The use case: how VFS Global deploys Cloudflare WAF
VFS Global uses the Cloudflare WAF alongside Bot Management and Rate Limiting to shield its visa application websites from OWASP threats, protect API endpoints and prevent sensitive data detection. It runs managed rules and custom rulesets at the edge so that abusive traffic is blocked before reaching its servers.
More reported results
Figures published in Cloudflare WAF’s case study. They are not independently measured by usedby.
VFS Global saw immediate performance results with the Cloudflare cache, rapidly off-loading 97% of its static traffic to edge servers.
Currently, Cloudflare identifies and blocks as much as 15 percent of our total traffic.
detected and mitigated 194 million app layer threats
Cloudflare Bot Management identified 10 million automated bot requests by JA3 fingerprint
In the customer’s words
Cloudflare has elevated our overall security and operational maturity. We now have edge-level visibility, faster incident response, and stronger protection against API abuse and bot-driven traffic, all while maintaining high availability.Other companies using Cloudflare WAF
Customers across industries, with public evidence.
CalienteConfirmed
CrazyGamesConfirmed
Hack The BoxConfirmed
Olive YoungConfirmed
CapacityDeclared
HalcyonDeclaredGo straight to the source
Based on Cloudflare WAF’s published case study. We check the public evidence; the results are reported by the vendor.
cloudflare.com- Last checked
- Nov 12, 2026
Open source capture What the story claims, and what we checked
What we compared with the page.
- The figure: 581 millionChecked
Printed word for word on the page, near the name of VFS Global.
- The passage quoted aboveChecked
Copied word for word from the page, near the name of VFS Global.
- VFS Global uses Cloudflare WAFChecked
Confirmed line.
- The result itselfNot checked
We quote it; we did not measure it.
In addition, the Cloudflare WAF further secures VFS Global by shielding the system from threats in the Open Web Application Security Project (OWASP), protecting API endpoints, and preventing sensitive data detection. In a single month, the WAF generated 581 million protective firewall events