WAF
Supahound vs Cloudflare WAF: blocking at the edge vs detecting per user
Cloudflare WAF and Bot Management form an edge firewall and bot filter for traffic proxied through your Cloudflare zone. Supahound reads Supabase edge logs and flags abnormal traffic per user. Cloudflare blocks known-bad requests before they arrive; Supahound spots a signed-in user doing something wrong with valid requests. Use both.
Last updated
How do Supahound and Cloudflare WAF compare?
| Question | Supahound | Cloudflare WAF |
|---|---|---|
| Blocks attacks? | No. Detection and alerts only. | Yes. At the edge, before traffic reaches the app. |
| Sees Supabase API calls? | Yes. It reads Supabase edge logs. | Only if you route the Supabase API URL through your zone. |
| Knows which user owns which rows? | Yes. It flags cross-tenant reads. | No. |
| Bot protection | Detects scraping and credential stuffing per actor. | Bot mitigation on every plan. |
| Supabase posture checks? | Yes. Free daily scan. | No. |
| Entry price | Free posture scan; $29 per project per month for detection. | Free; Pro from $20 per month billed annually. |
What does Cloudflare WAF do well?
- Blocks attacks at the edge before they reach the app, with a free managed ruleset.
- Bot mitigation on every plan, with anomaly detection and advanced bot analytics on contract plans.
- Low entry price and no code changes for traffic already on Cloudflare.
What does Cloudflare WAF not cover?
- It protects only traffic proxied through your Cloudflare zone. Supabase client calls go to the project's API URL, which is not in your zone unless you route it there.
- It does not read Supabase logs or know which Supabase user owns which rows, so it cannot flag cross-tenant reads.
- No Supabase posture checks, such as RLS coverage or Security Advisor findings.
How much does Cloudflare WAF cost?
Free is $0. Pro is $20 per month billed annually or $25 monthly. Business is $200 per month billed annually or $250 monthly. Contract plans are custom and billed annually. WAF and the Free Managed Ruleset come with every plan. Bot mitigation grows by plan: simple bots on Free, easy-to-detect bots on Pro, sophisticated bots with basic analytics on Business, and all bots with anomaly detection, custom CAPTCHAs and advanced analytics on Contract. Supahound's posture scan is free; runtime detection is $29 per project per month (pricing).
Which one should I choose?
Choose Cloudflare WAF if your site already proxies traffic through Cloudflare and you want to block bots and common attacks at the edge.
Choose Supahound alongside it, if your app calls Supabase directly: a WAF cannot tell that a valid, signed-in request is reading another tenant's rows.
Frequently asked questions
- Does Cloudflare WAF protect my Supabase API?
- Only if the traffic passes through your Cloudflare zone. By default, Supabase client calls go to your project's API URL, which sits outside your zone.
- If Cloudflare blocks bots, why do I need Supahound?
- A signed-in user reading other users' rows, or a caller with a leaked service key, sends valid requests. A firewall that does not know which user owns which rows cannot flag them. Supahound reads the logs per actor.
- Can Supahound block an attacker for me?
- No. Supahound is detection only. It sends an email or a signed webhook with a summary and a SQL fix; Cloudflare or your own code does the blocking.
Find out if someone is abusing your app
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.