a cloud waf is mostly a dns change and a lot of trust

moved two sites behind one last year and the bits nobody warns you about:

1: your origin ip is still reachable unless you lock it to their ranges, and almost nobody does

2: your logs show their ips now, so every geo report and every rate limit you wrote yourself is quietly wrong until you fix the real ip header

3: support becomes two vendors pointing at each other while the client waits

a cloud based web application firewall is still worth it on anything with a public login form. the second one cost me weeks though, because every visitor looked like it was coming from