The right WAF for Adobe Commerce depends on your hosting model and who owns rule changes. Peakhour brings WAF rules, bot policy, rate limits and request logs into one service. Compare those controls with the protection already active on your store.
Identify your Adobe deployment
Adobe offers SaaS, Cloud Infrastructure (PaaS) and on-premises models. Adobe manages the SaaS platform. For on-premises Commerce, the merchant or host manages infrastructure. Review your contract and architecture before selecting an added WAF. Adobe deployment responsibilities.
Cloud Infrastructure includes Fastly services. Adobe lists its managed WAF for Starter and Pro production environments. Fastly maintains the default policy; Adobe and Fastly manage WAF operations. Legitimate requests blocked by the service go through Adobe Support. Fastly service scope and Adobe WAF operations.
Adobe describes this WAF as checking requests sent to the Commerce server to refresh the cache. Plan tests for dynamic store routes and APIs. Adobe WAF inspection.
Separate WAF and bot protection
Adobe also offers Advanced Security for PaaS projects, adding Fastly-powered bot management and rate limiting. Confirm your enabled services before comparing coverage. Adobe Advanced Security.
For merchant-hosted Commerce, inventory your CDN, WAF and host controls. Every deployment needs its own review.
Where Peakhour can help
Peakhour WAF combines WAF rules, API policy, bot signals, rate controls and decision logs. Its support guide describes OWASP Core Rule Set support, Atomicorp virtual-patching rules, rule tuning and warning mode.
Advanced rate limiting can count request and response events by configured client keys. Evaluate repeated failures on login and account routes alongside WAF findings. Bot management adds controls for automated traffic that needs route-specific policy.
The Magento integration supports cache tags and cache variation. Confirm version support and test cache changes separately from security enforcement. For Adobe’s SaaS service, confirm which integrations Adobe supports before planning changes.
Why keep Adobe's managed WAF?
The existing service may meet your needs when Adobe Support handles exceptions within your required workflow. Keeping it preserves the provider-managed cloud path. Adobe documents origin cloaking that routes Cloud Infrastructure traffic through Fastly. Adobe origin cloaking.
A Peakhour deployment alongside an existing edge needs an agreed design for this path, log access and who manages the rules.
Test before changing enforcement
Test checkout, payment callbacks, admin actions, imports, REST and GraphQL requests. Review blocked valid requests and malicious requests reaching origin. Ask each team to show the matching rule and how it would make an exception.
Start Peakhour in warning mode, tune rules and enable a limited scope. Keep a rollback plan and continue application patching alongside WAF work.
Contact Peakhour to review your hosting model and plan a Commerce WAF evaluation.
Official sources checked: 6 November 2026.