Which WAF fits your operating needs?
Consider Peakhour when you want WAF, bot and rate controls reviewed through a shared request policy. Peakhour WAAP combines WAF rules, API policy, bot signals, rate limits and Layer 7 DDoS controls, with decision logs for review.
Fastly Next-Gen WAF offers several deployment types. It deserves a close look when inspection must run within your own infrastructure, or when your team already manages security on Fastly. Compare the exact deployment and package you would buy.
Where can Fastly Next-Gen WAF run?
Fastly documents Edge WAF on its edge platform, On-Prem WAF in customer infrastructure and Cloud WAF on Fastly-managed cloud infrastructure. Fastly manages Edge and Cloud deployments; customers manage On-Prem deployments. On-Prem options include module-agent and reverse proxy setups. See its deployment guide.
Deployment availability depends on the purchased package. Ask Fastly to confirm it against the getting-started guide and your contract. A requirement for local inspection should include a review of management connections, request data and support access.
Fastly Bot Management has separate requirements. Its post-cache inspection requires Bot Management plus Edge WAF; pre-cache inspection uses ContentGuard and requires Bot Management. Check the bot deployment guide if bot coverage is part of your WAF decision.
How does Peakhour support policy and tuning?
Peakhour documents OWASP Core Rule Set support, Atomicorp virtual patching, rule tuning and a warning mode in its WAF guide. Start in warning mode and inspect valid requests that trigger rules before enabling blocking.
The Peakhour WAF product combines these controls with bot, API and rate policy. Its bot management adds browser and network fingerprints, proxy context and route behaviour to request decisions. The custom-rule guide describes conditions based on paths, methods, headers and other request fields.
Peakhour supports Peakhour Edge and existing-edge deployments, including a path alongside Fastly. Confirm the supported integration and enforcement point for each application. Agree on the signals available at that point and who owns policy changes.
When might you stay with Fastly?
Staying may suit a team that needs its documented On-Prem options or already operates a well-tuned Fastly deployment. Fastly's setup guide includes logging before blocking, attack thresholds, request rules, rate controls and signal exclusions. Compare those tools against the daily tasks your operators perform.
Evaluate Peakhour when you want to bring WAF findings, bot decisions and rate-limit reviews together, or need a different support relationship. Peakhour documents plan-based support channels; confirm the escalation service your team needs.
What should you check before choosing?
- Which requests reach inspection, including alternate origin routes and internal traffic?
- Who patches, monitors and recovers the inspection components?
- How do request-body limits affect uploads, JSON and large forms?
- Can you narrow an exception to a route, method and rule?
- Which request fields enter logs, who can view them and how long are they kept?
- Can an operator trace a block to its rule and restore a valid user task?
How should you evaluate or migrate?
- Save the current rules, exceptions and thresholds. Record what each rule should stop. Identify the team that owns it.
- Select a route with known attacks and representative valid requests. Save a baseline and rollback settings.
- Validate the proposed traffic path in staging. Test request bodies, origin access and component failure behaviour.
- Run warning or logging mode, review matched requests and rebuild narrow exceptions in the new policy.
- Enable blocking in stages. Track valid requests blocked, missed test attacks and successful user tasks before widening coverage.
Contact sales to review your current deployment and scope a Peakhour WAF evaluation.
Official sources
Checked 6 November 2026: Fastly WAF deployments, WAF setup and tuning and Bot Management requirements. Peakhour sources are linked beside the relevant claims.