> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Billing

This document describes WAAP billing structure, plan capabilities, Domain / Zone definition, and plan management.

Detailed pricing information is available on the [Security pricing page](https://gcore.com/pricing/security#waap).

## Plan details

The following table outlines feature availability across WAAP plans. Features marked as **Add-on** are available as separately purchasable additions to the base plan.

| Feature                 | Free | Start | Pro    | Enterprise |
| ----------------------- | ---- | ----- | ------ | ---------- |
| **IP Firewall**         |      |       |        |            |
| DenyList / AllowList    | ❌    | ✅     | ✅      | ✅          |
| IP Reputation           | ❌    | ❌     | ✅      | ✅          |
| **Default Rules**       |      |       |        |            |
| OWASP Threats           | ✅    | ✅     | ✅      | ✅          |
| Behavioral WAF          | ❌    | ❌     | Add-on | Add-on     |
| CMS Protection          | ❌    | ❌     | Add-on | Add-on     |
| **Custom Rules**        |      |       |        |            |
| WAF Rules               | ❌    | ✅     | ✅      | ✅          |
| Basic rate-limits       | ❌    | ✅     | ✅      | ✅          |
| Advanced rules          | ❌    | ❌     | Add-on | Add-on     |
| **Bot Management**      |      |       |        |            |
| Automated threats       | ❌    | ❌     | Add-on | Add-on     |
| Known Bots              | ❌    | ❌     | Add-on | Add-on     |
| **Threat Intelligence** |      |       |        |            |
| Security Insights       | ❌    | ❌     | ❌      | Add-on     |
| IP Spotlight            | ❌    | ❌     | ❌      | Add-on     |
| **API Security**        |      |       |        |            |
| API Discovery           | ❌    | ❌     | ❌      | Add-on     |
| API Protection          | ❌    | ❌     | ❌      | Add-on     |

## Domains / Zones

A Domain / Zone is a WAAP billing and configuration unit.

It represents one CDN resource with a single WAAP configuration. Multiple domains and aliases can be grouped into the same Domain / Zone when they:

* Redirect to the same origin.
* Share the same CDN configuration.
* Use the same WAAP security settings.

In this case, all linked domains are managed as one configuration and billed as one Domain / Zone.

A single domain can also be split into multiple configurations. For example:

* `portal.domain.com`
* `admin.domain.com`
* `api.domain.com`

If these subdomains are mapped to different CDN resources and require separate WAAP configurations, each one is counted and billed as a separate Domain / Zone.

## Plan management

WAAP plans are available as either self-serve or sales-assisted offerings.

* **Free**, **Start**, and **Pro** plans are self-serve and can be activated directly through the [Gcore Customer Portal](https://portal.gcore.com/accounts/reports/dashboard).
* The **Enterprise** plan is available through direct engagement with [Gcore Sales](https://gcore.com/waap-contact-sales) and supports custom terms and enterprise agreements.

### Trial

When a WAAP plan is activated, a trial period applies according to the selected plan.

* Paid plans include a 30-day trial with full access to the features available in that plan.
* Service usage is limited by the included traffic and plan quotas.
* The trial ends when 30 days have elapsed or when the included quota is exceeded.

A credit card is not required to start.

If no payment method is added and the included quota is reached, service consumption is stopped.

If a credit card is added, service continues without interruption. Usage remains free until the included quota is reached. Any usage beyond the included quota is billed according to the selected plan.

## Billing for disabled domains

When a WAAP-protected domain is disabled, the following billing rules apply:

* **Traffic is not processed.** No requests are inspected or counted while the domain is disabled.
* **The domain is counted for the current billing month.** If you disable a domain mid-month, it counts as one Domain / Zone for that billing period.
* **The domain is not counted in subsequent months.** Starting from the next billing month, a disabled domain no longer appears in your usage metrics.

<Tip>
  To avoid being billed for a domain in a given month, disable it before that billing month begins.
</Tip>