Cloudflare vs Arcjet

Key differences: Cloudflare vs Arcjet

Cloudflare vs Arcjet is the usual pairing: Cloudflare at the edge, Arcjet in the application. Teams evaluating a Cloudflare WAF alternative often keep Cloudflare for DDoS and use Arcjet for application-aware rules.

This comparison uses primary documentation reviewed on August 13, 2026. Products change, so check the linked sources before you decide.

Cloudflare's application-security products run at the network edge. Rules evaluate before a request reaches your origin, which means that DNS and traffic must go through Cloudflare. Arcjet runs inside your application: in request handlers, and on agent tool calls and background jobs the edge never sees. It works alongside any CDN, including Cloudflare, rather than replacing it.

That layer split drives the rest of the comparison. Edge rules see IP, TLS fingerprint, path, headers, and other network signals. In-app rules see session, plan tier, route, and the input to a tool call. They're complementary more often than they're substitutes.

What each layer covers

Cloudflare is strong at DDoS, coarse bot and WAF filtering, and, through AI Gateway, caching and content moderation in front of model providers. Arcjet covers application-aware bots and Shield WAF on HTTP, plus prompt-injection detection, per-user token spend, and sensitive-information checks before content hits a model, including inside agent tool calls. Bot detection is an HTTP control in request handlers.

Configuration

You change Cloudflare rules at the CDN in a dashboard, through the API, or with Terraform. You change operational in-app remote rules in the Arcjet dashboard or through MCP: block a country, ASN, IP, or VPN during an attack; turn on a global bot category; add a temporary site-wide rate limit; dry-run then promote. Those updates take effect immediately: create, update, delete, or promote from dry-run to live, with no code edit and no application restart. They still enforce inside the application, combined with any code rules into one decision, so they keep the request context that the edge doesn't have.

App-specific rules stay in code because they need application context: route, user, tenant, plan, prompt, tool call, or request body. That includes per-user token budgets, prompt-injection detection, sensitive-information checks for personally identifiable information (PII), email validation, and identity-keyed limits. Operational HTTP remote rules support fixed-window and sliding-window rate limits, bots, filters, and Shield WAF. You set token-bucket budgets in application code because each call declares how many tokens it consumes. Those remote rules are site-wide: every HTTP check for the site.

Labeled tool-call policies let a security team change the policy for a labeled action without changing the tool. That's a separate system from request remote rules.

Bot detection

Cloudflare offers Bot Fight Mode (all plans, a single domain-wide toggle), Super Bot Fight Mode (Pro, Business, and Enterprise without the Bot Management add-on: category actions, no per-request scoring), and Bot Management for Enterprise (per-request scores and custom rules). Per-request scores and custom rules sit on the Enterprise add-on. Arcjet classifies known bots by name and category in your request handlers, on self-serve plans, and can add browser-based signals for headless-browser detection without a CAPTCHA.

Rate limiting

Cloudflare rate limiting is heavily tiered. Free: 1 rule, IP only, 10-second max window. Pro: 2 rules, 1-minute max. Business: 5 rules, 10-minute max. Enterprise: 100 rules. Keying on headers, cookies, JSON body fields, or query parameters requires Enterprise Advanced Rate Limiting. You configure Arcjet rate limiting in code, and it can key on user ID, account, session, or plan on self-serve plans. You set token-bucket budgets in application code, not as remote rules.

AI Gateway vs in-app AI protection

AI Gateway sits between your application and model providers. It provides caching, request-count rate limiting, retries, analytics, Guardrails for harmful-content moderation, and data loss prevention (DLP) for PII on prompts and responses. The Guardrails documentation doesn't mention prompt-injection or jailbreak detection, and AI Gateway rate limiting is request-count-based with no concept of your authenticated users. Separately, Cloudflare's WAF AI Security for Apps (Enterprise paid add-on) can score inbound HTTP prompts for injection. That score still sits on edge HTTP, so it doesn't cover tool calls, queued jobs, or fan-out work inside the application. You configure Arcjet's AI checks in your application code: prompt-injection detection (the Arcjet Cloud API evaluates the prompt text), per-user token budgets keyed in code, and sensitive-information detection that runs entirely in your application. Sensitive-information detection uses a built-in local engine, plus an optional on-device ML model for names, addresses, and government or financial identifiers. That isn't a hosted DLP service that you route prompts through. For sensitive-info detection, the raw body isn't sent to Arcjet for inspection.

Turnstile vs advanced signals

Turnstile is a per-form CAPTCHA-replacement widget. Tokens expire after 300 seconds, are single-use, and require a verification round-trip on the protected submission. Arcjet advanced client signals collect browser-environment anomalies, persist a cookie, and evaluate with server-side bot classification and IP reputation. See CAPTCHAs vs Arcjet.

Comparison

AI agent runtime: what the edge can't see

Once you ship an agent, an MCP server, or a background pipeline, the risky work is often after the HTTP request. This comparison doesn't claim that Cloudflare is an agent-security product, and that work isn't inbound bot management (automated clients that target /login). Inbound bot management stays on HTTP controls – Cloudflare's edge bot products, and Arcjet in your request handlers.

Cloudflare's WAF, Bot Management, Rate Limiting, and AI Gateway all sit on inbound traffic. After a request is inside your application, a model can fetch a page and re-enter its context, a tool can burn tokens in a loop, or a queue job can send a support ticket to a third-party LLM with PII attached. None of those surface as a fresh HTTP request that the edge can rule on.

Arcjet runs prompt-injection detection, per-user token budgets, and in-process sensitive-info at those points. You pass the tool or job input directly. Bot detection is an HTTP control in request handlers. Labeled tool-call policies let a security team change the policy for a labeled action without changing the tool; that system is separate from site-wide HTTP remote rules. The SDK names those two surfaces protect() (HTTP request handlers) and guard() (tool calls and jobs).

When a security check can't finish (a timeout, a transport issue, or an incomplete policy), you choose what happens next. A direct Guard call returns allow with error codes rather than treating the incomplete check as a denial. Vercel AI SDK and LangChain wrappers fail closed unless you opt into continuing on error. HTTP request checks can fail open when your application can't reach Arcjet's cloud; that behavior is configurable. If you can't accept a check that didn't finish, then look at the error codes. For more information about the error codes, see the Guards reference. JavaScript, Python, and Go are the documented languages for that path; the Go SDK is pre-release.

A buyer question for any runtime control: can it use prior actions in a run when deciding the next one? A correlation ID ties Arcjet decisions to a run so that the sequence is reconstructable for investigation.

You can keep Cloudflare for DDoS, edge filtering, and AI Gateway caching or content moderation, and use Arcjet for the application-layer risks AI Gateway doesn't cover.

When to choose which

Choose Arcjet

Choose Arcjet if any of the following apply:

• You want rules in application code.
• You need per-user or per-plan logic that the edge can't see.
• You aren't routing DNS through Cloudflare, or you might move hosts.
• You want prompt-injection detection and per-user token budgets in the application.
• You're shipping an agent, MCP server, or pipeline where the risky surface is after the HTTP request.
• You want Shield WAF and advanced bot signals on a self-serve plan.

Choose Cloudflare

Choose Cloudflare if any of the following apply:

• You need L3/L4/L7 DDoS mitigation.
• You're already on Cloudflare and want zero-code network protection.
• You want JA3/JA4 TLS fingerprinting as a rule condition (Enterprise Bot Management add-on).
• You want a drop-in form widget (Turnstile).

Instant operational-rule changes aren't unique to the edge: Arcjet's dashboard and MCP update in-app HTTP rules immediately too.

In short: Cloudflare is the network and edge layer. Arcjet is the application layer, including the tool path. Many teams use both.

Compare: Vercel WAF vs Arcjet · CAPTCHAs vs Arcjet · All comparisons