Fortinet FortiWeb alternatives: 11 web application firewall tools compared
People look for a FortiWeb alternative when the appliance model stops fitting: they want to stop sizing and patching boxes, they want a vendor and operator inside the EU, or they want pricing that is published rather than negotiated per model. They move to software they run themselves, to European hosted services, or to the edge networks of the large cloud providers.
Short answer: Ubika Cloud Protector, BunkerWeb and Myra Security head the list of Fortinet FortiWeb alternatives drawn from our web application firewall ranking. Our rule for order: vendors outside the big brands go first, and the largest names are not placed in the top three. Ubika Cloud Protector is the one to try if you want a European vendor but traffic has to stay on your own premises. Each of the 11 alternatives sits in Best Web Application Firewall in 2026 and is described against Fortinet FortiWeb.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
Pricing: Per appliance or virtual machine, quoted; cloud option per hour
Established in: United States
Built for: Data centres that already run Fortinet and cannot proxy externally
Not for: Cloud-native teams who want rules in version control
01
Why buyers look past Fortinet FortiWeb
01
Hardware and virtual machines to look after
Fortinet describes FortiWeb as available in hardware, virtual machine and SaaS forms, with virtual versions for VMware, Hyper-V, KVM and Docker. Each box or virtual machine in front of your servers is something your team sizes, patches and replaces, and hardware means priority RMA options when it fails.
02
Licensing is not on the page
The FortiWeb product page we read lists no prices. Features arrive as FortiGuard subscriptions that can be bought a la carte or in a bundle, and support is a layer of FortiCare options on top. Working out a total cost means a quote per model, which is slow to compare across vendors.
03
The cloud service lives on AWS and Azure
FortiWeb Cloud WAF as a Service runs gateways in most AWS regions and keeps scrubbing in the region of your application. The marketplace versions support bring your own licence or pay as you go. Organisations that want an EU contracting entity and EU operation often go and look elsewhere.
you want a mature rule set and plan to monitor databases from the same vendor
#12
03
What each one does differently
1
Ubika Cloud Protector
France · On request
Ubika Cloud Protector comes from a French application-security lineage and is sold as a hosted service or as a gateway deployed in your own infrastructure. That second form is the closest match to an appliance estate. Pricing is quoted per application or per gateway, and documentation and community are thinner than the American products offer.
Switch from Fortinet FortiWeb if you want a European vendor but traffic has to stay on your own premises.
BunkerWeb is a French open source build of nginx that bundles the OWASP Core Rule Set, bad-reputation blocking and TLS handling behind a readable configuration layer. You run it on machines you control, with no per-request bill. PRO plans start at 49 euros a month and a managed cloud at 639 euros. Rule tuning stays with your team.
Switch from Fortinet FortiWeb if you want to swap a licensed box for software you can inspect and run yourself.
Myra Security operates its own filtering service from Germany and holds the certifications that German regulators ask for. Traffic is proxied through it, and you can edit rules in the dashboard or through the API, or add a managed WAF service in which Myra analysts write the rules. Pricing is quoted per organisation.
Switch from Fortinet FortiWeb if regulated or critical-infrastructure rules require a German operator with certification.
Link11 is a Frankfurt company that began in DDoS mitigation and now sells application firewalling, bot control and a content network on a single edge. Its WAAP plans are published from 490 euros a month on annual billing, with self-onboarding. Custom protections and managed onboarding belong to the quoted enterprise tier.
Switch from Fortinet FortiWeb if you want self-service plans with a published price from a German edge provider.
Gcore is headquartered in Luxembourg and packs application rules, bot management and DDoS protection into one WAAP plan beside a content network. A free plan covers one domain, paid plans start at 25 euros a month and enterprise is quoted. Rule tuning and analytics trail the largest American edge providers.
Switch from Fortinet FortiWeb if you want to try a hosted WAF on one domain before committing, with an EU contracting entity.
Indusface AppTrana pairs a scanner with analysts who tune your rules and write virtual patches for what it finds. The Advanced plan is 99 US dollars per domain per month, published, while Premium and Enterprise are quoted. The console is functional and changes follow the vendor's support schedule rather than your own.
Switch from Fortinet FortiWeb if nobody on your team has time to tune rules and you would rather have analysts do it.
Fastly's Next-Gen WAF can run as a module or agent next to the application, so requests are inspected after TLS termination without passing through a third party. Edge and cloud deployments also exist. It scores each request on context instead of regex matching. Pricing follows request volume and is quoted, and each host needs an install step.
Switch from Fortinet FortiWeb if you like inspection beside the application and want blocking mode to be safe to enable.
Azure Web Application Firewall comes in two forms that behave differently: one at the Front Door edge and one on an Application Gateway inside your network. Managed rules use the Default Rule Set, built on the OWASP Core Rule Set. An Application Gateway bills per gateway-hour, so idle test environments still cost money.
Switch from Fortinet FortiWeb if your workloads already run on Azure and you want a gateway-style deployment inside that network.
AWS WAF attaches rules to a CloudFront distribution or Application Load Balancer you already operate, and every rule can be kept in Terraform. Billing is per web ACL, per rule and per million requests. Managed rule groups carry their own price, and working out why a request was blocked means querying logs.
Switch from Fortinet FortiWeb if your applications sit behind CloudFront or an AWS load balancer and you manage infrastructure as code.
Cloudflare WAF goes live after a nameserver change, after which traffic runs through Cloudflare, which terminates TLS. Rules are set from a console. A free plan gives basic managed rules and five custom rules, and paid plans are priced per domain per month. A full request log is an enterprise feature.
Switch from Fortinet FortiWeb if you want protection switched on in an afternoon with no hardware to rack.
Imperva Cloud WAF has one of the older rule sets on the market and can be paired with the same vendor's database monitoring. Thales bought the company in 2023, so account teams and packaging have shifted. Pricing is quoted per organisation, and in much of Europe it is sold through partners.
Switch from Fortinet FortiWeb if you want a mature rule set and plan to monitor databases from the same vendor.
Ubika Cloud Protector: It sells a gateway you deploy yourself as well as a hosted service, and pricing is quoted per application or gateway.
02
You want software you can read and run without licence fees
BunkerWeb: It is an open source nginx build with the OWASP Core Rule Set, and PRO plans start at 49 euros a month if you want support.
03
You need a German operator with regulatory certifications
Myra Security: Myra runs its own service from Germany, and you can edit rules yourself or add its managed WAF.
04
You want to trial a hosted WAF on a single domain for nothing
Gcore WAAP: A free plan covers one domain, and paid plans start at 25 euros a month.
05
Your applications already run on AWS
AWS WAF: Rules attach to CloudFront or a load balancer you already run and can be kept in Terraform.
04
When Fortinet FortiWeb is still the right choice
FortiWeb stays a sound choice when your network team already runs Fortinet gear and traffic must be inspected inside your own data centre. Fortinet lists integration with FortiGate and FortiSandbox, machine-learning anomaly detection, API discovery and bot mitigation on one platform, and the same product runs on an appliance, a virtual machine or a public cloud. If a box in your rack is a requirement, few alternatives match that.
05
What moving off Fortinet FortiWeb involves
01
Rules and learned baselines do not export
FortiWeb policies, signatures and its machine-learning baselines are tied to the product. Plan to rebuild exceptions, run the new WAF in logging mode beside the old one for several weeks, and compare what each blocks before you switch to enforcement.
02
TLS, routing and network placement change
An appliance sits in the path of your own network, while hosted services need DNS or load balancer changes and certificate handling. List every hostname, upstream and certificate behind the box, and decide who owns rollback if a rule blocks real customers.
06
Questions about replacing Fortinet FortiWeb
6 answers
Does Fortinet publish FortiWeb prices?
Not on the product page we read. It lists form factors, FortiGuard subscriptions and FortiCare support options, so expect to request a quote for the model or virtual machine you need.
Can I run FortiWeb without owning hardware?
Yes. Fortinet lists virtual machines, container appliances, FortiWeb Cloud WAF as a Service, and AWS and Azure marketplace versions with bring your own licence or pay as you go.
Which alternative can I run on my own servers?
BunkerWeb is open source and runs on machines you control, Ubika sells a gateway you deploy yourself, and Fastly's Next-Gen WAF can run as an agent beside the application.
Which alternatives have published entry prices?
BunkerWeb lists PRO plans from 49 euros a month, Gcore from 25 euros with a free single-domain plan, Link11 from 490 euros on annual billing and AppTrana at 99 US dollars per domain. The others are quoted or priced per usage.
Which alternatives are operated from inside the EU?
Ubika and BunkerWeb are French, Myra Security and Link11 are German and Gcore is headquartered in Luxembourg. Check the data processing terms, because the operator's country and the data centre location are separate questions.
How should I test a replacement before cutting over?
Run it in logging mode on a copy of live traffic, compare blocked requests with your current appliance, and tune exceptions first. Move to blocking only when false positives on your key forms and APIs are understood.
—
Sources
Checked 10 November 2026
Fortinet FortiWeb product page: Form factors, virtual platforms, AWS and Azure BYOL and on-demand, FortiGuard subscriptions, FortiCare, FortiWeb Cloud, no prices listed.
Founder of The Knowledge Engineers and of 2 Steps Ahead, an AI search visibility agency. Editorially responsible for every page on this site; research and drafting are AI-assisted.
Author and fact-checker: Sebastiaan Smits. This page was last reviewed on 10 November 2026; our review process is public.
