Tool profile
AWS WAF Bot Control: cost, fit and limits
AWS WAF Bot Control is a managed bot filtering feature of AWS WAF, made by Amazon Web Services, Inc., sold in Common and Targeted tiers and billed per web ACL plus request fees for applications protected by AWS WAF.
What to know first
Bot Control is added to an AWS WAF web ACL and billed in two ways: a $10.00 monthly subscription per web ACL, prorated hourly, and per-request fees. The Common tier includes the first 10 million requests a month, the Targeted tier the first 1 million. Pricing is the same in every AWS Region. The product page was unavailable when opened, so feature detail comes from the pricing page only.
AWS WAF Bot Control at a glance
| Maker | Amazon Web Services, Inc., Not stated on the vendor pages |
|---|---|
| Free plan | Yes |
| Entry price | $10.00 per month per web ACL (subscription, prorated hourly) |
| API access | No |
| Category | Best AI Bot Management Software in 2026, rank 4 of 11 |
| Website | aws.amazon.com/waf/pricing/ |
Who AWS WAF Bot Control is best for
AWS teams modeling a bot budget
Printed monthly and per-request rates, with worked examples, let a finance team estimate cost from its own request counts before turning the feature on.
Low-traffic sites
The free monthly allowances of 10 million Common and 1 million Targeted requests mean a small site may pay mostly the subscription.
Multi-region deployments
Pricing is the same across all AWS Regions, so the bill does not change depending on where the web ACL runs.
AWS WAF Bot Control plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Web ACL subscription | $10.00 per month per web ACL | Prorated hourly. Bot Control is added to a web ACL, so request fees and analysis fees apply on top where relevant. |
| Common Bot Control | First 10 million requests per month free, then $1.00 per million | Common bot detection. Rates come from worked examples on the pricing page, so confirm them before budgeting. |
| Targeted Bot Control | First 1 million requests per month free, then $10.00 per million | Targeted detection for more advanced bots, with analysis fees where applicable. Rates come from worked examples on the page. |
Checked November 2026.
What AWS WAF Bot Control does
- Common Bot Control tier
- The entry tier covers common bot categories and includes the first 10 million requests each month, which suits sites that mainly need to filter well-known automated clients.
- Targeted Bot Control tier
- The higher tier is for more advanced bot detection. It includes only the first 1 million requests monthly and costs more per million, so volume drives the bill.
- Per web ACL billing
- The subscription attaches to a web ACL, not an account, so teams can enable Bot Control only on the applications that suffer bot abuse. That keeps cost limited to the applications that actually suffer bot abuse.
- Analysis fees
- Beyond request fees, analysis fees apply where applicable for the Targeted tier. The pricing page uses them in worked examples rather than a simple table.
- Uniform regional pricing
- Rates are the same across AWS Regions, which keeps cost comparisons simple for multi-region applications. Rates are the same across all AWS Regions, which keeps budgeting for multi-region applications simple.
How AWS WAF Bot Control handles your data
The AWS WAF pricing page, the only page we could open for this product, states no policy on training from customer data, retention or where request data is processed. It names no certification. The Bot Control product page returned HTTP 404 and was not read, so the vendor's policy was not checked for this. Buyers should read AWS WAF documentation and the AWS data processing terms, since the product runs inside AWS WAF logging and account settings.
Where AWS WAF Bot Control falls short in practice
- Needs a web ACL first. Bot Control is an add-on to AWS WAF, so a team must have a web ACL and a WAF rule set before it can switch the feature on.
- Rates from examples. The per-request rates appeared in worked examples because the pricing table was not in the extracted text. Confirm current rates on the live page. The $1.00 and $10.00 per million figures should be checked against the live AWS page.
- Detection not described. The pages opened do not describe the detection method or any AI capability, so depth of detection against advanced bots was not verified here. A buyer would need AWS documentation to learn how bots are classified and tuned.
Works with
Alternatives to AWS WAF Bot Control
AWS WAF Bot Control: common questions
How much does AWS WAF Bot Control cost?
As of November 2026 the pricing page shows a $10.00 monthly subscription per web ACL, prorated hourly, plus request fees. Common Bot Control includes the first 10 million requests a month and Targeted Bot Control the first 1 million. Per-request rates appeared in worked examples, so confirm them.
What is the difference between Common and Targeted Bot Control?
Common Bot Control handles common bot categories, while Targeted Bot Control is for more advanced bot detection. They differ in the free request allowance, 10 million against 1 million, and in per-request price. Targeted may add analysis fees. The pages we opened do not explain the detection logic.
Do I need AWS WAF to use Bot Control?
Yes. The subscription is billed per web ACL, so Bot Control is added to a web ACL inside AWS WAF. A team without a WAF setup has to create one first, which adds rules and configuration work before bot filtering starts.
Does Bot Control cost the same in every region?
Yes, according to the pricing page, which says pricing is the same across all AWS Regions. That helps with budgeting multi-region workloads. The page does not state where request data is processed, which is a separate question for residency. Data location is a different matter and should be checked separately.
Does AWS publish how Bot Control detects bots?
Not on the page we could open. The AWS WAF pricing page covers cost only, and the Bot Control product page returned a 404 when we tried it. Read the current AWS documentation before assuming any AI or machine learning capability.