European Alternatives to F5
Looking for a European alternative to F5? F5, Inc. is headquartered at 801 5th Ave in Seattle and sells web application and API protection (web application firewall, API security, bot management, DDoS protection) together with load balancing, DNS and CDN, through BIG-IP, NGINX and the Distributed Cloud Services platform. Products come as hardware, virtual editions and SaaS, sold as term subscriptions, a Flex Consumption Plan or perpetual licences, with prices on request.
The European tools below cover the WAF and API protection side with providers in Germany, Switzerland, France, Luxembourg, Slovenia, Hungary, Estonia and the Netherlands, as cloud services, self-hosted gateways or open-source engines.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA or Switzerland, and processes customer data in Europe. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Paid placement can affect which tools appear here and the order they appear in. Editorial policy
11 European Alternatives to F5
Myra Security
German security platform with a WAF, DDoS filter and CDN
Airlock
Swiss WAF and API gateway from Ergon Informatik
Link11
German cloud WAF with AI-based DDoS filtering
Gcore
Luxembourg edge platform with WAF and DDoS protection
Bunny.net
Slovenian CDN with a Shield WAF tier that starts free
BunkerWeb
Open-source WAF reverse proxy from Agen, self-hosted or SaaS
WEDOS Protection
Czech-founded CDN shield with a managed WAF and free plan
CrowdSec
French open-source security engine with a WAF component
BitNinja
Hungarian server-side WAF for Linux hosting fleets
Patchstack
Estonian virtual patching for WordPress and open-source code
Sansec
Dutch Magento-aware firewall installed as a Composer module
Key takeaways
- F5, Inc. is headquartered in Seattle, and its privacy notice names the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as its data transfer mechanisms.
- F5 sells its web application firewall as F5 WAF for BIG-IP on hypervisors, public clouds or hardware, and the pages checked on 20 October 2026 show no price.
- Airlock from Ergon Informatik in Zurich is the European tool closest to a self-operated BIG-IP WAF, delivered as a virtual appliance, cloud image or Kubernetes Microgateway.
- BunkerWeb from Bunkerity in Agen is free to self-host under AGPLv3, with Standard at 49 euro and Enterprise at 149 euro a month.
- None of the eleven European tools on this page replaces BIG-IP load balancing hardware; they replace the firewall, bot and DDoS functions.
Why people leave F5
F5, Inc. started as a maker of load balancers and still sells most of its weight in that direction.
The company is headquartered at 801 5th Ave in Seattle, and its product list runs from BIG-IP appliances and virtual editions through the NGINX web server and gateway line to Distributed Cloud Services, the SaaS platform.
A web application firewall is one entry in that list, sold as F5 WAF for BIG-IP, as NGINX App Protect or as a Distributed Cloud service. Buyers who say they are running F5 usually mean the box in the data centre rack, with the WAF licence on top of it.
That history explains why the question of leaving F5 is rarely a simple swap. The WAF policy, the iRules, the virtual servers, the TLS certificates and the pool definitions often live on one device that also balances traffic and terminates sessions.
Moving the firewall function to a European provider means deciding which of those jobs go with it. The contract also differs by edition: BIG-IP can be bought as hardware, as software on a hypervisor or from a public cloud marketplace, while the F5 pages show term subscriptions, a Flex Consumption Plan and perpetual licences, with prices on request.
The reasons to look at European tools are mostly about control and supply chain rather than detection quality.
F5 states in its privacy notice that its personal data may be disclosed to governments, courts or law enforcement under the laws of the countries where it operates, and that it relies on the EU-U.S. Data Privacy Framework and on Standard Contractual Clauses for transfers. A buyer who must show an auditor a European contracting party for every layer in front of a regulated application has to ask what the alternatives look like.
- The contracting party and the transfer mechanism F5, Inc. in Seattle is the controller named in the privacy notice, with a European office run under the NGINX name in Cork and a UK entity, F5 Networks Limited, in Chertsey. For personal data the notice lists the Data Privacy Framework and Standard Contractual Clauses as the transfer tools. That works today, but it ties your compliance file to a framework whose future depends on US and EU politics. A Swiss, German or French vendor removes the transfer from the file altogether.
- A WAF licence that is bundled into an infrastructure decision The F5 pages sell the WAF as a module of BIG-IP, so buying it means buying or already running the platform around it: hypervisor images, cloud marketplace images or hardware, plus the licence model that comes with them. Teams that only want a firewall in front of a few applications pay for traffic management they may never use. Several European tools do only the firewall job, which is a narrower purchase and a narrower contract.
- Price only on request Nothing on the F5 pages checked on 20 October 2026 lists a price for the WAF. Subscriptions, the Flex Consumption Plan and perpetual licences all go through sales or a reseller. That is normal for enterprise infrastructure, but it makes a comparison slow. BunkerWeb publishes 49 and 149 euro a month for its self-hosted plans, WEDOS Protection publishes a free plan and 99 euro a year, and Bunny.net starts free, so a budget conversation can begin before any call.
- Operating the policy yourself versus buying it managed F5 WAF for BIG-IP gives you a learning engine and detailed policy building, which suits an application security team that tunes rules daily. Not every organisation has that team. Myra Security says its security operations team manages the WAF rule sets for the customer, and Link11 runs its WAF as a service behind a DNS change. If your problem is staffing rather than capability, a managed European service answers it better than a bigger box.
What you have to replace, not just match
The first thing to inventory is what the F5 device does besides filtering. If it terminates TLS for fifty hostnames, balances across server pools, rewrites headers with iRules and runs global DNS, only the first of those moves to a WAF-only product.
Airlock and BunkerWeb both sit in front of applications as reverse proxies and can take over TLS termination and routing for the protected services, but neither claims to replace a BIG-IP load balancer or its DNS features. Write down each virtual server and mark whether it exists for security, for availability or for both.
The second item is the policy itself. A WAF policy built over years of learning mode and manual exceptions is the most valuable thing on the device and the hardest to move, because rule syntax and negative security models differ between products. Expect to rebuild it.
BunkerWeb is built on ModSecurity and Lua, CrowdSec lists support for legacy ModSecurity rules, and Airlock enforces API schemas, so the porting effort depends on which rule language your current policy leans on. Plan a period in which the new WAF runs in detection mode next to the old one.
The third item is the layer F5 sells around the WAF: bot defense, behavioral denial-of-service detection, application-layer encryption of sensitive fields in the browser, and API protection for GraphQL, REST, XML and GWT. Some of these have close equivalents in the European list.
Link11 and Myra Security cover bots and layer 7 DDoS from a cloud platform, and Airlock has bot defense and an anomaly detection component. In-browser field encryption is a feature none of the European pages checked mention, so if you rely on it, keep it on the list of things to confirm in a proof of concept.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | Myra Security | Munich, Germany | Enterprise pricing on request | EU (Germany) |
| #2 | Airlock | Zurich, Switzerland | Pricing on request (no price list on the vendor site) | Switzerland (adequacy decision, outside the EEA) |
| #3 | Link11 | Frankfurt, Germany | Enterprise pricing on request | EU (Germany) |
| #4 | Gcore | Luxembourg | Free tier / paid from about €25/month | EU (Luxembourg) |
| #5 | Bunny.net | Ljubljana, Slovenia | Pay-as-you-go from about €0.01/GB | EU (Slovenia) |
| #6 | BunkerWeb | Agen, France | Open Source free; Standard 49 euro/month and Enterprise 149 euro/month (self-hosted); BunkerWeb CLOUD from 639 euro/month; Sentinel on quote | EU (France) |
| #7 | WEDOS Protection | Luxembourg, Luxembourg | Free plan; NoLimit €8.25/month billed annually (€99/year) or €13 billed monthly; Managed EU from €1,000/month billed annually | EU (Luxembourg) |
| #8 | CrowdSec | Montrouge, France | Free and open source / paid plans for the threat feed | EU (France) |
| #9 | BitNinja | Debrecen, Hungary | Per server by hosted users in USD: VPS Free, VPS 6 at 6 dollars/month, Solo 9, Standard 19, Pro 29, Unlimited 39 (promotional, yearly), 7-day trial | EU (Hungary) |
| #10 | Patchstack | Pärnu, Estonia | Developer 69 USD/month billed annually (828 USD/year), 3 seats; Enterprise and Web host on quote | EU (Estonia) |
| #11 | Sansec | Utrecht, Netherlands | Per store on Advanced (stores up to 20 million euro online revenue) or Enterprise (up to 50 million euro); amounts not published | EU (Netherlands) |
How each alternative compares to F5
Best for: Government, banking and critical infrastructure that want the WAF run by someone else
Myra Security, a Munich company founded in 2012, takes the opposite approach to a BIG-IP: there is no appliance to tune. Its own team manages the WAF rule sets, and the platform sits in a German-only network with a CDN, DNS security and bot management beside it. The tool page lists BSI certification, ISO 27001 on the basis of BSI IT-Grundschutz and a BSI C5 Type 2 attestation.
Against F5, the question is who does the work. An F5 WAF gives your team the policy editor; Myra gives you a service with 24/7 operations and an account manager, priced by quote. The tool page puts the entry price at roughly 1,500 euro a month, which is a figure to verify in a proof of concept.
What Myra Security does better than F5
- Staff-light teams, since Myra tunes the rules
- German-only infrastructure and workforce
- Certification file for audits under NIS2
- One vendor for CDN, DDoS and WAF
Where Myra Security is a step down from F5
- No hardware or on-premise option
- Does no load balancing for internal applications
- Slower start because of the sales process
Standout against F5. Myra is the only tool here that combines a BSI C5 attestation with a German-only network and a managed WAF.
Best for: Banks, insurers and public bodies that want to run the WAF and API gateway themselves
Airlock Gateway from Ergon Informatik AG in Zurich is delivered as a virtual appliance, a cloud image or the Microgateway container for Kubernetes. That is the same shape of purchase as F5 WAF for BIG-IP on a hypervisor, and traffic and logs stay in your own environment. The vendor lists OWASP Top 10 filtering, virtual patching, bot defense, layer 7 DoS prevention and API schema enforcement.
The trade is similar to F5 too: you operate it, and the vendor shows no price list. Airlock also bundles the Webroot threat intelligence service as a third-party component, which a strict supply-chain review should note. Switzerland is not in the EU, but it holds an adequacy decision, and Ergon has a German branch in Frankfurt.
What Airlock does better than F5
- Runs fully inside your own network
- Kubernetes Microgateway option
- API gateway and WAF in one product
- Swiss trade register entry for the contracting party
Where Airlock is a step down from F5
- No price transparency before a demo
- No hardware appliance listed
- Sold mainly in Switzerland and Germany
Standout against F5. Airlock states a virtual patching response of 24 hours for Log4Shell-class issues, according to the vendor.
Best for: Enterprises that want attack traffic absorbed before it reaches their own network
Link11 GmbH in Frankfurt, founded in 2005, offers its WAF as part of a Web Application and API Protection bundle with DDoS filtering, bot management and a secure CDN. The tool page counts two security operation centres, 13 scrubbing centres and more than 40 points of presence, and says traffic is processed in European data centres only.
Where F5 expects you to deploy and size a device, Link11 asks for a DNS change and says onboarding takes hours. The WAF applies a positive security model with allowed-application enumeration. The price is by quote, and the tool page itself notes that Cloudflare and Akamai have the broader portfolio and global reach.
What Link11 does better than F5
- Volumetric DDoS capacity that an appliance cannot give
- Fast onboarding by DNS
- BSI-qualified and ISO 27001
- No hardware to size or replace
Where Link11 is a step down from F5
- Enterprise quote only
- Smaller global reach than the big CDNs
- Decrypted traffic passes through a third party
Standout against F5. Link11 shares what it learns about an attack on one customer across all customers, according to the vendor.
Best for: Teams that want a WAF and CDN on one account with a free tier to start
Gcore S.A. in Luxembourg, spun out of Wargaming in 2014, runs more than 180 points of presence and lists a WAF, bot management and DDoS protection at layers 3, 4 and 7 among its security features. It also sells cloud VMs and edge computing, so a team can host the application and protect it at one provider.
Against F5 the fit is a smaller job. Gcore filters in its network and does not give you a policy workbench of the BIG-IP kind. The tool page puts paid plans from about 25 euro a month with a free tier, which is far below the F5 route, but the page also says the platform asks for more configuration than a small site needs.
What Gcore does better than F5
- Largest published point-of-presence count here
- Free tier and a public starting price
- Hosting and protection on one account
- EU jurisdiction under a Luxembourg company
Where Gcore is a step down from F5
- Shallower WAF policy tooling than BIG-IP
- Broad platform to configure
- Not open source
Standout against F5. Gcore is the only tool on this page that also rents out the cloud servers behind the firewall.
Best for: Developers who already serve assets through a CDN and want basic WAF rules at little cost
Bunny CDN d.o.o. in Ljubljana, founded in 2015, built its name on pay-as-you-go delivery from about €0.01 per GB. The vendor shield page lists a WAF with a free Basic tier and an Advanced tier at 9.5 USD a month, which the EP tool page for Bunny.net does not yet show.
Compared with F5, this is a different weight class. Shield covers common web attacks at the edge without a device, an iRule or a contract, but it offers none of the behavioral analytics or enterprise policy tooling. For a small site moving off an F5 virtual edition it may be more than enough, and for a bank it is not the answer.
What Bunny.net does better than F5
- Entry cost, with a free WAF tier on the vendor page
- No minimum or commitment
- Pay-as-you-go billing
- Slovenian company, EU jurisdiction
Where Bunny.net is a step down from F5
- No enterprise support model
- Thin policy control next to BIG-IP
- No edge computing, unlike Gcore
Standout against F5. Bunny.net lists the lowest WAF price on this page: a free Basic tier and 9.5 USD a month for Advanced, according to the vendor shield page.
Best for: DevOps teams on Docker or Kubernetes that are leaving NGINX App Protect or BIG-IP
BunkerWeb by Bunkerity SAS in Agen is a reverse proxy with WAF functions built on ModSecurity and Lua, published under AGPLv3. For teams that bought NGINX App Protect because they already ran NGINX, the shape is familiar, and the code can be audited. The site is hosted at OVH in Roubaix.
The money side is unusually open for this market: free Open Source, Standard at 49 euro and Enterprise at 149 euro a month, and BunkerWeb CLOUD from 639 euro. The free edition has community support and no SLA. A small company cannot absorb volumetric attacks, so a large DDoS needs a provider in front.
What BunkerWeb does better than F5
- Published prices from zero
- Source code you can inspect
- Runs on Linux, Docker and Kubernetes
- Managed edition on certified French infrastructure on request
Where BunkerWeb is a step down from F5
- No load balancing hardware or global DNS
- Small vendor next to F5
- Community support only on the free edition
Standout against F5. BunkerWeb is the only WAF here that gives you the source under AGPLv3 and a managed edition to move to later.
Best for: Small and mid-sized sites that want certified DDoS protection without a sales cycle
WEDOS Protection offers a free plan, a NoLimit plan at 99 euro a year on annual billing and a Managed EU tier from 1,000 euro a month. It caches from 120+ anycast points of presence and adds DDoS protection at layers 3, 4 and 7 with a managed WAF. Logs, configurations and analytics sit in two data centres that WEDOS owns in the EU, and the German BSI certifies the group as a DDoS protection supplier.
Read the contract before signing. WEDOS Group SA is the Luxembourg holding, but the terms name WEDOS, a.s. in the Czech Republic as the provider. Everything in that chain is European, so the check is about which entity signs, not about a hidden parent. Against F5, the offer is price and simplicity rather than policy depth.
What WEDOS Protection does better than F5
- Free plan and a 99 euro yearly price
- BSI-certified DDoS supplier
- Logs kept in its own EU data centres
- ISO 27001, 27017 and 27018 listed
Where WEDOS Protection is a step down from F5
- Entity naming differs between holding and contract
- Little policy tooling next to BIG-IP
- Monthly billing costs 13 euro against 8.25 on annual
Standout against F5. WEDOS Protection is the only tool here with a free plan from a BSI-certified DDoS supplier.
Best for: Self-hosting teams that want shared IP reputation and WAF rules in one stack
CrowdSec SAS in Montrouge makes a Security Engine that reads logs and requests. Its AppSec component receives each HTTP request from Nginx, OpenResty, Traefik, Envoy Gateway, HAProxy or a WordPress plugin, applies in-band rules and lets the web server block or pass the request. The quickstart installs a virtual patching collection updated daily for known CVEs.
This is far from a BIG-IP appliance, and that is the point for some buyers: nothing sits in the traffic path except your own web server. The docs checked list no price or licence for the AppSec component, and the OWASP Core Rule Set is not installed by the quickstart, so tuning and false positives are yours. The privacy policy lists US cloud processors, which matters if you enrol in the community network.
What CrowdSec does better than F5
- Engine is free to start
- Daily-updated virtual patching rules
- Works with the web servers you already run
- Shares attacker IPs across users
Where CrowdSec is a step down from F5
- No published AppSec price or licence
- No managed service or SLA on the pages checked
- Weaker fit for API protocols than Airlock
Standout against F5. CrowdSec turns one user's attacker sighting into a block for every other user of the network.
Best for: Hosting providers and VPS owners who need a firewall on each Linux server
BitNinja Technologies Zrt. in Debrecen sells an agent that runs on your own Linux servers, with a WAF module that applies security levels per domain from a central dashboard. Hosting control panels such as cPanel, Plesk and DirectAdmin are among the supported environments, and a WAF, malware scanner and IP reputation list come in every plan.
Next to F5 this is a distributed model: a filter on every server, not one gateway in front of all. That suits a hosting company with a thousand sites and not a bank with five applications. Prices are in US dollars on a per-server basis, a VPS plan is free and a 7-day trial is offered; there is no CDN or volumetric protection, and the dashboard data location is not stated.
What BitNinja does better than F5
- Per-server pricing with a free VPS plan
- Fits hosting control panels
- Includes malware scanning
- Hungarian entity under EU law
Where BitNinja is a step down from F5
- Linux only
- No scrubbing capacity
- USD prices marked as promotional
Standout against F5. BitNinja is the only tool on the page built around a hosting provider with many customer sites on one server.
Best for: Agencies and hosts that run many WordPress sites
Patchstack OÜ in Pärnu applies targeted mitigation rules for known vulnerabilities in WordPress core, plugins and themes. The vendor says it holds 12,000 mitigation rules and claims fewer false positives than general WAFs, which is a vendor statement. The Developer plan costs 69 dollars a month billed annually for three seats.
Compared with F5 this is a specialist, and the page should not suggest otherwise. Patchstack does not inspect traffic for custom application logic, and it publishes no data location. Its value is that a plugin flaw can be blocked before the site owner patches it.
What Patchstack does better than F5
- Rules written per known WordPress flaw
- Public pricing for one plan
- First month free
Where Patchstack is a step down from F5
- Not a general-purpose WAF
- Open-source ecosystem only
- Prices in USD
Standout against F5. Patchstack is the only tool here that blocks a catalogued WordPress plugin flaw before the plugin is patched.
Best for: Magento and Adobe Commerce merchants that already have a general WAF in front
Sansec BV in Utrecht ships Sansec Shield as a Composer module inside the Magento store. The vendor says Sansec maintains the rules, that no access to your infrastructure is needed and that Shield can run next to an existing WAF.
Against F5 it covers one platform only. Licences are per store under the Advanced plan (up to 20 million euro online revenue) or Enterprise (up to 50 million), with amounts not published. Because it runs inside the application, it offers no DDoS capacity.
What Sansec does better than F5
- Rules written for Magento specifically
- No infrastructure access needed
- Can run beside the existing WAF
Where Sansec is a step down from F5
- Magento only
- No published prices
Standout against F5. Sansec Shield is the one tool here that arrives as code inside the store rather than as a proxy in front of it.
What actually breaks when you switch
Plan the cutover as a parallel run. The F5 device stays in the path while the European WAF sits in detection mode, either mirrored or in front, and you compare what each would have blocked for several weeks.
Export the F5 policy and the list of exceptions first, because the exceptions document years of false positives that the new tool will produce again. Certificates and TLS termination are the other sharp edge: moving termination from BIG-IP to a cloud WAF changes who holds the private keys, so involve whoever owns key management.
Contracts and people are the slower part. F5 terms run by subscription term or perpetual licence, so check support and renewal dates before announcing a date.
Your staff know iRules and the BIG-IP interface, and a managed service such as Link11 or Myra Security changes their role from editing rules to reading reports. For a self-operated tool such as Airlock or BunkerWeb they need retraining on a different configuration model. Budget both, and keep the F5 support contract until the last application is cut over.
Can I keep my F5 load balancers and only change the WAF?
Yes, and for many teams that is the sensible first step. A BIG-IP can forward traffic to an upstream or downstream proxy, and a reverse-proxy WAF such as Airlock Gateway or BunkerWeb can sit in front of the F5 pool or behind it, depending on where you want TLS to end. The load balancer keeps its job, the F5 WAF licence is dropped at renewal, and the policy moves to the new tool in detection mode first.
The catch is the renewal calendar. F5 sells term subscriptions and perpetual licences, so the date at which your WAF module expires decides how long you have to run the two in parallel. Ask your reseller for the module end dates before choosing a pilot, because a six-week proof of concept that ends two weeks after renewal leaves you paying for both.
Is a cloud WAF from a CDN provider a fair replacement for an on-premise F5?
It replaces a different arrangement. A cloud WAF such as Link11, Myra Security, Gcore or WEDOS Protection receives your traffic first, filters it in their network and forwards the clean requests to your origin. That adds DDoS absorption and removes the appliance, but it also means a European provider sees your decrypted traffic, which an on-premise F5 does not do. Whether that is a gain or a new dependency depends on how strict your own supply-chain rules are.
The on-premise route keeps traffic inside your network. Airlock, BunkerWeb and BitNinja run on servers you control, and CrowdSec runs as an engine beside your web server. They give no volumetric DDoS capacity, so a large attack needs a scrubbing provider upstream. Many regulated buyers end up with both: a cloud scrubbing service for volume and a self-operated WAF for policy.
Which one to pick
If your F5 estate is mainly a WAF in front of a few applications and you have no team to tune it, pick a managed service: Myra Security if the BSI file matters, Link11 if DDoS capacity matters as much as the firewall.
If you want to keep the policy in your own hands and your applications are in your own data centre or cluster, pick Airlock for a supported commercial gateway or BunkerWeb for an open-source one you can read and later pay for.
If the F5 bill is smaller than the F5 estate, the cheaper tools make sense. WEDOS Protection and Bunny.net start free, Gcore starts at about 25 euro a month with the cloud behind it, and BitNinja, CrowdSec, Patchstack and Sansec fit hosting fleets, WordPress and Magento. Keep BIG-IP where load balancing and global DNS are the point, and be honest that F5 remains stronger on policy depth, bot and behavioral detection and sheer breadth of products.
Frequently Asked Questions
For the firewall function, Myra Security and Link11 are the managed German options with BSI credentials, Airlock is the closest self-operated gateway from a Swiss vendor, and BunkerWeb is the open-source choice from France. None of them replaces F5 load balancing hardware. Which one fits depends on whether you want a cloud service, a gateway you run yourself or a free engine, and the comparison below separates those cases.
BunkerWeb is free to self-host under AGPLv3, and its paid plans start at 49 euro a month. WEDOS Protection has a free plan and a NoLimit plan at 99 euro a year on annual billing. Bunny.net and Gcore also have free entry points, and BitNinja has a free VPS plan. Myra Security, Link11 and Airlock publish no prices, so they need a sales conversation before you know the cost.
It removes the vendor-side transfer for the firewall layer, because the contracting party sits in the EU, the UK or Switzerland. It does not touch other F5 products you may keep, such as BIG-IP load balancers, which have their own privacy statement. Check each product you retain against the privacy notice F5 publishes, and treat the WAF as one entry on that list.
Partly. Airlock enforces API schemas, keys and throttling and works with its own identity product for OAuth 2.0, OpenID Connect and SAML. Link11 and Myra Security list API security in their WAAP offerings. F5 names GraphQL, REST, XML and GWT protocol security for its BIG-IP WAF, so compare the protocols you actually run, not the feature headings, during a trial.
Often a specialist is the better first purchase. Patchstack applies virtual patches for known WordPress vulnerabilities from 69 dollars a month billed annually, and Sansec Shield installs in a Magento store as a Composer module. Both are narrow and neither absorbs volumetric attacks, so pair them with a CDN-based service from the list when traffic volume is part of your risk.
Related comparisons
About the author
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.