according to the selected plan.
Billing for disabled domains
When a WAAP-protected domain is disabled, the following billing rules apply:
- Traffic is not processed. No requests are inspected or counted while the domain is disabled.
- The domain is counted for the current billing month. If you disable a domain mid-month, it counts as one Domain / Zone for that billing period.
- The domain is not counted in subsequent months. Starting from the next billing month, a disabled domain no longer appears in your usage metrics.
To avoid being billed for a domain in a given month, disable it before that billing month begins.
