Every European web application firewall tool reviewed
Munich, Germany
Founded 2012
Enterprise pricing / Contact for quote
Demo on request
Best for: European enterprises, government agencies, critical infrastructure
Myra Security is the managed option on this list: the vendor's own security operations team maintains the WAF rule sets, so there is no policy editor to learn and no appliance to size.
Alongside the WAF the platform carries DDoS mitigation with a stated capacity above 50 Tbps, a CDN the vendor operates itself, DNS security with anycast and bot management that separates search crawlers from credential-stuffing traffic. The vendor says it met all 37 BSI criteria for qualified DDoS mitigation, a figure to confirm in a proof of concept.
The company is Myra Security GmbH in Munich, founded in 2012, and the tool page lists federal agencies, state institutions and critical infrastructure operators among its protected organisations.
Hosting and staff access are German-only, and certifications named on the page are ISO 27001 on the basis of BSI IT-Grundschutz and a BSI C5 Type 2 attestation. The cost of that profile is access: no self-serve sign-up, a sales process before any evaluation, and a starting figure the tool page puts at roughly 1,500 euro a month.
What Myra Security does well
- BSI certified for German critical infrastructure
- CDN, DDoS protection, WAF and bot management as one layer
- German hosting and jurisdiction throughout
- One accountable vendor rather than four seeing your traffic
- Built for organisations that must document their supply chain
Where Myra Security falls short
- Enterprise pricing on request, no self-serve entry
- Smaller network than the delivery-first CDNs
- Substantial overspend for an ordinary marketing site
- Sales cycle before evaluation
Standout feature. Myra Security is the only tool here that combines a BSI C5 Type 2 attestation, a German-only network and a WAF whose rules its own staff manage.
Zurich, Switzerland
Pricing on request (no price list on the vendor site)
Demo on request
Best for: Banks, insurers and public bodies in German-speaking markets that want a WAF they operate themselves
Airlock is the gateway for organisations that want to operate their own WAF and API protection. Airlock Gateway sits in front of web applications and APIs as a reverse proxy and combines OWASP Top 10 filtering, virtual patching, bot defense and layer 7 denial-of-service prevention with API schema enforcement, keys and throttling. An AI-based component the vendor calls Anomaly Shield adds detection, and reporting plus SIEM integration are part of the package.
The contracting entity is Ergon Informatik AG in Zurich, listed in the Swiss trade register, with a German branch in Frankfurt; Airlock is a brand of Ergon and not a separate firm.
Delivery comes as a virtual appliance, a cloud image or a Microgateway container for Kubernetes, which means traffic and logs stay in your environment. There is no price list and no self-service trial, the Gateway includes the Webroot threat intelligence service as a third-party part, and volumetric DDoS needs another provider in front.
What Airlock does well
- WAF and API gateway in one product
- Virtual patching with vendor-stated 24-hour response to Log4Shell-class issues
- Runs in your own environment
- Kubernetes Microgateway option
- Swiss entity with trade register entry
Where Airlock falls short
- Pricing only on request
- You operate it yourself
- No global scrubbing network of its own
- Includes a third-party threat intelligence feed (Webroot)
Standout feature. Airlock is the only tool here that puts a WAF and an API gateway into one product you run on your own virtual machines or Kubernetes cluster.
Frankfurt, Germany
Founded 2005
Enterprise pricing / Contact for quote
Demo on request
Best for: European enterprises needing advanced DDoS protection
Link11 is where a WAF and a large DDoS defence arrive together, sold by a German company that began with DDoS protection.
Its WAF defends against the OWASP Top 10 and uses a positive security model, meaning allowed-application enumeration and access control lists let known-good traffic through rather than trying to list every bad pattern. It belongs to a bundle that also covers bot management, API security, DNS protection and a secure CDN, and the tool page counts two security operation centres, 13 scrubbing centres and over 40 points of presence.
Link11 GmbH, founded in 2005 and based in Frankfurt, holds ISO 27001 and BSI qualification as a DDoS provider for critical infrastructure in Germany, and the tool page says all traffic is processed in European data centres.
The vendor claims mitigation starts within 0 to 10 seconds per attack vector and that what is learned on one customer protects the rest, both vendor statements. Pricing is custom, based on traffic, domains and modules, and the tool page itself concedes that Cloudflare and Akamai offer a broader portfolio and larger global network.
What Link11 does well
- AI-based DDoS detection that runs always-on without manual activation
- WAF, bot management, DNS protection and secure CDN in one WAAP offering
- BSI-qualified for DDoS protection of critical infrastructure and ISO 27001 certified
- Traffic processed in European data centres, with 13 scrubbing centres
- Onboarding by DNS change, which the tool page says takes hours
Where Link11 falls short
- Enterprise pricing by quote, no self-serve plan
- Smaller global network than Cloudflare or Akamai
- Decrypted traffic passes through the provider
- Less suited to small sites with no DDoS exposure
Standout feature. Link11 is the only tool here that applies a positive-security WAF model on top of an always-on, AI-based DDoS filter from the same vendor.
Luxembourg
Founded 2014
Free tier available, paid from €25/month
Demo on request
Best for: Gaming companies, streaming platforms, and businesses needing low-latency global content delivery
Gcore treats the WAF as one security feature of a broader edge and cloud platform, which suits teams that would rather host and protect at one provider.
Besides the WAF the vendor lists DDoS filtering across network and application layers, bot management, SSL/TLS certificate management, a CDN, DNS hosting, load balancing, edge computing and cloud VMs in European regions such as Luxembourg, Frankfurt and Amsterdam. Basic DDoS protection is included with CDN plans, and the tool page describes a 24/7 security operations centre.
Gcore S.A. is a Luxembourg company founded in 2014 as a spin-out from the gaming firm Wargaming, which explains the focus on game distribution and live streaming.
With 180+ points of presence it has the largest published network among the tools here, and a free tier exists alongside paid plans from about €25 a month. The same breadth is the drawback: the tool page says there is more to configure than a small site needs, and the WAF is not the part of the platform the company is best known for.
What Gcore does well
- 180+ points of presence, the largest network here
- Edge computing and cloud VMs alongside delivery
- Built for gaming and streaming latency
- DNS hosting, load balancing and DDoS protection included
- Luxembourg company, EU jurisdiction, free tier available
Where Gcore falls short
- From about €25/month, more than a small site needs
- Broader platform means more to configure
- Not open source
- Overkill for a business website or blog
Standout feature. Gcore is the only tool here that sells the cloud servers and the edge firewall in front of them from the same Luxembourg company.
Ljubljana, Slovenia
Founded 2015
Pay-as-you-go (from €0.01/GB)
Demo on request
Best for: Developers and businesses needing fast, affordable CDN with video streaming capabilities
Bunny.net comes to web application firewalls from the CDN side, and its pitch is price and simplicity.
The company built its name on pay-as-you-go delivery, billed per gigabyte from a cent or so, with edge storage, Stream video hosting, DNS and image handling on the same account. The vendor shield page lists a WAF with a free Basic tier and an Advanced tier at 9.5 USD a month; the EP tool page still shows DDoS protection only, so confirm the current tier with the vendor.
Bunny CDN d.o.o. is a Ljubljana company founded in 2015 that, according to the tool page, grew without venture capital and runs 110+ points of presence with a strong European footprint. That makes it the cheapest entry on this list for a site already behind a CDN. Its limits are the flip side: no edge computing, less suited to enterprise contracts and dedicated support, and policy control far shallower than a dedicated WAF.
What Bunny.net does well
- From about €0.01/GB with no minimum or commitment
- Edge storage, video streaming, DNS and image optimisation on one account
- 110+ points of presence with a strong European footprint
- DDoS protection included
- Slovenian company, EU jurisdiction for request logs
Where Bunny.net falls short
- No edge computing, unlike Gcore
- Less suited to enterprise contracts and dedicated support
- Very large media operations will negotiate better elsewhere
- Not open source
Standout feature. Bunny.net is the only tool here that starts a WAF tier free inside a pay-as-you-go CDN with no minimum spend.
Agen, France
Open Source free; Standard 49 euro/month and Enterprise 149 euro/month (self-hosted); BunkerWeb CLOUD from 639 euro/month; Sentinel on quote
Demo on request
Best for: DevOps teams that want an auditable WAF they host themselves, with optional paid support
BunkerWeb is the open-source WAF on this list, a reverse proxy by Bunkerity SAS that blocks OWASP Top 10 attacks and malicious bots from one entry point and manages HTTPS certificates and HTTP policies there too. The vendor says it is built on ModSecurity and Lua, with HTTP/2, HTTP/3 and TLS 1.3 support, and the core code is published under AGPLv3, so a security team can read what filters its traffic. Install targets are Linux, Docker and Kubernetes.
Bunkerity SAS is registered in Agen, France, with share capital of 75,000 euro, and its website states that it is hosted by OVH in Roubaix.
The pricing ladder is the most open of the self-hosted tools: free Open Source with community support and no SLA, Standard at 49 euro a month, Enterprise at 149 euro a month, a 30-day trial, and BunkerWeb CLOUD from 639 euro a month on infrastructure chosen on request, including SecNumCloud, ISO 27001 or HDS certified providers. The company is small compared with F5, and large volumetric attacks need a scrubbing provider in front.
What BunkerWeb does well
- AGPLv3, code can be audited
- Free self-hosted edition
- Runs on Linux, Docker and Kubernetes
- Managed cloud edition available
- French company, hosted on OVH in France
Where BunkerWeb falls short
- Free edition has community support only
- Managed edition starts at 639 euro a month
- No own global scrubbing network
- Small vendor compared with F5
Standout feature. BunkerWeb is the only WAF here whose source code is open under AGPLv3 and that also sells a managed edition on certified French infrastructure.
Luxembourg, Luxembourg
Founded 2010
Free plan; NoLimit €8.25/month billed annually (€99/year) or €13 billed monthly; Managed EU from €1,000/month billed annually
Demo on request
Best for: Sites and small businesses that want a free or low-cost shield with BSI-certified DDoS protection and EU-stored logs
WEDOS Protection puts a managed WAF inside a CDN shield and is priced like a hosting product rather than a security contract.
A free plan is answered from EU locations only, the paid tier is called NoLimit (€99 for a year, or €13 for a single month), the Advanced plan comes with a 15-day trial, and the managed tier begins at €1,000 per month on a yearly term. Requests are served from 120+ anycast locations and filtered across network and application layers.
The group began in the Czech Republic in 2010, and the holding, WEDOS Group SA, moved its headquarters to Luxembourg in 2025.
The terms still name WEDOS, a.s. in Hluboká nad Vltavou as provider and the privacy policy names WEDOS Internet, a.s. as controller, so ask which entity signs your contract. WEDOS says it has no external investors and holds a BSI certificate for DDoS protection suppliers. Logs, configurations and analytics stay in two EU data centres that WEDOS operates itself.
What WEDOS Protection does well
- Free plan, with NoLimit at €99 a year or €13 billed monthly
- 120+ anycast points of presence, second only to Gcore among published counts here
- Logs, configurations and analytics kept in two EU data centres WEDOS owns
- Certified by the German BSI as a DDoS protection supplier
- ISO 27001, 27017, 27018, 9001 and 14001
Where WEDOS Protection falls short
- Luxembourg holding, but the terms name the Czech WEDOS, a.s. as provider: check which entity you contract with
- The free plan is served from EU points of presence only
- Monthly billing on NoLimit costs €13 against €8.25 a month on the annual plan
- Managed EU jumps to €1,000 a month on annual billing
Standout feature. WEDOS Protection puts a BSI-certified DDoS supplier's protection on a free plan and keeps the logs in data centres WEDOS owns.
Montrouge, France
Founded 2020
Free and open source / paid plans for the threat feed
Demo on request
Best for: Self-hosting teams that want collaborative IP reputation and a WAF engine in one open-source stack
CrowdSec is a security engine first and a WAF second, which is the reason to choose it. The Security Engine reads logs and requests, and its AppSec component receives each HTTP request from Nginx, OpenResty, Traefik, Envoy Gateway, HAProxy or WordPress, applies in-band rules and lets the web server block or pass the request. The quickstart installs a virtual patching collection for known CVEs, updated daily, plus generic attack rules, and the docs mention support for legacy ModSecurity rules.
CrowdSec SAS is registered in Nanterre under number 880 140 496, with its office in Montrouge, France, and was founded in 2020.
The vendor describes the product as open source and collaborative, sharing attacker signals between users, and it sells blocklists and threat intelligence separately. The AppSec docs checked state no licence or price for the WAF component, the OWASP Core Rule Set is not installed by the quickstart, tuning is yours, and the privacy policy lists US cloud processors, so check data flows before enrolling.
What CrowdSec does well
- Free and open source under MIT, with paid tiers only for the enriched feed
- Community threat intelligence: one attacker blocked everywhere at once
- Built for servers and internet-facing services
- French company, EU processing
Where CrowdSec falls short
- Not endpoint anti-malware; it does not protect laptops
- You run and tune it yourself
- Young company compared with the rest of this list
Standout feature. CrowdSec is the only tool here that turns one user's attacker sighting into a block for every other user of the same network.
Debrecen, Hungary
Per server by hosted users in USD: VPS Free, VPS 6 at 6 dollars/month, Solo 9, Standard 19, Pro 29, Unlimited 39 (promotional, yearly), 7-day trial
Demo on request
Best for: Shared hosting providers and VPS owners who want a WAF on each Linux server
BitNinja is a server-side firewall built for the company that runs many customer websites on shared Linux machines.
The WAF is a standalone engine rather than a module of Apache, NGINX or LiteSpeed, so it does not depend on the web server, and security levels and filters are set per domain from a central dashboard. It blocks SQL injection, cross-site scripting, CMS exploits and malformed requests with cloud-updated rules, and every plan also includes an AI malware scanner and a global IP reputation list.
BitNinja Technologies Zrt. is registered in Debrecen, Hungary, and the terms name Hungarian courts for disputes.
Pricing is per server and depends on the number of hosted users, in US dollars: a free VPS plan, VPS 6 at 6 dollars a month, then Solo 9, Standard 19, Pro 29 and Unlimited 39, shown as promotional yearly prices with a 7-day trial. It protects only Linux servers you control, offers no CDN or volumetric DDoS scrubbing, and does not state where its dashboard data is stored.
What BitNinja does well
- WAF with per-domain security levels
- Free VPS plan
- Includes malware scanner and IP reputation
- Works with common hosting control panels
- Hungarian entity under EU law
Where BitNinja falls short
- Linux servers only
- No CDN or volumetric DDoS protection
- Prices in USD, promotional
- Dashboard data location not stated
Standout feature. BitNinja is the only tool here that puts a per-domain WAF, malware scanner and IP reputation on every Linux server of a hosting fleet at once.
Pärnu, Estonia
Developer 69 USD/month billed annually (828 USD/year), 3 seats; Enterprise and Web host on quote
Demo on request
Best for: Agencies and hosts that maintain many WordPress sites and want known vulnerabilities blocked before patches are applied
Patchstack answers one specific question: what protects a WordPress site between the day a plugin flaw is published and the day the owner patches it.
Its RapidMitigate applies targeted virtual patch rules to block exploitation of known vulnerabilities in WordPress core, plugins and themes without changing site code, and coverage extends to WooCommerce and NodeJS. The vendor says it holds 12,000 unique mitigation rules and claims it prevents up to 74 percent more vulnerabilities than leading web application firewalls, which is a vendor statement.
Patchstack OÜ is the controller named in the privacy policy, with registration code 14331217 at Aida tn 7 in Pärnu, Estonia.
The Developer plan costs 69 dollars a month billed annually (828 dollars a year) for three seats, with a free first month and packs of five extra sites at 12.50 dollars a month, while Enterprise and Web host plans are quoted. It is not a general WAF for custom application logic, it focuses on open-source software, and the pages checked do not state a data location.
What Patchstack does well
- Targeted rules reduce false positives, according to the vendor
- WordPress, WooCommerce and NodeJS coverage
- Public pricing for the Developer plan
- First month free
- Estonian company
Where Patchstack falls short
- Not a general-purpose WAF
- Mostly WordPress ecosystem
- USD pricing, enterprise on quote
- Data location not stated
Standout feature. Patchstack is the only tool here that maintains a rule per catalogued WordPress vulnerability so the flaw is blocked before the plugin is updated.
Utrecht, Netherlands
Per store on Advanced (stores up to 20 million euro online revenue) or Enterprise (up to 50 million euro); amounts not published
Demo on request
Best for: Magento and Adobe Commerce merchants who want protection against known Magento attacks
Sansec Shield is the firewall written for one platform, Magento, and it installs inside the store instead of in front of it. The vendor says Shield targets Magento-specific threats rather than relying on generic rules, installs as a Composer module without access to your infrastructure, updates rules automatically, and can run alongside an existing WAF. Sansec also lists malware scanning, Slack alerts and a multi-store dashboard.
Sansec BV is registered in Utrecht, the Netherlands, at Wolvenplein 25, under company registration 77165187. Shield belongs to the Advanced plan, for stores up to 20 million euro in annual online revenue, and the Enterprise plan, up to 50 million euro; a standard licence covers a single store identified by its database, and amounts are not published. Because Shield runs inside the application, it cannot absorb volumetric attacks or protect other services on the same infrastructure.
What Sansec does well
- Rules specific to Magento
- Installs through Composer, no infrastructure access
- Can sit next to an existing WAF
- Vendor maintains the rules
- Dutch company
Where Sansec falls short
- Magento only
- Prices not published
- No DDoS capacity
- Requires an Advanced or Enterprise license
Standout feature. Sansec Shield is the only tool here that ships as a Composer module of the shop itself, with rules maintained for Magento alone.
