# Do you need a web application firewall for a small app in 2026?

Last updated: 2026-11-10

Most small apps don't need to buy a separate web application firewall on day one. Start with the filtering your host already does, keep your framework and dependencies patched, and add a WAF when you take payments, run an exposed admin or login page, or see abusive traffic in your logs. When you do add one, **Bunny Shield** and **Gcore** are European services with free tiers, **Cloudflare** has a free plan with a basic managed ruleset, and **Coraza** with the OWASP CRS is the free option you run yourself.

## WAF options at a glance

| Platform | Company | Free tier | First paid step | Rules you write |
|---|---|---|---|---|
| Eurobase | Warsaw, Poland | Included with hosting | Starter €10 a month + VAT | Not documented |
| Bunny Shield | BunnyWay d.o.o., Ljubljana, Slovenia | Basic, 71 managed rules | Advanced, $9.50 a month | On higher tiers |
| Gcore WAAP | Gcore, Luxembourg | 1 domain, 0.5M requests | Start, €25 a month | 5 custom rules on Start |
| Coraza + OWASP CRS | Open-source OWASP projects | Free software | Your own server time | Yes |
| Cloudflare | Cloudflare, Inc., San Francisco | Free Managed Ruleset, custom rules, one rate limiting rule | Pro, $20 a month billed yearly or $25 monthly | Yes |
| Vercel | Vercel Inc., terms under California law | Up to 3 custom rules on Hobby | Rate limiting, $0.50 per million allowed requests | Yes |

Prices are from each provider's own page, checked on 9 and 10 November 2026.

## What a WAF does, and what it can't

A web application firewall reads each HTTP request before your app does and drops the ones that match known attack patterns. The OWASP Core Rule Set, which many WAFs use, lists the kind of thing it catches: SQL injection, cross-site scripting, local and remote file inclusion, shell and code injection, and scanners and bots probing for weak spots.

What it can't do is understand your app. The top risk in the OWASP Top 10:2025 is broken access control, and a request that reads another customer's invoice through a missing permission check looks perfectly normal to a firewall. The same goes for leaked secrets, weak passwords and a vulnerable package in your build. A WAF buys you time while you patch. It doesn't replace the patch.

## What to check before you add one

- **What your host already filters.** Many platforms block floods and obvious attacks before your code runs. Read their terms or security page so you don't pay twice.
- **Whether you have something worth attacking.** A login form, a checkout, file uploads or an API with user data raise the stakes far more than a brochure site does.
- **False positives.** Managed rules sometimes block real users, for example a form field that contains code or SQL. Pick a service with a log-only or learning mode and watch it before you switch to blocking.
- **Body inspection limits.** Rules only see the first part of a large request body. Bunny Shield inspects 256 KB on its free tier and Cloudflare 1 MB on its Free plan.
- **Who sees your traffic.** A cloud WAF decrypts every request, so the company running it processes your visitors' data. With a company based in the EU, that processing stays with a business under EU law; see [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act).
- **Price at your traffic.** Several WAFs bill per million requests once you pass the included amount, so estimate your monthly requests before you pick a tier.

## 1. Eurobase

Eurobase is a hosting platform for web apps, Workers, containers and Functions, on European infrastructure run by Scaleway, a French provider. Its terms say automated tools filter attack traffic and enforce rate limits, and its privacy policy describes requests blocked for restricted paths, kept in an encrypted archive for 90 days that no one, staff included, can change or delete.

- **Best for:** small apps that want baseline filtering included in the hosting price.
- **Price:** a Free plan, then €10 or €20 a month + VAT per workspace. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.
- **What it lacks:** the docs don't describe custom WAF rules, IP block lists you manage or a managed OWASP ruleset you can switch on. ISO 27001 and SOC 2 are still in progress.

## 2. Bunny Shield

Bunny Shield is the security layer of bunny.net, run by BunnyWay d.o.o. in Slovenia. It bundles a managed WAF, DDoS protection, rate limiting, bot mitigation, access lists and upload scanning, all filtered at its edge.

- **Best for:** a small team that wants a self-service European WAF with a free start.
- **Price:** Basic is free with 71 managed WAF rules and a 256 KB body inspection limit. Advanced costs $9.50 a month and raises those to 255 rules and 512 KB, and Business is $99 a month. Overage is billed per million requests, from $0.60 to $0.70 depending on tier. There's a 14-day trial with no card.
- **What it lacks:** euro pricing. Its block and challenge page is bunny.net branded on the free tier.

## 3. Gcore WAAP

Gcore sells web application and API protection as a reverse proxy that sits in front of any origin or CDN. You point your domain at Gcore, start with managed OWASP rules and L7 DDoS monitoring, review the traffic, then switch to blocking.

- **Best for:** apps with a public API that want schema validation and bot management later without changing provider.
- **Price:** Basic is free for 1 domain and 0.5 million requests, then €2 per million. Start is €25 a month for 5 domains, 1 million requests and 5 custom rules. Pro is €125 a month with 20 custom rules and IP reputation.
- **What it lacks:** an EU-only footprint. Gcore runs more than 210 points of presence worldwide, so ask where your traffic is inspected if that matters to your contracts.

## 4. Coraza with the OWASP Core Rule Set

Coraza is an OWASP open-source WAF engine written in Go, compatible with the Core Rule Set. It runs as a library, a sidecar or a proxy, with connectors for Caddy, NGINX, HAProxy and Envoy. The rule set's current release is 4.30.0, with 4.25.2 as the long-term support line.

- **Best for:** apps on your own server or VPS where you already run a reverse proxy.
- **Price:** free software. You pay for the server and your own time.
- **What it lacks:** someone to tune it. Expect to spend time on false positives and rule updates, and it does nothing against floods that saturate your server's network.

## 5. Cloudflare

Cloudflare's WAF is available on every plan. The Free plan includes custom rules, one rate limiting rule and the Free Managed Ruleset, which covers high-impact, widely exploited vulnerabilities. The fuller Cloudflare Managed Ruleset and its OWASP Core Ruleset start on Pro.

- **Best for:** sites that already use Cloudflare DNS and want protection at no cost.
- **Price:** Free at $0, Pro at $20 a month billed yearly or $25 monthly, Business at $200 a month billed yearly.
- **What it lacks:** EU headquarters. Cloudflare, Inc. is based in San Francisco.

## 6. Vercel Firewall

If your app already lives on Vercel, its firewall is built in. DDoS mitigation, IP blocking and custom rules are free on all plans, and blocked traffic doesn't count toward your usage.

- **Best for:** apps already hosted on Vercel.
- **Price:** Hobby allows 3 custom rules and 10 IP blocks per project, Pro 40 of each. Rate limiting costs $0.50 per million allowed requests.
- **What it lacks:** the OWASP core ruleset outside Enterprise, and an EU-based operator. Vercel Inc. sets its terms under California law.

## How to choose

1. Read what your host already blocks. If it filters floods and attack traffic, a brochure site or side project can stop there.
2. Patch first. Keep dependencies current and check access control on every route that returns user data.
3. When you add a login, payments or uploads, put a managed WAF in front in log-only mode for a week, then turn on blocking. The [GDPR hosting checklist](/i/gdpr-hosting-checklist) covers the contracts that come with it.
4. Want it European and self-service? Try Bunny Shield or Gcore on their free tiers. Already on your own server? Add Coraza to the proxy you run.

## Frequently asked questions

### Is a WAF required for GDPR?

No. GDPR asks for security appropriate to the risk, not for a specific product. A WAF can be part of that, but if it's a cloud service it also becomes a processor of your visitors' data, so it needs a DPA.

### Do I need a WAF and a CDN?

They're separate jobs that are often sold together. A CDN caches and delivers files; a WAF inspects requests. Bunny.net and Gcore offer both. See [European CDN providers](/i/cdn-europe) if you need the delivery side too.

### Will a WAF slow my app down?

It adds a hop and some inspection on every request. Coraza advertises inspection measured in microseconds, and edge WAFs run close to your visitors, so the cost is usually small next to your app's own response time. Measure before and after.

### Does Eurobase have a WAF?

According to its terms, automated tools on the platform filter attack traffic and enforce rate limits. Its docs don't describe rules you can write yourself, so if you need custom rules, put a WAF service in front of your domain.

## Sources

- [OWASP Top 10:2025](https://owasp.org/Top10/2025/) and [OWASP CRS](https://coreruleset.org/)
- [OWASP Coraza](https://coraza.io/)
- [Bunny Shield](https://bunny.net/shield/)
- [Gcore WAF and API security](https://gcore.com/security/waf)
- [Cloudflare plans](https://www.cloudflare.com/plans/), [Cloudflare WAF](https://developers.cloudflare.com/waf/) and [Cloudflare managed rules](https://developers.cloudflare.com/waf/managed-rules/)
- [Vercel Firewall](https://vercel.com/docs/vercel-firewall), [Vercel WAF limits](https://vercel.com/docs/vercel-firewall/vercel-waf) and [Vercel WAF pricing](https://vercel.com/docs/vercel-firewall/vercel-waf/usage-and-pricing)
- [Eurobase terms](/legal/terms), [Eurobase privacy policy](/legal/privacy), [Eurobase plans and limits](/docs/plans) and [Eurobase pricing](/pricing)