Quick reference for the "customer already has Enterprise WAF, wants to know what Advanced adds" conversation.
waf_advanced_accfeat) that layers on top of an existing Enterprise plan. It unlocks request body inspection at the rule level. Everything else the customer already has stays the same. Confirmed real by the internal Add Subscription UI which lists it as a subscribable T1 account feature alongside Web Attack Detection WAF.
This is the table to look at during a call.
| Capability | Enterprise WAF (already has) | + WAF Advanced |
|---|---|---|
| Custom rules on URL, method, headers, query string, cookies | Yes | Same |
| Managed rulesets (Cloudflare, OWASP) | Yes | Same |
| Advanced Rate Limiting (sliding window, complex keys) | Yes | Same |
| Exposed Credentials Check, Leaked Credentials Detection | Yes | Same |
| Sensitive Data Detection | Yes | Same |
| Account-level WAF rules | Yes | Same |
Rules that inspect request body content (http.request.body.raw, http.request.body.form, etc.) | No — throws entitlement error | Yes |
| Rules that match against parsed JSON body fields | No | Yes |
| Higher request body inspection size limits | 128 KB max | Higher (verify with AE) |
http.request.body.raw rule is failing today.
If they are trying to do any of these, they need Advanced. If not, they probably do not.
If they only need to filter on URL, method, headers, cookies, query string, or client IP, they do not need Advanced. Base Enterprise WAF covers all of that.
Not every body inspection need requires Advanced. Ask what the rule is trying to do first.
| What they want to do | Can they do it without Advanced? |
|---|---|
| Match a value in a URL query parameter that duplicates the body value | Yes, use http.request.uri.query |
| Match a value in a header the client sends | Yes, use http.request.headers |
| Enforce a schema on an API endpoint | Maybe — API Shield does this without WAF Advanced |
| Inspect a small percentage of routes for a specific body pattern | Maybe — put a Worker in front of the route, inspect body in JavaScript, attach a header, then WAF rule matches on that header |
| Broad body inspection across many routes and content types | No — Advanced is the honest answer |
Assumes Mayah's first reply has already gone. This is the follow-up to his "what else does Advanced enable" question.
Adding to Mayah's answer. WAF Advanced is an account feature layered on top of your Enterprise WAF plan, which is why you cannot find it as a top level plan tier in the documentation. The main thing it unlocks is the ability to write rules against the contents of a request body. That covers http.request.body.raw, the parsed body fields for JSON and form data, and larger body inspection size limits.
Everything you use in the WAF today stays the same. Advanced does not replace or change your existing rules, it just adds the body inspection capability on top.
Before we go the upgrade route though, what is the rule you are trying to build? If you can share a sample request and what you want to match on, there is a reasonable chance we can either use a field you already have access to, or put a Worker in front of the route to inspect the body and pass a header downstream that a base Enterprise WAF rule can then match on. If the use case is broad enough that a Worker workaround does not fit, then WAF Advanced is the right conversation to have, and we can pull the current entitlement sheet through your account team so you know exactly what else it includes before you commit.
These come up when customers ask "what other security add-ons exist." Do not surface them unprompted in Jan's thread. Reference only.
| Add-on | What it does | Related to WAF? |
|---|---|---|
| Bot Management | Bot Score, verified bots, JA4 fingerprinting, detection IDs | Adjacent — different SKU |
| API Shield | Schema validation, JWT validation, sequence mitigation, mTLS | Adjacent — often paired with Advanced |
| DDoS Protection Advanced | Custom L7 DDoS rules, adaptive DDoS tuning | Adjacent — different layer |
| Page Shield | Client-side script monitoring, CSP management | Adjacent — runs in browser, not edge |
| AI Security for Apps | Prompt injection and PII detection for LLM-backed apps | Adjacent — separate product |
Web Attack Detection WAF (web_attack_detection_waf) | Second WAF account feature visible in internal UI. Likely covers managed attack detection and scoring layer. | WAF sibling — verify scope with AE |