Tool profile
Link11 WAAP: cost, fit and limits
Link11 WAAP is a web application and API protection service made by Link11 GmbH that bundles a web application firewall, Layer 7 DDoS protection, bot management and API security for organizations that want one provider for web traffic defense.
What to know first
Link11 describes its WAAP as one package: Link11-maintained firewall rules for SQL injection, cross-site scripting and the OWASP Top 10, Layer 7 DDoS protection, bot management and API security. The homepage lists an Enterprise tier with scope and pricing tailored to the customer, and shows no AI or machine learning claim for its bot or WAAP products. The legal notice identifies the company as Link11 GmbH.
Link11 WAAP at a glance
| Maker | Link11, Germany |
|---|---|
| Free plan | Free trial only |
| Entry price | €490 per month plus VAT, billed annually (Core) |
| API access | Yes |
| Category | Best AI Bot Management Software in 2026, rank 1 of 11 |
| Website | link11.com |
Who Link11 WAAP is best for
European firms wanting one security vendor
A single package covers firewall, DDoS, bots and APIs, and the legal notice names a German company, which simplifies vendor management.
Sites hit by login guessing
Rate limits and challenges against login guessing, plus bot separation of scrapers from customers, address credential attacks. Both are named on the homepage, together with API policies applied at the single endpoint level.
Teams worried about application-layer floods
Web DDoS protection identifies Layer 7 floods by traffic volume and request sequence, aimed at attacks that look like normal requests.
Link11 WAAP plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Enterprise | Custom quote | Scope and pricing tailored to domains, traffic and requests. The contact form asks about these, and no figure appears on the homepage. |
| Bot management | Quote, part of the package | Separates customers and resellers from scrapers and credential-stuffing bots. No bot-only tier or price is named. |
| API security | Quote, part of the package | Applies policies per endpoint and traces each decision to the individual call. No separate price is published. |
Checked October 2026.
What Link11 WAAP does
- Web application firewall
- Link11 maintains rule sets for SQL injection, cross-site scripting and the OWASP Top 10, so customers do not write attack signatures themselves. That saves teams from maintaining attack signatures, though the rule update cadence was not stated.
- Layer 7 DDoS protection
- Web DDoS defense identifies floods at the application layer by traffic volume and request sequence, aimed at attacks that mimic user behavior. Application-layer floods resemble normal visitors, so volume and sequence analysis is the signal used.
- Bot management
- The service separates customers and resellers from scrapers and credential-stuffing bots, so allowed automation can pass while abuse is stopped. Allowed automation from known third parties can pass while scrapers and credential stuffers are stopped by policy.
- API security
- Policies apply to each endpoint, and each decision can be traced to the individual call, which helps when investigating a blocked request. Tracing decisions to the call is useful when a customer asks why a request was refused.
- Login protection
- Rate limits and challenges work against login guessing, one of the main routes into customer accounts. Login guessing is a main route into customer accounts, so throttling there matters most.
How Link11 WAAP handles your data
The homepage and legal notice were the only pages read for this product. They state no policy on training from customer data, retention or hosting region, and name no certification. The privacy policy URL returned empty content, so data handling terms were not confirmed. The company is headquartered in Frankfurt per the homepage. The vendor's policy was not checked for this, so request a data processing agreement and hosting details in writing.
Where Link11 WAAP falls short in practice
- No price signal. Neither prices nor plan names are published, and the Enterprise tier is tailored per customer, so there is no list rate to compare. Procurement should expect to supply domain counts and traffic volumes before any number is shared.
- No AI claim. The homepage makes no AI or machine learning statement for bot management, which matters for buyers who specifically want a learned bot score. Teams that want a scored, model-based approach should ask how bots are actually identified.
- Data terms unconfirmed. The privacy policy page returned empty content, so retention, region and processing terms could not be read. Without those terms, a European buyer cannot yet confirm retention or where data is processed.
Works with
Alternatives to Link11 WAAP
Link11 WAAP: common questions
Is Link11 WAAP a bot management product?
It includes bot management inside a wider package with a web application firewall, Layer 7 DDoS protection and API security. The homepage names no bot-only product or tier. A team wanting only bot scoring should ask whether it can be bought separately.
Does Link11 use AI for bot detection?
The homepage makes no AI or machine learning claim for its WAAP or bot products. The nearest wording is learns normal behavior under network security, which it does not call machine learning. Ask how bots are identified if an AI-based score matters.
Where is Link11 based?
The homepage says the company is headquartered in Frankfurt, and the legal notice identifies Link11 GmbH. It does not state where customer traffic is processed, so ask for the hosting region and processing terms. Request the data processing agreement for specifics.
Does Link11 publish its prices?
No. The homepage lists an Enterprise tier with scope and pricing tailored to the customer. The contact form asks about domains, traffic and requests, so volume drives the quote. Ask for included traffic and overage terms. Check minimum commitments and what happens when traffic grows.
What attacks does Link11 WAAP cover?
The pages name SQL injection, cross-site scripting and the OWASP Top 10 for the firewall, Layer 7 floods for DDoS, scrapers and credential stuffing for bots, and per-endpoint policies for APIs. Rate limits and challenges handle login guessing. The pages do not describe detection accuracy.