Cloudflare

Overview

Cloudflare is a global edge platform for website and application security, performance, and serverless compute. Primary jobs: authoritative DNS, reverse-proxy CDN, unmetered DDoS mitigation, WAF and bot controls, edge serverless (Workers), object storage (R2), and Zero Trust / SASE (Access, Gateway, WARP). Cloudflare states it powers roughly one in five sites on the Internet and operates in 330+ cities.

Company: cloudflare.com. Application plans: cloudflare.com/plans. Pro plan: plans/pro. Business: plans/business. Developer platform: developer-platform pricing. Workers docs pricing: Workers platform pricing. Docs hub: developers.cloudflare.com. Status: cloudflarestatus.com. Trust: Trust Hub.

Cloudflare sells edge proximity more than regional VMs: traffic terminates at nearby PoPs, security runs before origin, and Workers use V8 isolates (workerd) without classic cold-start packing for most workloads. R2 has no Internet egress fees. Application plans (Free/Pro/Business/Enterprise) are separate from Workers Paid ($5/month base)—teams often mix Free application + Workers Paid or Pro + Workers Free.

Key features

• Authoritative DNS + reverse proxy — Fast DNS, Universal SSL, HTTP/2 and HTTP/3, compression, redirects and rules, and the orange-cloud proxy that enables caching, WAF, and DDoS scrubbing without moving origin hosting.
• CDN & caching — Global cache, Cache Rules, Tiered Cache, optional Cache Reserve (persistent object cache to reduce origin load), Argo Smart Routing (paid add-on, starts ~$5/mo) for optimized paths, and higher-plan performance options.
• Unmetered DDoS protection — Network- and application-layer mitigation included from Free through Enterprise (depth and SLAs scale by plan). Magic Transit extends L3/L4 protection to networks on network/enterprise offerings.
• WAF, bots, rate limiting — Free Managed Ruleset on all plans; Pro adds stronger managed coverage (OWASP/Cloudflare managed, Super Bot Fight Mode, more custom rules). Business deepens WAF/rate limits, PCI DSS 4.0 path features, and support/SLA. Turnstile replaces CAPTCHA; advanced Bot Management and client-side JS defenses expand on paid/Enterprise packaging.
• Workers serverless — JS/TS (and Wasm) at the edge. Free: 100k requests/day, 10 ms CPU/invocation. Workers Paid: $5/mo with 10M requests + 30M CPU-ms included; then $0.30/M requests and $0.02/M CPU-ms. Standard model: no wall-clock duration charge; static assets free/unlimited. CPU max up to 5 minutes/invocation (defaults lower); cron/queue up to 15 minutes CPU.
• Pages, static assets, and full-stack edge — Git-linked deploys; Pages Functions bill as Workers. Workers static assets and modern full-stack patterns are first-class for many new apps.
• R2 object storage — S3-compatible API with zero Internet egress fees. Free allotment includes 10 GB-month storage, 1M Class A and 10M Class B operations. Paid standard storage about $0.015/GB-month; Class A ~$4.50/M; Class B ~$0.36/M. Infrequent Access trades cheaper storage for higher ops/retrieval.
• Data & stateful edge — KV, D1 (serverless SQL), Durable Objects, Queues, Hyperdrive (external Postgres acceleration), Vectorize, Workers AI (10k neurons/day free then $0.011/1k), AI Gateway, Workflows, Browser Rendering, Containers (Workers Paid meters).
• Zero Trust / Cloudflare One — Access (ZTNA), Gateway (SWG), WARP, Browser Isolation, CASB, DLP, Email Security. Free up to 50 users; pay-as-you-go about $7/user/month; Contract custom. Log retention and support improve on paid seats.
• Common add-ons — Load Balancing (~$5/mo+), Stream (Pro/Business include free storage/delivery minutes), WordPress APO ($5/mo on Free; included Pro/Business/Enterprise), Advanced Certificate Manager (~$10/mo), Log Explorer (usage; first 10 GB free on plans messaging), Registrar (at-cost domains).
• Ops surface — Analytics, Workers Logs, Logpush, GraphQL Analytics API, Terraform provider, cloudflared Tunnels, Radar, status page.

Pricing

Cloudflare is freemium across product families: (1) application security/performance plans billed per zone/account ladder, (2) Workers/developer platform with a separate Free vs Paid account subscription, (3) Zero Trust per user, plus usage meters for storage, AI, media, and add-ons. Figures below match official plan and Workers docs as of mid-2026—always recheck live pages before committing budget.

Application plans (CDN, DNS, WAF, DDoS)

Plan	Price (official)	Headline inclusions	Best for
Free	$0/month	DNS, CDN, Universal SSL, unmetered DDoS, Free Managed Ruleset, core WAF features, community support path	Personal sites, hobbies, light production, labs
Pro	$20/mo billed annually, or $25/mo monthly	Everything in Free + professional performance/security upgrades (e.g. lossless image optimization path, stronger bot/WAF tooling, more rules/controls)	Revenue sites, blogs, startups, agencies
Business	$200/mo billed annually, or $250/mo monthly	Small-business / compliance focus: PCI DSS 4.0 compliance features on the plan matrix, 100% uptime SLA with 1× service credits, deeper security and support vs Pro	Ecommerce, SaaS fronts, regulated SMBs
Enterprise (Contract)	Custom, typically annual	Network prioritization, higher SLA credit multiples (plans matrix cites 10× standard / 25× premium messaging), advanced bot/WAF packaging, dedicated support and enterprise features	Mission-critical multi-domain, large traffic, RFPs

Official positioning: Free for personal/hobby (not business-critical); Pro for professional sites; Business for small businesses online; Contract for mission-critical apps. Partial (CNAME) setup with external DNS is Business/Enterprise—Free/Pro generally need full nameservers for full proxy features.

Pro upgrade triggers Cloudflare cites: monthly revenue, ~1 TB+ traffic, self-managed origins, or real breach risk. Image optimization and tighter WAF/cache control are typical “why Pro” levers; Business is usually about SLA, PCI path features, and support—not raw CDN speed alone.

Workers & developer platform

Workers Paid is separate from Free/Pro/Business application plans. You can combine any application plan with Workers Free or Workers Paid.

Meter	Workers Free	Workers Paid (Standard)
Base fee	$0	$5 USD / month minimum per account
Requests	100,000 / day	10 million / month included; then $0.30 / million
CPU time	10 ms CPU per invocation	30 million CPU-ms / month included; then $0.02 / million CPU-ms
Duration (wall clock)	No charge	No charge or limit for duration on Standard
Static assets	Free / unlimited (docs)	Free / unlimited
Egress on Workers	No charge for data transfer / throughput (docs)	Same

Workers docs examples: 15M requests/month at ~7 ms CPU ≈ $8 ($5 + $1.50 requests + $1.50 CPU); 100M at 7 ms ≈ $45.40. With Workers Caching, cache hits still bill as requests but only misses use CPU. Set CPU limits in Wrangler/dashboard to avoid runaway bills.

Related developer meters (official tables, summary):

• KV: Free 100k reads/day, 1k writes/day, 1 GB; Paid then $0.50/M reads, $5/M writes, $0.50/GB-month after included storage.
• D1: Free 5M rows read / 100k written / day, 5 GB; Paid then $0.001/M reads, $1.00/M writes, $0.75/GB-month after included storage.
• R2: Free 10 GB-month + ops; paid storage/ops as above; egress free.
• Workers AI: 10k neurons/day free; then Workers Paid + $0.011 per 1k neurons.
• Queues: Free 10k ops/day; Paid 1M/month + $0.40/M.
• Containers: Workers Paid; memory/CPU/disk after included allotments; e.g. $0.025/GB NA/EU egress after 1 TB included.
• Workers for Platforms: ~$25/month base (docs) for multi-tenant script platforms.

Zero Trust

Plan	Price	Notes
Free	$0 forever (≤50 users)	Community/Discord support; short standard log retention (up to ~24 hours on plans matrix)
Pay-as-you-go	$7 / user / month	No user cap; longer logs (up to ~30 days); chat/ticket support
Contract	Custom annual per user	Full SASE packaging, longer retention, phone support options

Limits & gotchas

• Workers Free daily caps — 100k requests/day and 10 ms CPU hard-limit many real APIs. Burst traffic or heavy CPU work fails or needs Paid. Limits reset on documented Free schedules (often 00:00 UTC for several products).
• Application Free feature ceiling — Fine for DNS/CDN/basic DDoS; thin on advanced image optimization, SLA, PCI path features, partial DNS setup, and high rule counts. Community consensus: Free is legitimately usable for many small businesses—until compliance, support, or WAF depth forces Pro/Business.
• Pro vs Business value gap — $20–25 → $200–250 is a steep jump. Reddit/sysadmin threads often say stay on Pro if you only need image optimization + better rules; buy Business for SLA/PCI/support, not because Free CDN is “slow.”
• Multi-product invoice complexity — Workers, R2 Class A ops, Durable Objects duration, Containers memory, and Logpush can surprise teams who only budgeted the $5 Workers base or $20 Pro.
• Platform concentration risk — Outages (widely discussed after major 2025 incidents) take many sites down simultaneously. Design origin fallback, multi-CDN, or DNS failover for revenue-critical properties.
• Edge TLS termination — Proxied traffic is decrypted at Cloudflare. That enables WAF/caching but matters for threat models and compliance design (Strict SSL to origin, end-to-end patterns, data classification).
• WAF / bot false positives — Super Bot Fight Mode and managed challenges can block legitimate APIs, scrapers you own, or regions. Tune rules; use allowlists for critical paths.
• Support tiering — Free/community paths frustrate billing and account recovery threads; Business/Enterprise and paid Zero Trust seats get better channels. Do not assume Free support will untangle a production lockout quickly.
• Vendor gravity on the developer platform — KV, Durable Objects, D1, R2 bindings, and Workers-specific APIs are fast to adopt and costly to leave. Hyperdrive helps keep Postgres elsewhere; still plan exit paths for critical state.
• Always-on Containers economics — Community pricing threads note always-running container memory/disk can lose to a cheap VPS; design for sleep and model multi-layer bills (Worker + DO + container).
• Enterprise sales wall — Advanced Bot Management packaging, Magic Transit, network prioritization, and some compliance/custom WAF needs still push to Contract. Mid-market feels a gap between Business $200 and full Enterprise quotes.
• Plan-specific upload and rule limits — Verify current max upload sizes and custom rule counts in dashboard docs before large media or complex WAF designs.

Community sentiment

Across r/CloudFlare, r/sysadmin, r/devops, r/webhosting, Hacker News, G2/Capterra company listings, and Cloudflare Community, sentiment is broadly positive with recurring operational caveats.

Praise: Free tier that includes real CDN and DDoS (not a toy); Workers cost at scale vs Lambda + CloudFront + egress; R2 killing egress anxiety; Tunnels replacing messy port-forwards; Zero Trust free 50 seats for small orgs; Pro often “enough” when Free image/WAF limits bite; documentation and Wrangler DX improving; default answer for “put something in front of my origin.”

Criticism: stacked invoices; Free support quality; Workers lock-in; D1/AI immaturity vs managed Postgres/LLM APIs; Containers hard to forecast; outages affecting a large share of the web; Enterprise negotiation opacity; regional routing quirks Pro/Argo do not always fix; sales pressure toward Enterprise in some sysadmin stories.

Comparisons usually slot Cloudflare as default price/performance + security; Fastly for programmable purge/compute specialists; CloudFront for AWS-native estates; Akamai for large enterprise media. Many teams put Free Cloudflare in front of Vercel/Netlify/AWS origins rather than full migration.

Who should use it

• Any public website or API that wants DNS + TLS + CDN + DDoS without a scrubbing center—start Free; buy Pro when image/WAF/rules matter; Business when SLA/PCI/support matter.
• Edge and API teams optimizing global latency and serverless cost with Workers + R2 + KV/D1/Durable Objects (Hyperdrive to existing databases).
• Media and download-heavy products where object storage egress would dominate TCO—R2’s free egress is the product.
• IT/security teams replacing or augmenting VPN with Zero Trust Access/Gateway (start free ≤50 users).
• Agencies and freelancers managing many domains with consistent edge defaults and at-cost Registrar domains.
• Enterprises consolidating CDN, WAF, bot, and SASE under Contract SLAs and compliance packs.

Who should pause or dual-run: workloads that cannot accept edge TLS termination without careful design; always-on non-HTTP processes better on VMs/Kubernetes; teams that need multi-CDN active-active for outage resilience; pure lowest-cost always-on compute where a $5 VPS still wins; organizations standardized on AWS-only networking where CloudFront + WAF reduce architectural friction.

Alternatives

• AWS CloudFront + WAF + Lambda@Edge / S3 — Deepest AWS integration; typically higher egress and more knobs.
• Fastly — Real-time purge and Compute@Edge strengths for media/API specialists; less “free forever CDN for everyone.”
• Vercel — Best-in-class Next.js DX and previews; often pricier at bandwidth/function scale—many put Cloudflare in front.
• Netlify — Friendly Jamstack DX; different security/CDN depth than Cloudflare’s core network.
• Google Cloud CDN / Cloud Armor / Cloud Run — GCP-native path when already on Google.
• Supabase / Neon — Backend/database focus; complement Workers rather than replace CDN/WAF.
• Render / Railway — Simpler full-stack hosting; add Cloudflare when you need global edge security.
• Akamai — Enterprise media and custom edge at scale; heavier sales process.
• Self-host (Caddy/Nginx + Let’s Encrypt on Hetzner/DigitalOcean) — Full control; you own DDoS and global latency.

Verdict

Cloudflare is the default Internet front door for a huge share of the web in 2026: Free DNS/CDN/DDoS that is good enough for millions of properties; a paid application ladder (Pro $20 annual / $25 monthly, Business $200 annual / $250 monthly, Enterprise custom) that adds WAF depth, image tooling, PCI-oriented features, and SLAs; and a developer platform where Workers Paid at $5/month plus transparent request/CPU meters undercuts many hyperscaler edge stacks—especially with R2’s no-egress storage. Zero Trust at $0 (≤50 users) or $7/user makes SASE approachable without buying appliances.

Bottom line: Start Free for DNS/CDN/DDoS. Enable Workers Paid for real edge APIs. Buy Pro for WAF/image/control needs; Business for uptime SLA and compliance-oriented features; Enterprise for network prioritization, advanced bot packaging, and contract support. Instrument billing across application plans, Workers, R2, and Zero Trust; set Worker CPU limits; tune bot/WAF rules; keep an origin or multi-CDN escape hatch for rare platform incidents. Prefer Vercel/Netlify when framework DX is scarce; AWS/GCP when regional cloud is system of record; Fastly/Akamai for specialized edge or media RFPs. For most public sites and APIs, Cloudflare remains the rational first proxy—and often the only one needed.