Website · Documentation · Pricing

Cost calculator

Your traffic

Choose a workload. We’ll estimate traffic and requests for you.

Estimated monthly costs

USD per month, before tax. Load balancing and unpriced extras are excluded.

What’s included?

Estimates cover cacheable content. Origin and optional services are added only when you enter their rates. Plans differ in features and coverage; check their terms before buying.

Advanced settings
Split traffic between regions

Percentages must total 100%. The same split applies to bytes and requests. CloudFront charges by serving edge location; this is an approximation. Shared free allowances are allocated proportionally.

Origin and optional services

Paid tiers start with this workload; estimates do not include other account traffic. Enter your own effective rates after origin allowances. Reads use request misses; egress uses byte fill. Functions assume one invocation per viewer request. Zero leaves an extra out of the estimate; it does not mean your origin is free.

Compare a quote you received

This is your quote, not a published provider price. Use an effective rate for the selected traffic mix; tiers, included usage and commitments need to be reflected in your inputs. Sharing a scenario includes your quote details.

Presets are starting assumptions, not measured traffic. Video assumes one rendition and segment GETs; playlists, retries and extra audio tracks add requests. Fill is a byte ratio, not a request cache-hit rate. GB = 1 billion bytes; Google bills GiB = 1,073,741,824 bytes; CloudFront estimates use binary GB as a billing assumption.

Overview

Secure website delivery

Imperva combines website acceleration with its cloud application security platform. Static and smart caching, TLS termination, traffic dashboards and Layer 7 load balancing support web applications delivered through its network.

Choose the product scope

Cloud WAF, Advanced Bot Protection, API Security, DDoS protection and Secure CDN are distinct parts of the portfolio. Confirm which controls, optional licenses and support terms are included in the proposal.

Company background

Imperva was incorporated in 2002. Thales completed its acquisition on December 4, 2023; current Imperva services remain offered. Its current contact page lists Austin, Texas as headquarters.

Network

Global delivery network

Imperva publishes a footprint of 60+ PoPs and over 13 Tbps of capacity across APAC, the Americas and EMEA. Its named-city inventory is more useful for checking geographic fit than comparing headline counts.

Shared delivery and protection

Local PoPs support caching, WAF, bot protection, DDoS scrubbing and load balancing. Regional Super PoPs and a mesh pool provide additional scrubbing capacity; these security tiers are not a description of multi-tier caching.

Check your audience

The map shows approximate centers for identifiable published cities, rather than facility addresses. Several ambiguous names remain unpinned. Test representative audience and origin locations before choosing a plan.

Published cache cities

Approximate city centers, not exact facilities. Multiple facilities share one city marker. Some published city names remain unpinned; city counts do not measure capacity.

TokyoHong KongSingaporeSydneyAucklandMelbourneOsakaDelhiMumbaiTaipeiJakartaBangkokSeoulKuala LumpurManilaHanoiDetroitNew YorkTorontoAtlantaDallasSeattleMiamiSao PauloBuenos AiresDenverBogotaRio de JaneiroMontrealHoustonQueretaroChicagoMadridParisLondonDublinAmsterdamDüsseldorfFrankfurtZurichWarsawStockholmTel AvivMilanDubaiJohannesburgIstanbulViennaCape TownBarcelona
Cities

Tokyo, Hong Kong, Singapore, Sydney, Auckland, Melbourne, Osaka, Delhi, Mumbai, Taipei, Jakarta, Bangkok, Seoul, Kuala Lumpur, Manila, Hanoi, Detroit, New York, Toronto, Atlanta, Dallas, Seattle, Miami, Sao Paulo, Buenos Aires, Denver, Bogota, Rio de Janeiro, Montreal, Houston, Queretaro, Chicago, Madrid, Paris, London, Dublin, Amsterdam, Düsseldorf, Frankfurt, Zurich, Warsaw, Stockholm, Tel Aviv, Milan, Dubai, Johannesburg, Istanbul, Vienna, Cape Town, Barcelona

Listed without a marker: Ashburn, Los Angeles, San Jose, Vancouver, Santiago, Lima, Copenhagen.

Features

FeatureSupported
Web application firewall✓ Supported
Bot protection◐ Partial
DDoS protection◐ Partial
Rate limiting◐ Partial
HTTP/3 (QUIC)Not listed
TLS 1.3✓ Supported
Tiered caching◐ Partial
Origin shield◐ Partial
Instant cache purge✓ Supported
Serve stale while refreshing✓ Supported
Serve stale on origin errors✓ Supported
Image optimization◐ Partial
On-demand videoNot listed
Live videoNot listed
Digital rights managementNot listed
HLS / DASH packagingNot listed
WebSockets✓ Supported
Signed URLsNot listed
Edge computeNot listed
Edge functionsNot listed
Key-value storageNot listed
Configuration API✓ Supported
Real-time logs◐ Partial
Log export✓ Supported
Terraform provider✓ Supported

✓ Supported · Partial: limited or separate-product support · ✗ Not supported · Not listed: unconfirmed. Some features need a separate product or plan.

Cache controls

  • Choose standard HTTP caching, smart profiling, custom rules or cache-all behavior. Exclude personalized and authenticated content explicitly.
  • Purge the whole cache or selected URLs and tags. Imperva advertises sub-second propagation.
  • Configure cache keys using headers, cookies, geography and query parameters.
  • Serve Stale Content refreshes expired resources in the background and can retain stale responses while the origin is unavailable.
  • Cache Shield adds an intermediate cache when the appropriate FlexProtect license is included.

Transport and optimization

TLS 1.3, HTTP/2 and IPv6 are documented. Content optimization includes image compression and JavaScript minification. Ask about the specific image transformations your application needs. Confirm HTTP/3 and specialized media processing for the selected product.

WebSocket upgrades are supported, but Cloud WAF does not inspect traffic after the upgrade. The usual WebSocket idle timeout is 30 minutes; Google Cloud deployments depend on their load balancer settings.

Security and visibility

Built-in WAF policies cover threats such as SQL injection and cross-site scripting. Bot and DDoS products need the appropriate service scope. Custom rate rules count per proxy and can trigger several requests past a threshold.

Traffic dashboards are realtime. Exported Cloud WAF access logs can arrive within ten minutes; security logs normally arrive in three to five minutes. These files are distinct from immediate log streaming.

Pricing

Obtain a scoped quote

Request pricing for the delivery and application security services you need. Confirm included bandwidth, request charges, overages, commitments, Cache Shield licensing and additional security products. A free trial is not a permanent free delivery plan.

Compare the total

Enter the quoted USD bandwidth and request rates in the calculator, then add fixed subscription or optional service charges under advanced settings. If the contract uses another currency, convert it to USD first. Keep origin egress separate so cache efficiency is reflected in the comparison.

Developer tools

Provisioning and configuration

The documented APIs cover site onboarding, cache settings, policies, certificates, usage and log configuration. Imperva maintains the Incapsula Terraform provider; verify resource coverage before depending on it for every control.

Operations

SIEM integration can send service-specific logs to Amazon S3 or Splunk HEC, or provide API retrieval. Legacy SFTP remains limited to supported services. Allow for delayed files, destination configuration and potential duplicate deliveries.

Origin planning

DNS onboarding and certificate settings must match the website. When Cache Shield is enabled, review origin allowlists and per-IP rate limits because requests are concentrated through a shield PoP.

When it fits

  • Websites that need delivery and configurable Cloud WAF protection together.
  • Teams that want API/Terraform configuration and SIEM integration.
  • Applications that benefit from custom cache keys, stale responses and licensed shielding.

Before you choose

  • Obtain a quote before comparing total cost with public usage tariffs.
  • Validate specialized media, edge runtime and HTTP/3 requirements before committing.
  • Strict global rate quotas need additional design: counters are per proxy and asynchronous.
  • Do not rely on Cloud WAF inspection of upgraded WebSocket messages.

History

From Incapsula to Imperva

Imperva introduced its Incapsula cloud offering in 2011 and acquired the remaining Incapsula ownership in March 2014. Legacy Incapsula names still appear in tooling such as the Terraform provider.

Thales ownership

Thales completed its company acquisition on December 4, 2023. This transaction did not itself retire Secure CDN or the cloud security service.

Sources