What do you need a WAF for? Unless it's a legacy app that you have no control over, the best alternative would be nothing.