Sold by: Fortinet Inc.
Deployed on AWS
Free Trial
The FortiWeb web application firewall (WAF) defends web-based applications from known and zero-day threats. Its AI-based machine learning identifies threats with virtually no false positive detections.
4.1
Overview
Whether to simply meet compliance standards or to protect mission critical hosted applications, FortiWeb Web Application Firewalls (WAFs) provide advanced features and AI-based machine learning detection engines that defend web applications from known and zero-day threats.
Using a multi-layered and correlated approach, FortiWeb intelligently and accurately protects your web applications from the OWASP Top 10 threats. Combined with Fortinet Web Application Security Service from FortiGuard Labs, FortiWeb keeps your applications safe from vulnerability exploits, bots, malware uploads, DoS attacks, advanced persistent threats (APTs), and zero day attacks.
FortiWeb software editions offer the same features of the FortiWeb hardware-based appliances with the flexibility to deploy instances as needed to meet the demands of dynamic application hosting environments.
Highlights
- EFFECTIVE protection using multiple techniques including signatures, IP reputation, antivirus, and AI-based behavioral analysis and bot mitigation
- INTEGRATED with FortiGate, FortiSandbox, and leading third-party vulnerability scanners for enhanced zero-day threat protection and virtual application patching
- ACCURATE with intelligent tools that minimize false positive detections including user scoring, session tracking, and event correlation
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
OtherLinux 8.0.8
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 15 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
r5.xlarge Recommended | $2.51 |
m3.xlarge | $2.51 |
m4.xlarge | $2.51 |
r5.2xlarge | $4.43 |
m5.xlarge | $2.51 |
m5.2xlarge | $4.43 |
m4.2xlarge | $4.43 |
m3.2xlarge | $4.43 |
t3.large | $1.04 |
r5.4xlarge | $8.00 |
Dimensions summary
You pay by the hour for FortiWeb based on the AWS EC2 instance size you run. Each dimension maps to a specific instance type across several families — burstable (t2, t3), general-purpose (m3, m4, m5, m7i), compute-optimized (c4, c5, c7i), and memory-optimized (r5). Within each family, sizes scale from large up to 4xlarge, with hourly rates rising as vCPU and memory grow. There are no separate tiers or add-ons; you simply select the instance that fits your traffic and performance needs. Billing is usage-based, so you pay only for the hours each instance runs.
Top-of-mind questions for buyers
Each hourly dimension maps to one running FortiWeb virtual appliance on a specific AWS EC2 instance type. The instance size sets the vCPU and memory available for inspecting traffic. You are billed per running instance per hour, so each appliance you launch counts separately toward your bill.
Software charges meter running instance-hours only. A fully stopped instance does not accrue FortiWeb hourly charges. Stopped instances may still incur underlying AWS storage fees for attached volumes, but the FortiWeb licence bills active running time. Charges resume when you start the instance again.
Each instance type has its own hourly rate, rising with vCPU and memory. Switching sizes is a manual choice — you launch the appliance on the instance type you want. There is no automatic upgrade. If you run a new size, you pay that size's hourly rate for its running hours.
www.fortinet.com+1
Helpful?
Vendor refund policy
You may terminate the instance at anytime to stop incurring charges.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Additional details
Usage instructions
After deploying the instance, click on 'Manage in AWS Console' to see the running instance and public DNS address to continue the configuration of the FortiWeb-VM. Connect to the secured Web UI via the public DNS address: https://Public DNS:8443. For any CLI configuration/settings, SSH is required to log into the CLI. Default login credentials are with a username of "admin" and the AWS Instance ID value as the password. The FortiWeb-VM Install and Configure guides is located at https://docs.fortinet.com/vm/aws/fortiweb . For the full FortiWeb Administrator Guide, please refer to Fortinet documentation: https://docs.fortinet.com/fortiweb/admin-guides
Resources
Support
Vendor support
Fortinet FortiCare Support Services give you global support on a per-product basis. All FortiCare Support Services include firmware upgrades, access to the support portal and associated technical resources.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Fortinet Inc.
By Check Point Software Technologies
By Barracuda Networks
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Threat Detection Engine
AI-based machine learning detection with behavioral analysis to identify known and zero-day threats with minimal false positive detections
Multi-Layered Protection Approach
Multiple detection techniques including signatures, IP reputation, antivirus, and bot mitigation to defend against OWASP Top 10 threats
Third-Party Integration
Integration with FortiGate, FortiSandbox, and leading vulnerability scanners for enhanced zero-day threat protection and virtual application patching
False Positive Minimization
Intelligent tools including user scoring, session tracking, and event correlation to reduce false positive detections
Comprehensive Threat Coverage
Protection against vulnerability exploits, bots, malware uploads, DoS attacks, advanced persistent threats (APTs), and zero-day attacks
AI-Based Zero-Day Threat Prevention
Detects and blocks unknown threats and zero-day exploits in real-time, including log4shell, text4shell, and MOVEit attacks, before they can exploit vulnerabilities.
Intrusion Prevention System with CVE Coverage
Shields against OWASP Top 10 attacks with over 2,800 Web CVEs and Snort 3.0 signature enforcement for deep packet inspection.
DDoS Mitigation and Bot Prevention
Provides advanced DDoS attack mitigation and automated bot detection to protect applications from overload attacks and bot-driven exploits while maintaining service availability.
API Discovery and Schema Validation
Monitors API traffic for sensitive data exposure, performs real-time API discovery and governance, and enforces auto-generated Swagger schema validation for API security.
AWS Native Integration and Rapid Deployment
Integrates seamlessly with AWS services including Route 53, AWS WAF, AWS Shield, API Gateway, CloudFront, and Lambda, with non-agent deployment in less than 15 minutes requiring only DNS configuration.
Web Application Firewall
Cloud native WAF that secures web applications and APIs against OWASP Top 10, DDoS, and zero day attacks
Machine Learning-Based Threat Detection
ML backed adaptive protections to detect shadow API endpoints, identify malicious bots, and stop emerging attacks with automatic protection configuration
Containerized Deployment Architecture
Containerized deployment mode supporting single and container-based deployments with north-south and east-west security for hybrid environments
API Protection
Protection for JSON and GraphQL APIs with ML-based discovery and automatic configuration of shadow API endpoints
Performance Optimization Controls
Configurable rate limiting, content routing, load balancing, and server health monitoring to maintain application performance during protection operations
Standard contract
No
No
No
Customer reviews
reviewer2897019
Firewall protection has secured our customer portal and provides long-term peace of mind
Reviewed on Sep 08, 2026
Review from a verified AWS customer
What is our primary use case?
I use the solution as a firewall for our customer portal.
How has it helped my organization?
The solution provides peace of mind with website protection.
What is most valuable?
The solution offers IP Protection, which I find very valuable.
What needs improvement?
There is room for improvement in providing better access to updates, more seamless renewals, and the ability to rename objects.
For how long have I used the solution?
I have used the solution for 12 years.
Which solution did I use previously and why did I switch?
I did not use any previous solutions.
How was the initial setup?
Inital setup was fairly involved, requiring multiple sessions with Fortinet support.
What's my experience with pricing, setup cost, and licensing?
It is probably best to bring your own license (BYOL).
Which other solutions did I evaluate?
I did not consider any alternate solutions.
What other advice do I have?
The renewals are not seamless, and although updates are advertised via email from AWS, actual software updates require contacting support for access.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Prasanth K.
Easy-to-Implement AppSec with Strong Signature Detection, Bot Protection, and Cloud Integration
Reviewed on Feb 21, 2026
Review provided by G2
What do you like best about the product?
While we use it as an mirror alternate to AWS WAF for our China accounts, It brings in lot of value ad interms of very less manual effort and almost covers all of our security aspects for both our internal and external apps.
Its Signature based detection and Advanced Bot protection defn needs a praise.
Synthetic Testing, Fabric Connector options really put forti's Appsec in driver position.
Its very easy implementation, to use and configuration and integration with cloud (AWS & Azure market place pfferings) comes in handy.
Its Signature based detection and Advanced Bot protection defn needs a praise.
Synthetic Testing, Fabric Connector options really put forti's Appsec in driver position.
Its very easy implementation, to use and configuration and integration with cloud (AWS & Azure market place pfferings) comes in handy.
What do you dislike about the product?
Just like any other software, its initial setup initial setup can be a head-scratching because the platform offers an overwhelming number of useful but complex options.
Reporting is some what limited which we got to knwo during our training and it pretty much remained the same today.
Reporting is some what limited which we got to knwo during our training and it pretty much remained the same today.
What problems is the product solving and how is that benefiting you?
Since AWS WAF is not allowed in China mainland, we use Forti products to cover our applications in place of this. Due to its general availability in AWS/Azure market place, we sort of setteled on this and it continue to impress us securing our products from almost all attacks.
Because of its powerful and multi option features, it covers all ur firewall needs not just for our application but DNS, ELB's nd other API security needs as part of our hybrid security strategy
Because of its powerful and multi option features, it covers all ur firewall needs not just for our application but DNS, ELB's nd other API security needs as part of our hybrid security strategy
Piotr M.
Streamlines Web Security but Needs UI Enhancements
Reviewed on Feb 18, 2026
Review provided by G2
What do you like best about the product?
I really like the ease of deployment and the AI-powered automation in FortiAppSec Cloud, which make protecting and accelerating web apps and APIs much more manageable. The initial setup was very straightforward and I appreciate the unified management and reduced complexity it offers.
What do you dislike about the product?
I find the custom rule tuning tricky at first and the UI/UX lacks intuitiveness. It could use better incident timelines and risk scoring for an overall polish. There's also occasional performance dip or latency under high traffic or complex rules.
What problems is the product solving and how is that benefiting you?
I use FortiAppSec Cloud to protect web apps and APIs, handling issues like false positives, evolving threats, and security challenges.
Alexandru R.
Secure, User-Friendly with Great Support, Minor Lag Issues
Reviewed on Feb 16, 2026
Review provided by G2
What do you like best about the product?
I really appreciate the ease of access with FortiAppSec Cloud, along with its reliable customer support which is very beneficial for me. The dashboard is also great because it allows us to monitor all activities conveniently. I found the initial setup process to be very easy, and we got everything set up in under one hour.
What do you dislike about the product?
There's some lag in the platform when we reach a large number of endpoints.
What problems is the product solving and how is that benefiting you?
FortiAppSec Cloud helps us deliver secure endpoints in the cloud to customers, with ease of access and reliable customer support.
Mansi S.
Robust Protection with Room for UI Improvement
Reviewed on Feb 13, 2026
Review provided by G2
What do you like best about the product?
I like the FortiAppSec Cloud's clean dashboard, which lets me quickly understand what’s happening without digging through endless logs. I also appreciate that I can log in and immediately see what types of attacks are being blocked, where traffic is coming from, and whether there are any unusual spikes. It's our security shield in front of our applications.
What do you dislike about the product?
The UI is clean overall, but sometimes when you're trying to troubleshoot something specific, you have to click around more than you'd like. A more straightforward log search or clearer explanations inside the dashboard would help. The UI is not customizable as well. I would love to see that option.
What problems is the product solving and how is that benefiting you?
I use FortiAppSec Cloud as a security shield for our web apps and APIs, providing deep visibility into traffic, reducing bot activity, preventing web attacks, and simplifying security reporting.