OCI Web Application Firewall

OracleSecurity

Layer-7 protection against OWASP Top 10 attacks (SQLi, XSS, RCE), bot traffic, and DDoS at the application layer. Edge-deployed for global protection or regional for backend-fronted apps.

Jurisdictional exposure

Provider HQ
USAustin, USA

Subject to CLOUD Act, FISA-702, DPF

Region locations
APACEEAEUUKUSOther56 regions across 6 jurisdictions
Sovereign option
Yes — 10 sovereign-flagged regions available

Attributes

Ga Year
2019

Sub-services (3)

Managed Rule Sets

Oracle-maintained protection signatures against OWASP Top 10 and known CVEs

Bot Management

Reputation-based and behavioural detection for bad bots; CAPTCHA challenges

Rate Limiting

Per-IP / per-token rate limits to defend against credential-stuffing and scraping

Compliance & Certifications

This service is attested for the following frameworks. Always verify with the provider before relying on a specific compliance posture.

Where this runs

56 regions
27 countries
10sovereign
Sovereign regions (10)
  • EU Sovereign South (Madrid) · MadridOracle EU Sovereign Cloud
  • EU Sovereign Central (Frankfurt) · FrankfurtOracle EU Sovereign Cloud
  • US Gov East (Ashburn) · AshburnOracle US Government Cloud
  • US Gov West (Phoenix) · PhoenixOracle US Government Cloud
  • US DoD East (Ashburn) · AshburnOracle US Defense Cloud
  • US DoD North (Chicago) · ChicagoOracle US Defense Cloud
  • US DoD West (Phoenix) · PhoenixOracle US Defense Cloud
  • UK Gov South (London) · LondonOracle UK Sovereign Cloud
  • UK Gov West (Newport) · NewportOracle UK Sovereign Cloud
  • Australia Dedicated Region (Canberra) · CanberraOracle Cloud Infrastructure for Australia Government and Defence
Commercial regions (46)

Europe (13)

  • France South (Marseille)
  • France Central (Paris)
  • Germany Central (Frankfurt)
  • Italy Northwest (Milan)
  • Italy North (Turin)
  • Netherlands Northwest (Amsterdam)
  • Serbia Central (Jovanovac)
  • Spain Central (Madrid)
  • Spain Central (Madrid 3)
  • Sweden Central (Stockholm)
  • Switzerland North (Zurich)
  • UK South (London)
  • UK West (Newport)

North America (9)

  • Canada Southeast (Montreal)
  • Canada Southeast (Toronto)
  • Mexico Northeast (Monterrey)
  • Mexico Central (Querétaro)
  • US East (Ashburn)
  • US Midwest (Chicago)
  • US West (Phoenix)
  • US West (Salt Lake City)
  • US West (San Jose)

South America (5)

  • Brazil East (São Paulo)
  • Brazil Southeast (Vinhedo)
  • Chile Central (Santiago)
  • Chile West (Valparaíso)
  • Colombia Central (Bogotá)

Asia (10)

  • India South (Hyderabad)
  • India West (Mumbai)
  • Indonesia North (Batam)
  • Japan Central (Osaka)
  • Japan East (Tokyo)
  • Malaysia West 2 (Kulai)
  • Singapore (Singapore)
  • Singapore West
  • South Korea North (Chuncheon)
  • South Korea Central (Seoul)

Oceania (2)

  • Australia Southeast (Melbourne)
  • Australia East (Sydney)

Middle East (5)

  • Israel Central (Jerusalem)
  • Saudi Arabia West (Jeddah)
  • Saudi Arabia Central (Riyadh)
  • UAE Central (Abu Dhabi)
  • UAE East (Dubai)

Africa (2)

  • Morocco West (Casablanca)
  • South Africa Central (Johannesburg)

Tags

Equivalent services on other platforms

App & API ProtectorAkamai

Web application firewall and API protection delivered on Akamai's edge, combining adaptive WAF rules, API discovery, bot visibility and DDoS mitigation for web apps and APIs

Alibaba Web Application FirewallAlibaba

Managed WAF protecting web apps from OWASP Top 10 attacks, bot traffic, API abuse, and data scraping, with global and China regional deployment, custom rule engine, and unified consoles across Anti-DDoS and Security Center

AWS WAFAWS

Web application firewall that protects against common exploits with managed rule groups, custom rules, rate-based rules, Bot Control, and CAPTCHA challenges

Azure Application GatewayAzure

Layer 7 load balancer with integrated web application firewall, SSL termination, URL-based routing, cookie-based session affinity, and autoscaling based on traffic

Azure Front DoorAzure

Global application delivery network and CDN with anycast acceleration, caching, rules engine, WAF, bot protection and Private Link origins, in Standard and Premium tiers. Front Door (classic) is closed to new resources and retires 31 March 2027.

Cloudflare WAFCloudflare

L7 web application firewall protecting against OWASP Top 10 risks with Cloudflare-managed rule sets, custom expression-based rules, exposed-credentials detection, rate-limiting integration, and machine-learning attack-score signals tuned across the global traffic graph

Gcore WAAPGcore

Web application and API protection with OWASP rule sets, bot management, API schema enforcement, and rate limiting — delivered at the CDN edge with a single configuration surface

Cloud ArmorGCP

Edge DDoS protection and web application firewall with managed rule sets for OWASP Top 10, adaptive bot protection, and reCAPTCHA Enterprise integration

Huawei Web Application FirewallHuawei

Managed web application firewall with OWASP Top 10 rule sets, bot management, anti-crawler, CC (challenge-collapsar) attack mitigation, custom rule engine, and regional deployment with integrated DDoS protection

IBM Cloud Internet ServicesIBM

Edge delivery and security bundle powered by Cloudflare, offering DNS, global load balancing, WAF, DDoS protection, CDN, rate limiting, and Page Rules through a single IBM Cloud-native control plane

Web Application FirewallT Cloud

L7 web application firewall protecting against OWASP Top 10 risks — SQL injection, XSS, command injection — with managed rule sets, custom rules, IP allow/block lists, and bot-detection heuristics tuned for OTC-hosted apps

Vercel FirewallVercel

Managed WAF with bot mitigation, IP / geo blocking, custom rules, and per-route challenges — runs on the edge before any function executes

Pricing

Pricing model:usage-based