Security pricing
Rate Limiting and WAF inspection meters.
Security meters apply only when a request enters the matching path.
Rate Limiting counts requests that were subject to a rate-limit rule and allowed. Requests that never entered a rate-limit path are not counted. Requests that were limited (HTTP 429) are not counted as allowed.
WAF Inspected Requests counts requests on the WAF inspect path. WAF Inspected Payload counts the inspected request-body prefix only, not response bodies.
Hobby and Pro have no included WAF grant at launch. Rate Limiting has an included monthly allowance.
Included allowances and on-demand ranges are in What each meter counts.