Companies Using AWS WAF

I run the crawler that produced these numbers, and AWS WAF was the oddest product in this batch to count. Our October 2026 crawl finds its JavaScript on 12,756 live domains, 6,481 of them matched to a company, 8th of 38 in Bot Detection & CAPTCHA. A domain counts when a page loads a script from awswaf.com: the silent challenge, the CAPTCHA page or the integration SDK. A web ACL that only filters requests at the edge leaves nothing in the HTML, so everything below is a floor, and it is a floor tilted towards sites that turned on bot features.

Domains are not customers here

Every AWS WAF script loads from an address that starts with an integration ID, and AWS's documentation says you integrate using the URL of the web ACL you want to protect. Group domains by that ID and the picture changes. Before cleaning, 14 IDs covered about half of the raw count. We removed five of them: Northwestern Mutual's ID on 2,128 advisor domains (eight of eight we sampled loaded Northwestern Mutual's own assets or redirected to its advisor pages), Flower Shop Network's 983 florists, a 920-domain Vietnamese-language gambling network, 493 .ru domains redirecting to Aviasales, and 429 gambling clones carrying Booking.com's ID. That's 4,953 domains.

What remains still clusters. We read an ID on 10,022 of the 12,756 domains and found about 1,300 IDs. 735 cover one domain each, while the 131 IDs with ten or more domains cover 61.55%. The biggest are creator merch stores on Spring (742), a UK GP-practice platform (642, a challenge on every one we opened), promotional-products distributors (634), Compass agent domains that redirect to compass.com (362) and Sotheby's International Realty affiliates that redirect to sothebysrealty.com (322).

"Eighteen thousand raw domains sounded like eighteen thousand buyers. Group them by the integration ID in the script address and you find about 1,300 AWS WAF setups, and a handful of platforms carry most of the weight." - David Thomson, CTO at TechnologyChecker.io

Sales signal: dedupe an AWS WAF list by integration ID, not by root domain. A GP-website provider with 642 practices is one deal, and the practices themselves never chose AWS.

One point on the chart

The chart shows a single October 2026 point, 12,756, because that's the first month on the cleaned basis. Our earlier totals moved for two reasons besides adoption: the set of domains we crawl turns over every month, dead sites out and new ones in, and our detection of the AWS WAF script widened after we began tracking it on 4 August 2026. Since then 5,421 domains have dropped it on at least one hostname, a figure that includes the removed fleets, and 236 of those still ran it on another hostname when we checked. I wouldn't call either number a trend yet.

Sales signal: size the AWS WAF market by setups, about 1,300 we could read, and give the monthly domain count little weight.

Who runs their own setup

On the company side the base looks small: 56.46% of matched companies have 1 to 10 employees. That's the platforms talking. The named companies tell a different story. Of the 50 on our list, 23 run AWS WAF on a subdomain and 11 of those are sign-in, registration or application pages: id.atlassian.com, customer-registration.statefarm.com, passport.amazon.jobs, NatWest's and RBS's online-banking logins, Monzo's web sign-in, Deakin University's applicant portal, Medibank's member login. AWS recommends exactly that, putting the challenge script on login, checkout and account-creation pages. 292 companies have more than 1,000 staff.

We also left 37 candidates off the list because the script came from someone else's setup. Careers sites on Clinch share three IDs between them, so WTW's, Equinix's and Toast's job sites run Clinch's AWS WAF, not their own. M&S Bank's pages carry HSBC's setup. Huntsman's product site shares one setup with Knowde and ten other chemical companies.

Sales signal: the buyer inside a large company is the identity or fraud team that owns the login, not the web team. Pitch account-takeover and sign-up fraud, not page speed.

Industries follow the platforms

Real Estate leads at 8.28%, then Retail (7.32%), Medical Practices (7.11%) and Advertising Services (4.51%). Three of those four are mostly shared setups: about 75% of Real Estate sits under Compass, Sotheby's International Realty and HAR.com IDs, about 70% of Medical Practices is the GP platform, and 192 of the 250 Advertising Services matches are promotional-products distributors under one ID. Geography tilts British for the same reason. The UK has 1,229 matched companies against 2,830 in the US, and English-speaking countries hold 4,739 of 6,481.

Sales signal: the vertical opportunity is the platform layer. Website providers for GP practices, estate agents and promotional-products distributors have already decided to run a WAF for their whole fleet, and a pitch to them covers hundreds of sites.

Switching: there isn't any to report

We found no switching corridor that passes our tests. 2,188 domains run AWS WAF and reCAPTCHA today, 92 run it with Cloudflare Turnstile, 72 with PerimeterX and 36 with DataDome. Most pairs are complements: a CAPTCHA on a form behind the firewall, or a dedicated bot vendor on one property and AWS WAF on another. Small numbers, and I won't dress them up.

"The companies that run AWS WAF themselves put it where the money is: logins, registrations and account pages. The marketing site usually doesn't have it." - David Thomson, CTO at TechnologyChecker.io

Sales signal: a bot-management vendor selling against AWS WAF is usually selling an add-on to it. Lead with what AWS WAF's targeted Bot Control costs per request at scale.

The stack around it

Amazon CloudFront runs on 54.53% of live AWS WAF domains and AWS hosting shows on 40.84%, which is what you'd expect, since AWS WAF attaches to CloudFront or a load balancer. Cloudflare is on 20.7%, so about a fifth of these sites run Cloudflare in front of or beside AWS. Google Analytics is on 44.89%. Other WAFs barely register: Imperva is on 0.27% and Sucuri on 0.08%. One caveat: on 2,051 domains our crawler only saw the CAPTCHA page, so the real stack there is hidden and these shares run low.

Sales signal: the Cloudflare-plus-AWS pattern is a consolidation conversation. Those sites pay for two edges and two rule sets.

What it costs

AWS's pricing page (checked October 2026) lists $5 per web ACL a month, $1 per rule a month and $0.60 per million requests. Bot Control adds $10 a month per web ACL, plus $1 per million requests at the common level after 10 million free, or $10 per million at the targeted level after 1 million free. CAPTCHA attempts cost $0.40 per thousand. The browser SDK we detect is the piece AWS pairs with targeted Bot Control and its fraud-control rules, but plain CAPTCHA and Challenge rules load AWS WAF's script too, so we can't tell from the page which tier a site pays for.

Sales signal: high-traffic sites on targeted Bot Control pay per request, and their bills grow with traffic. That's the opening for flat-priced alternatives.

Key takeaways

1. 12,756 domains after removing 4,953 under five shared IDs; about 1,300 integration IDs where we could read one.

2. 131 IDs with ten or more domains still cover 61.55% of the count, led by Spring merch stores, a GP platform and promo distributors.

3. Large companies put AWS WAF on logins and account pages; 11 of our 50 named rows do.

4. Small-company shares come from platforms: GP practices, estate agents, distributors, creators.

5. No switching corridor passes our tests; overlaps with other bot tools are complements.

How to use this list

Group rows by root domain and by integration ID, drop the platform fleets you don't sell to, and filter on company size above 1,000 for the direct buyers. For the full list of AWS WAF domains with company, size and stack data, explore TechnologyChecker.io, and our bot traffic statistics cover the traffic these firewalls are filtering.