Skip to content
SocialAtoZ

Barracuda WAF

Verified

Web application firewall and API security with built-in DDoS and bot protection

Website Security Software
–

Not yet rated. Be the first to review Barracuda WAF.

Visit website Request pricing Write a review
Barracuda WAF screenshot See all screenshots
  • Deployment Cloud Based, On Premises, Hybrid
  • Starting price Custom
  • Free trial Not offered
  • Best for SMEs, Agencies, Enterprises

What is Barracuda WAF?

Barracuda's Application Protection portfolio, sold under Barracuda Web Application Firewall and Barracuda WAF-as-a-Service, is a US-based (Campbell, California) suite of tools protecting web applications and APIs from OWASP Top 10 attacks, SQL injection, and cross-site scripting. Full Layer 3-7 DDoS protection and machine-learning-based Advanced Bot Protection are built in at no extra charge, and the platform can be deployed as a hardware appliance, virtual appliance, or fully managed SaaS.

API security features include JSON and GraphQL protection, schema-based API discovery, and, on the Premium plan, machine-learning detection of shadow and zombie APIs. Pricing is entirely custom, quoted per protected application through Barracuda's sales team or its Build and Price tool, with two tiers, Advanced and Premium, differentiating log retention, bot mitigation depth, and deployment options.

Key Features of Barracuda WAF

Barracuda WAF lists 9 documented features, including OWASP Top 10 protection against SQL injection, XSS, and CSRF, Advanced Bot Protection using machine learning and client fingerprinting and Full-spectrum Layer 3-7 DDoS protection included by default. The list below covers what the product does rather than how it is marketed.

  • OWASP Top 10 protection against SQL injection, XSS, and CSRF
  • Advanced Bot Protection using machine learning and client fingerprinting
  • Full-spectrum Layer 3-7 DDoS protection included by default
  • JSON and GraphQL API protection with schema-based API discovery
  • Machine-learning-powered shadow and zombie API detection on Premium
  • Data leak prevention and antivirus scanning for file uploads
  • Zero Trust Network Access via CloudGen Access integration
  • Load balancing, content routing, and CDN integration
  • Rate limiting enforced at the API endpoint level

Barracuda WAF Pricing

Barracuda WAF lists 2 plans without published figures. Pricing is quoted on request.

Advanced

Custom

Per protected application

Request pricing

OWASP Top 10 protection, full-spectrum DDoS protection, bot protection, API security, 30-day log storage, Zero Trust Access

Premium

Custom

Per protected application

Request pricing

Adds ML-powered API discovery, automated shadow/zombie API detection, advanced bot mitigation, client-side protection, containerized deployment, 60-day log storage

Barracuda WAF Specifications

Barracuda WAF is available on web app. It offers an API.

Deployment
  • Cloud Based
  • On Premises
  • Hybrid
Billing cycle
Yearly
Desktop
  • Web App
Languages
  • English
Built for
  • SMEs
  • Agencies
  • Enterprises
Support
  • Email
  • Phone
  • Live Support
  • Tickets
Integrations
AWS, Azure, and GCP marketplaces, SIEM platforms, CloudGen Access
Public API
Yes
Free trial
No
Free plan
No
Runs in browser
Yes
Customisable
Yes
Website
barracuda.com

Barracuda WAF Videos

Barracuda WAF Screenshots

Barracuda WAF screenshot 1

Barracuda WAF Reviews

No reviews yet

Used Barracuda WAF? Share your experience and help other buyers decide.

Write the first review

Barracuda WAF FAQs

Pricing is fully custom, quoted per protected application through Barracuda's sales team or its online Build and Price tool; no list prices are published.

Yes, full-spectrum Layer 3-7 DDoS protection, both volumetric and application-layer, is built into the WAF at no additional charge.

Yes, it is available as a physical appliance, a virtual appliance, or a fully managed WAF-as-a-Service in the cloud.

Premium adds machine-learning-based shadow/zombie API discovery, deeper bot threat mitigation, client-side protection, and longer log retention on top of the Advanced feature set.

Yes, JSON and GraphQL payloads are scanned and protected against parser and injection attacks.