Every pricing model in this market, what the major vendors charge, and the costs that never appear on a pricing page.
Bot protection costs between $0 and roughly $10,000 a month. Self-serve tools run $0–$250/month. Specialist bot-management vendors start around $3,000–$4,000/month on annual contracts. Enterprise platforms are quoted privately and commonly land above $5,000/month. There is very little in between those two bands, and that gap is the defining feature of this market.
All figures on this page checked October 2026 against vendor pricing pages and documentation. Vendors change these often — check the linked source before you rely on a number.
The headline price matters less than which model you are buying, because the model determines what happens to your bill when something goes wrong.
| Model | Typical cost | What you actually get | Where it bites |
|---|---|---|---|
| Free tier | $0 | A toggle and a category. Bots are blocked or challenged across your whole site, with no per-request score and no path-level control. | You cannot tune it, and you cannot see why something was blocked. |
| Plan-bundled | $20–$250/mo | Bot protection as a feature of a CDN or WAF plan. Better categories, some analytics, still whole-site scope. | Cost is per zone or per domain, and the useful tier is usually a 10× jump from the one below it. |
| Metered | $0.60–$1.00 per million requests |
Pay for what you inspect, on top of a base platform fee. | A scraping attack increases your bill at the same time as your load. Costs scale with the thing you are trying to stop. |
| Enterprise quote | $3,000–$10,000+/mo | Per-request scoring, rules against that score, path-level control, analytics, support. | Annual commitment, sales process, no self-serve signup, and no published price to compare against. |
| Self-hosted | $0 + your time | Open-source proof-of-work tools you run yourself. | No vendor bill, but you own the hosting, updates and tuning — and proof-of-work deters scripts, not browser automation. |
Four of the ten vendors below publish no price at all. That is not an accident — an unpublished price is what lets a vendor price by customer rather than by product, which is why comparing these on cost alone is harder than it should be.
| Vendor | Entry cost | Model | Published? |
|---|---|---|---|
| ZeroBot | $0 free tier $50/mo flat | Flat monthly, per account | Yes |
| Cloudflare Pro / Business | $20/mo annual $200/mo annual | Bundled with CDN plan, per zone | Yes — monthly billing adds ~25% |
| Cloudflare Bot Management | Enterprise only | Enterprise add-on, annual contract | No — third-party estimates near $5,000/mo |
| Google reCAPTCHA | $0 to 10k/mo then $8 → $1/1,000 | Metered assessments | Yes — free tier is 10k, not the old 1m |
| hCaptcha | Free Basic Pro $99/mo annual | Tiered, 100k evaluations included | Yes — $0.99 per 1,000 over |
| AWS WAF Bot Control | ~$10/mo + $1/million | Metered, on top of base WAF | Yes — plus $5 per web ACL |
| DataDome | ~$3,830/mo | Enterprise, annual | Yes — lowest list in the enterprise band |
| Kasada | $3,000–$5,000/mo | Enterprise, annual | Partial — ranges reported, not listed |
| Imperva | Quote only | Enterprise, usually bundled | No |
| Wordfence / Sucuri | $119/yr · $9.99/mo | WordPress plugin, per site | Yes — good value if you are on WordPress |
Two things worth noticing. First, the free tiers are not comparable — reCAPTCHA's 10,000 assessments a month is a challenge budget on your contact forms, while Cloudflare's free Bot Fight Mode is a whole-site toggle with no visibility. Second, the enterprise band clusters tightly at $3,000–$5,000/month regardless of vendor, which means the decision that matters is not which enterprise vendor, but whether you need the enterprise model at all.
Card testing is billed per attempt by your payment gateway, and the fee lands whether the card turns out to be valid or not. On a site taking payments this is routinely the largest cost in the whole equation — and the only one that grows faster the longer an attack runs.
Scraping is traffic you pay for and get nothing from. On metered hosting or a CDN with a per-request charge, the attacker's success is directly billed to you — and on metered bot protection, the same traffic costs you twice.
Rule tuning, log review, whitelist maintenance and false-positive triage are ongoing. A tool with a published price and a low-tuning model can be cheaper than a "cheaper" tool that needs a day a month from someone senior.
Blocking a real customer costs the order, sometimes the account, and occasionally the relationship. It is invisible on a pricing page and it is the number most worth asking a vendor about — a vendor who cannot tell you their false-positive rate has not measured it.
ZeroBot is the flat-fee model: $50/month, no per-request charge, free tier, no card. You add a call to your own code, or install the plugin, and the verdict and the signals behind it come back to you. There is no DNS change and no annual contract, which means leaving costs you nothing but the time to remove a snippet.
It is not the right tool for everyone, and the honest framing is this: if you are already on Cloudflare Enterprise and their machine-learning scoring is working for you, moving is not worth it. ZeroBot is for the case in between — you need a real per-request score you can act on, you cannot sign a five-figure annual contract, and you want the reasons behind a verdict visible in your own system rather than inside someone else's dashboard.
Self-serve tools cost $0 to about $250 per month. Specialist bot-management vendors start around $3,000 to $4,000 per month on annual contracts. Enterprise platforms are quoted privately and commonly land above $5,000 per month. There is very little between those two bands, which is the single biggest gap in this market.
Yes, and some of it is genuinely useful. Cloudflare includes Bot Fight Mode on its free plan, Google reCAPTCHA gives 10,000 assessments a month free, hCaptcha has a free Basic tier, and open-source proof-of-work tools such as ALTCHA and Anubis are free to self-host. The trade-off is control: free tiers give you a toggle or a category, not a score you can write rules against.
Because the vendors that score requests per-request sell to enterprises with annual contracts, and the vendors that self-serve treat bot protection as a feature of a CDN or WAF plan. A site that needs real per-request scoring but cannot sign a five-figure annual contract falls between the two.
Metered pricing charges per request inspected -- AWS WAF Bot Control is the clearest example, with a monthly fee per web ACL plus a charge per million requests. It looks cheap in a calculator and grows with traffic, so a scraping attack can show up on your bill before it shows up in your logs.
Failed-authorisation fees from card testing, bandwidth consumed by scrapers, engineering time spent tuning rules, support load from false positives, and the cost of a migration if you pick the wrong model. On sites handling payments these routinely exceed the subscription itself.
Figures checked against vendor pricing pages and documentation in October 2026: Cloudflare plans · reCAPTCHA pricing · hCaptcha pricing · AWS WAF pricing. Enterprise bands for DataDome, Kasada and Imperva are as reported by their public listings and third-party comparisons; where a vendor quotes privately, this page says so rather than inventing a figure. Newer comparative coverage exists at Prosopo and ReadyBytes — worth reading alongside this one.
$50/mo flat, free tier, no DNS change, no card.
Get started free →