Our own use of Cloudflare is fairly basic — DNS and CDN for our domains — so this isn’t a stress-test of Workers at scale or a detailed audit of the WAF. What we can say firsthand: setup for DNS and CDN took minutes, not hours, and the free tier covers what a standard marketing site or blog needs before anyone would have a reason to look at a paid plan.
TL;DR
Cloudflare is a network platform that started as CDN and DDoS protection and has expanded into DNS, edge compute (Workers), object storage (R2), Zero Trust security, and more. The free tier includes real DNS, CDN, Universal SSL, DDoS protection, and a basic WAF — genuinely usable for a production site, not a crippled trial. Paid plans start at $20-25/month and add image optimization and uptime SLAs; developer products like Workers and R2 are priced separately on a pure usage basis. It’s a strong default for anyone who needs DNS plus CDN plus basic security without a procurement process, and a much bigger platform than most users ever touch — we use the free/basic tier for DNS and CDN and haven’t tested Workers, R2, or the enterprise compliance features ourselves.
Cloudflare at a glance
| What it is | DNS, CDN, security, and edge-compute platform |
| Category | Network infrastructure / CDN and security |
| Pricing model | Freemium website plans + separate usage-based pricing for developer products (Workers, R2, etc.) |
| Standout feature | A genuinely functional free tier — DNS, CDN, SSL, DDoS protection, and WAF at $0/month with no time limit |
| Free tier | DNS, CDN, Universal SSL, DDoS protection, WAF, role-based access |
| Our usage | DNS and CDN for our domains |
What Cloudflare does
Cloudflare was founded in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn, growing out of earlier anti-spam research (Project Honey Pot) into a company built around sitting between visitors and origin servers to filter traffic and speed up delivery. It went public in 2019 and by 2026 runs a network spanning more than 275 cities in over 100 countries, with roughly 5,000 employees. What started as CDN-plus-security has grown into a considerably broader platform, organized loosely into three areas: the core website/network products most users interact with, developer/edge-compute products for building on Cloudflare’s network directly, and Zero Trust products for enterprise network security.
DNS, CDN, and core security
The foundation is authoritative DNS and a content delivery network that caches and serves static assets from edge locations near the visitor, reducing load on the origin server and cutting latency. Bundled with that on every plan, including free, is Universal SSL (automatic HTTPS certificates), unmetered DDoS protection, and a managed Web Application Firewall ruleset that blocks common attack patterns without custom configuration.
Workers, Pages, and R2
Workers is Cloudflare’s serverless compute product — JavaScript, TypeScript, or WebAssembly code that runs at edge locations instead of a single origin region, useful for things like request routing, A/B testing logic, or lightweight APIs that need to run close to the user. Pages is Cloudflare’s static site and frontend hosting product, commonly paired with Workers for full-stack apps. R2 is S3-compatible object storage with a specific selling point: no egress fees, meaning you don’t pay to move data out of R2, which is a real cost difference versus AWS S3 for anything read-heavy. Alongside these sit newer products — D1 (serverless SQL database), KV (key-value store), Durable Objects, Queues, Vectorize (vector database), and Workers AI — all usage-priced and aimed at developers building entirely on Cloudflare’s edge network instead of a traditional cloud region.
Zero Trust and network security
Cloudflare One bundles Zero Trust Network Access, a secure web gateway, and device-posture checks into what Cloudflare calls a SASE (Secure Access Service Edge) platform — aimed at replacing traditional VPNs with per-request identity and device verification for employee access to internal apps. This product line has its own pricing structure, separate from the website plans, with a free tier for up to 50 users.
Analytics, caching controls, and page rules
Beyond the security and delivery basics, Cloudflare’s dashboard gives site owners visibility into traffic — request volume, cached-versus-uncached ratio, threats blocked, and bandwidth saved — without needing to instrument a separate analytics tool for infrastructure-level metrics. Caching behavior is configurable through Page Rules and Cache Rules, letting an admin set different cache lifetimes for different URL patterns (long cache for static assets, no cache for a login page or API endpoint), which matters for any site mixing static and dynamic content behind the same CDN.
Pricing
| Plan | Price/mo | Includes |
|---|---|---|
| Free | $0 | DNS, CDN, Universal SSL, DDoS protection, WAF, role-based access |
| Pro | $20 (annual) / $25 (monthly) | + image optimization, AMP support, enhanced support |
| Business | $200 (annual) / $250 (monthly) | + PCI DSS 4.0 compliance, 100% uptime SLA with service credits |
| Enterprise | Custom | + higher SLA credit multiples, network prioritization, dedicated support |
Outside the website plans, developer products bill separately by usage: Workers’ free tier covers 100,000 requests/day, with the $5/month paid plan including 10 million requests/month and no per-request bandwidth charge. R2 storage gives 10GB-month free, then $0.015/GB-month for storage plus per-operation charges ($4.50 per million write-type operations, $0.36 per million read-type operations) — and critically, no egress fee, which is the main reason developers pick R2 over S3 for anything that gets read frequently. Zero Trust products follow yet another schedule: free for up to 50 seats, then roughly $7/user/month pay-as-you-go above that. The practical effect is that “Cloudflare pricing” isn’t one number — what you pay depends on which of the three product lines (website plans, developer/edge products, Zero Trust) you’re actually using, and it’s entirely possible to run a real production site on the free website tier while paying only for incremental Workers or R2 usage.
Pros
The free tier is a real, ongoing product — not a 14-day trial. DNS, CDN, SSL, DDoS protection, and a managed WAF ruleset are available at $0/month indefinitely, which is unusual generosity for infrastructure that would cost real money elsewhere.
Unmetered DDoS protection at every tier. Cloudflare doesn’t cap or meter DDoS mitigation by plan — a volumetric attack against a free-tier site gets the same network-level absorption as an enterprise customer’s, which isn’t universal among CDN providers.
R2’s no-egress-fee model is a genuine cost advantage. For any workload that reads data frequently — serving images, video, or downloadable files — avoiding S3-style egress charges can be a meaningful line-item difference at scale.
One account covers DNS, CDN, security, and compute. Teams that would otherwise juggle a DNS provider, a separate CDN, and a separate WAF vendor can consolidate into a single dashboard and API.
Network reach is enormous. Presence in 275+ cities across 100+ countries means cached content and edge compute run physically close to most users worldwide, without the customer configuring regional deployment themselves.
Free managed rulesets get updated automatically. The WAF’s baseline attack-pattern rules are maintained by Cloudflare and applied without the customer needing to track new CVEs or attack signatures themselves, which is a meaningful maintenance reduction compared to running a self-managed WAF.
Cons
Pricing is fragmented across product lines. Website plans, developer/edge products, and Zero Trust each have separate pricing pages and billing logic — estimating a total monthly cost across all three takes more effort than reading one price list.
The jump from Pro to Business is steep. Business costs 10x Pro ($200 vs $20/month) for PCI compliance and an uptime SLA — a big gap for a business that needs just one of those two things and not the whole tier.
Advanced WAF rules and rate limiting are paywalled. The free managed ruleset covers common attacks, but custom WAF rules and more granular rate-limiting controls require a paid plan, so security customization has a real price floor.
The platform is large enough to be confusing. Between website plans, 10+ developer products, and a separate Zero Trust suite, new users evaluating “Cloudflare” often aren’t sure which parts of the platform they actually need — the surface area is a genuine onboarding cost.
How Cloudflare compares
Against Amazon CloudFront, the clearest differentiator is pricing model and ecosystem lock-in. CloudFront is billed purely on usage with no free tier equivalent to Cloudflare’s, and it makes the most sense if your origin infrastructure is already on AWS — cross-origin data transfer between S3/EC2 and CloudFront within the same region avoids extra charges that would apply moving data to a third-party CDN. Cloudflare’s advantage is the standing free tier and a platform that isn’t tied to a single cloud provider, which matters for teams that don’t want their CDN vendor and cloud vendor to be the same company.
Against Fastly, the difference is audience and depth versus breadth. Fastly is built for developer-first teams that want deep programmable control at the edge and consistently reports very low cached-content latency (sub-25ms P99 in its core network), which appeals to media platforms and API-heavy products where every millisecond is visible to users. Cloudflare’s edge compute (Workers) covers similar ground but as part of a much broader platform that also includes DNS, security, and Zero Trust — Fastly is more focused, Cloudflare is more of a one-stop network layer.
Who it’s for
Small sites and side projects. The free tier alone — DNS, CDN, SSL, DDoS protection, basic WAF — covers what a blog, portfolio, or early-stage product needs, with no time limit forcing an upgrade.
Teams that want DNS, CDN, and security under one vendor. Consolidating what would otherwise be three separate vendor relationships into one dashboard and API is a real operational simplification, even before touching the developer products.
Developers building edge-native applications. Workers, R2, D1, and the rest of the developer product line suit teams that specifically want compute running close to users worldwide rather than in a single cloud region.
Not the first choice for AWS-native shops. If your origin infrastructure is entirely on AWS already, CloudFront’s same-region transfer pricing and native integration with S3/EC2 may end up simpler and cheaper than adding a third-party CDN layer.
Frequently asked questions
Is Cloudflare’s free tier actually usable, or just a trial?
It’s a real, ongoing free tier with no time limit — DNS, CDN, Universal SSL, and basic DDoS/WAF protection are included indefinitely, based on our own ongoing usage and Cloudflare’s published plan comparison.
What do you get by upgrading to Cloudflare Pro?
Image optimization, AMP support, and enhanced support, on top of everything in the free tier, per Cloudflare’s published plan comparison — features we haven’t personally tested since our own usage stays on the free/basic tier.
How much do Cloudflare Workers cost?
The free tier covers 100,000 requests per day. The paid plan is $5/month and includes 10 million requests per month with no separate bandwidth charge, then usage-based pricing beyond that allotment.
Is Cloudflare R2 cheaper than AWS S3?
For storage alone, R2’s $0.015/GB-month is close to S3’s standard rate, but R2 charges no egress fee at all, while S3 charges for data transferred out. For read-heavy workloads, that egress difference is the main reason teams choose R2 over S3.
Does Cloudflare protect against DDoS attacks on the free plan?
Yes — Cloudflare provides unmetered DDoS protection at every plan tier, including free, rather than gating volumetric attack mitigation behind a paid plan.
What’s the difference between Cloudflare Pages and Workers?
Pages is built for hosting static sites and frontend frameworks, with automatic builds from a Git repository. Workers is serverless compute for running custom code at the edge. They’re commonly used together — Pages for the frontend, Workers for API routes or middleware logic.
Does Cloudflare replace a traditional VPN?
That’s the pitch behind Cloudflare One / Zero Trust: it replaces network-level VPN access with per-request identity and device verification for reaching internal applications. It’s a separate product line from the CDN/DNS plans, with its own free tier for up to 50 users.
Is Cloudflare good for a WordPress site?
Yes, and it’s a common pairing — Cloudflare’s free CDN and caching sit in front of WordPress to reduce origin server load and speed up page delivery, though cache configuration needs some attention since aggressive caching can serve stale content on a frequently updated site.
How does Cloudflare pricing compare to AWS CloudFront?
Cloudflare has a genuine free tier with unlimited bandwidth on qualifying plans; CloudFront is pure pay-as-you-go with no equivalent free allotment at scale. CloudFront tends to work out cheaper if your origin is already inside AWS, due to same-region transfer pricing.
What is Cloudflare’s uptime SLA?
Free and Pro plans don’t carry a formal uptime SLA. The Business plan adds a 100% uptime SLA with service credits if it’s missed, and Enterprise plans add higher credit multiples on top of that.
Who founded Cloudflare and how big is the company today?
Cloudflare was founded in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn, went public in 2019, and by 2026 runs a network across more than 275 cities in over 100 countries with roughly 5,000 employees — a scale relevant to evaluating how much capacity sits behind the free tier’s DDoS protection claims.
Can I use Cloudflare with a site hosted anywhere, or only specific hosts?
Cloudflare works with essentially any hosting provider — you point your domain’s nameservers at Cloudflare, and it proxies traffic to whatever origin server you’re already using, whether that’s shared hosting, a VPS, or a major cloud provider. It’s not tied to a specific host.
Verdict
Cloudflare is close to a default-yes for DNS and CDN: the free tier is genuinely production-capable, setup is fast, and unmetered DDoS protection at every tier is hard to match. Where it gets more situational is the rest of the platform — Workers, R2, and Zero Trust are real products with real usage-based pricing, but evaluating them means treating Cloudflare less like a single plan and more like a portfolio of separately priced services. For a standard site needing DNS, CDN, and basic security, it’s an easy recommendation; for teams considering the deeper edge-compute or Zero Trust products, budget time to understand each product’s separate pricing before assuming “Cloudflare” is one line item.
See Cloudflare’s full profile, pricing, and verified reviews on Spotsaas, listed under Content Delivery Network (CDN) Software alongside its competitors.
Sources
- Cloudflare — Plans (checked July 2026)
- Cloudflare Workers — Pricing
- Cloudflare — Our Story
Pricing verified July 2026 via Cloudflare’s published plans page and developer documentation, cross-checked against third-party comparison coverage. Features and prices change; this reflects the product as of July 2026. Written by the Spotsaas team, based on our own DNS/CDN usage.
