Cloudflare Review (Verified August 2026)

Cloudflare is worth using for most public websites because $0 buys authoritative DNS, CDN, TLS, baseline WAF, and unmetered DDoS protection. The recommendation gets conditional when one domain becomes five, Workers becomes part of the stack, or an outage needs a human: Pro is $20 per domain with annual billing, Workers Paid is a separate $5 account plan, and emergency phone support is Enterprise-only. Pricing and product details were verified against Cloudflare's live pages on 7 August 2026.

What Cloudflare actually is

Cloudflare is a network layer that sits between a visitor and a website or application origin. It can answer authoritative DNS, terminate TLS, cache content, inspect requests, block attacks, and route accepted traffic to the origin. The same account also sells a developer platform: Workers runs code at the edge, R2 stores objects, and Workflows coordinates durable tasks. That breadth is the reason to buy it and the reason to evaluate it carefully. Cloudflare is not one interchangeable CDN subscription. It is a per-domain application plan, a separately billed compute and storage platform, and an operating model in which one vendor can control DNS, traffic policy, security, and code execution.

Who Cloudflare is for, and who should skip it

Cloudflare is the strongest default for a public website or API that needs competent DNS, caching, TLS, DDoS protection, and request policy without assembling several vendors. It is less convincing when the job is only cheap bandwidth, the application already lives entirely inside AWS, or the team refuses to move authoritative DNS.

Prices in this table were checked on each vendor's live pricing page on 7 August 2026. The shortlist turns on four criteria: how many operating layers one vendor should own, whether authoritative DNS can move, how predictable the bill must be, and whether the workload needs edge code or only content delivery.

Pick Cloudflare when reducing handoffs matters

Cloudflare fits a small SaaS company with a marketing site, dashboard, API, and login flow. The same request can pass through authoritative DNS, TLS termination, cache rules, managed WAF rules, and a Worker before the origin sees it. A founder gets one place to change those controls. An operator gets one request path to reason about. An engineer can add code without provisioning another regional service.

The fit is especially good when the origin should become boring. Put static assets in cache, reject obvious attacks at the edge, validate lightweight requests in a Worker, and let the application server spend its capacity on authenticated work. This is not a promise that switching Cloudflare on makes a slow database fast. It means fewer requests need to reach that database in the first place.

Pick CloudFront when the system is already AWS-native

Amazon CloudFront is the cleaner alternative when S3, Route 53, AWS WAF, CloudWatch Logs, and Lambda-style edge compute are already approved parts of the architecture. Its current flat-rate plans bundle CDN, WAF, DDoS protection, DNS, TLS, logging, serverless edge compute, and monthly S3 storage credits. The Free plan is $0, followed by Pro at $15, Business at $200, Premium at $1,000, and Custom pricing, all with no overage charge inside each plan's allowance.

That bundle removes some of the invoice arithmetic that used to make CloudFront difficult to compare. It does not remove AWS architecture. Choose it when using AWS services is an advantage, not when the team is trying to reduce its dependence on them.

Pick Fastly when delivery control is the product

Fastly is the shortlist option for a team that wants a delivery-first platform and accepts regional usage pricing. Its current free allowance includes 100 GB and 1 million requests. At the first paid band, delivery in North America and Europe is $0.12 per GB, while requests from 1 million to 100 million cost $0.01 per 10,000.

That model is easier to attribute to delivered traffic than a broad collection of per-domain plans and add-ons. It can also be materially more expensive than Cloudflare Free for a normal company site. The decision flips toward Fastly when the delivery layer deserves its own engineering ownership and away from it when the buyer wants DNS, security, compute, and storage to arrive together.

Pick bunny.net when simple bandwidth economics win

bunny.net is the practical skip for downloads, images, or a content-heavy site whose main requirement is an understandable CDN bill. Standard Network delivery costs $0.01 per GB in Europe and North America, with a $1 monthly minimum. That is a clean proposition for a 200 GB monthly asset workload: the delivery line starts near $2 before any other purchased services.

The trade is scope. A low CDN price does not reproduce Cloudflare's application plan, WAF operating model, Workers runtime, R2, and DNS controls. Pick bunny.net when that narrower boundary is exactly what you want.

If the desired product is an AI builder that creates and hosts the application rather than edge infrastructure around code, Replit is the more relevant purchase. Cloudflare expects the buyer to understand the request path and production architecture.

DNS and CDN make the best first Cloudflare workflow

Cloudflare delivers its clearest value when DNS, proxying, caching, and origin protection are treated as one migration instead of a collection of toggles. Its CDN says it caches static and dynamic content across data centers in 335+ cities, while Authoritative DNS is free and controlled through an API.

The right workflow starts with the records, not the orange proxy switch:

1. 1

   Inventory DNS before changing authority

   List the current A, AAAA, CNAME, MX, TXT, and verification records. Cloudflare's quick scan is useful but its own setup guide says the scan is not guaranteed to find everything. Missing a mail, verification, or DKIM record can break a service that has nothing to do with the website.

2. 2

   Move nameservers with DNSSEC handled deliberately

   Free and Pro use the primary, or full, setup. That requires replacing the domain's authoritative nameservers with the two assigned by Cloudflare. If DNSSEC is active, disable it at the registrar before the change and re-enable it through Cloudflare after the zone is active. Changing nameservers with the old DNSSEC chain still active can make the domain unreachable.

3. 3

   Proxy web traffic, leave mail records DNS-only

   Proxy the web-facing A, AAAA, and eligible CNAME records that should receive CDN and security treatment. Keep MX records and the related mail records DNS-only. The useful boundary is simple: Cloudflare should proxy HTTP/S traffic it can inspect, while third-party verification and mail routing should continue to resolve directly.

4. 4

   Cache the safe content and verify the origin

   Start with versioned static assets, then add rules only where the application has a clear freshness policy. Check the rendered page, authenticated paths, API responses, and origin logs. Finally, restrict direct origin access where the hosting setup permits it, because an exposed origin IP lets attackers bypass the edge controls you just configured.

The full-setup requirement is a product boundary, not a setup footnote. Free and Pro cannot keep another authoritative DNS provider. Partial CNAME setup, which proxies selected hostnames while keeping external authoritative DNS, is available only on Business and Enterprise. Even then, Cloudflare documents that DNS-infrastructure DDoS protection is unavailable because the domain is not using its nameservers.

That creates a clean decision. Use Free or Pro when Cloudflare can own authoritative DNS. Pay for Business or Enterprise when partial onboarding is mandatory and its remaining trade-offs are acceptable. Skip Cloudflare when independent authoritative DNS is a hard requirement and the business will not fund the higher tier.

WAF and DDoS protection work when the policy is narrow

Cloudflare WAF is valuable because it inspects HTTP/S requests before they reach the application and can apply both managed and custom rules. The security workflow fails when a team enables every aggressive control, sees legitimate users blocked, and concludes that edge security is unreliable.

Use a SaaS login as the worked case. Enable the managed ruleset as the baseline, then add a narrow custom rule for the actual abuse pattern: an unexpected method, a known hostile path, or repeated automation against the login route. Add Turnstile only where the application needs visitor verification. Turnstile is free, and Cloudflare says it does not harvest data for ad retargeting.

The rule order matters. A managed rule catches common web and API exploits such as SQL injection and cross-site scripting. A custom rule expresses something specific to the application. Turnstile distinguishes likely humans from automated traffic at a chosen interaction. None of those controls replaces server-side authorization. The application must still decide whether the authenticated user can read or modify the requested record.

For a small ecommerce site, begin in observe mode where the feature permits it and read the event data before blocking. Exclude a payment-provider callback only after verifying its authentication method. Do not create a blanket allow rule for a wide path because one integration broke. A narrow exception preserves the rest of the control.

Cloudflare's current DDoS page cites 500 Tbps of network capacity. That is meaningful evidence that the network can absorb attacks far beyond one origin's capacity, but it is not a guarantee that every application-layer rule is correct or every lower-tier support request will be immediate.

The origin remains the buyer's responsibility. If an attacker knows the origin address and can reach it directly, traffic can route around the WAF. If an API trusts a header merely because Cloudflare normally inserts it, a direct request may forge it. Restrict origin ingress, validate identity inside the application, and keep a recovery path that does not depend on remembering a dashboard setting during an incident.

Workers turns edge policy into application code

Cloudflare Workers is the capability that changes the purchase from "CDN with security" to an application platform. It runs serverless functions across 330+ cities, charges CPU time rather than time waiting on I/O, and supports gradual percentage rollouts and rollback.

A useful production workflow is webhook intake. The Worker receives the request, validates its signature, rejects malformed input, stores the original payload in R2, and starts a Workflow. The Workflow performs a bounded transformation, retries a failed downstream call, waits for an approval event when needed, and then records the final state. Cloudflare Workflows persists state for minutes, hours, or weeks and can wait for external events without an always-on process.

That architecture separates fast acceptance from slow business work. The sender gets a prompt response. The durable process owns retries. The raw payload remains available for audit or replay. A local-services company could use it for lead intake, a SaaS company for billing events, or an agency for approval-driven publishing.

Workers still has a wall. Both Free and Paid have 128 MB of memory. Free permits 100,000 requests per day, 10 ms CPU per invocation, 50 subrequests per invocation, and a 3 MB Worker. Paid raises the subrequest allowance to 10,000 and Worker size to 10 MB, while HTTP CPU can be configured up to 5 minutes from a 30-second default. This is a strong request and orchestration runtime, not a substitute for a large-memory data job or an arbitrary long-running server.

The billing model is unusually legible once the separate plan is acknowledged. Workers Paid costs at least $5 per account each month, includes 10 million requests and 30 million CPU milliseconds, then charges $0.30 per additional million requests and $0.02 per additional million CPU milliseconds. There is no extra egress or throughput charge for Workers.

Assume one Worker handles 30 million dynamic requests in a month at 5 ms CPU each. The base is $5. Request overage is $6 for the 20 million requests above the allowance. CPU overage is $2.40 for 120 million CPU milliseconds above the allowance. The result is $13.40 per month, or about $0.45 per million requests. That is an excellent price for lightweight routing or validation, provided 128 MB and the runtime model fit the job.

Cloudflare's 3 August 2026 production note also shows that Workers AI is more than a thin model catalog. Cloudflare reports that an FP8 cache increased resident Kimi K2.6 context from roughly 686,000 to about 1.37 million tokens. At 64 concurrent requests it reached 2,192 tokens per second, about 41% above the BF16 peak, at roughly 30% lower cost per token. For GLM 5.2, INT4 compression reduced model weights from 705 GB to 421 GB, about 40%, while Cloudflare reports accuracy stayed within 0.8 points across its evaluation suite.

Those are Cloudflare's measurements of its hosted inference system, not a benchmark for a normal Worker and not proof that every AI model will have the same latency. They do demonstrate investment below the API surface. A builder considering agents on Workers can pair that infrastructure context with the production-agent cost breakdown already published for Cloudflare.

R2 is compelling storage, with an operations bill

Cloudflare R2 is the best adjacent product when object-storage egress is the cost problem. It is S3-compatible, strongly consistent, accessible through a Workers binding, an S3-compatible API, and a REST API, and it does not charge Internet egress.

Use a customer-upload workflow. The browser sends an upload through a controlled application path, the object lands in a regional R2 bucket, metadata is committed before a successful response is returned, and a custom domain serves approved objects. Cloudflare Cache can sit in front of that custom domain for faster reads. Keep private uploads private, issue access only through the application, and separate original files from processed public assets.

Standard storage costs $0.015 per GB-month. The monthly free tier includes 10 GB-month, 1 million Class A operations, and 10 million Class B operations. Beyond that, Class A operations cost $4.50 per million and Class B operations cost $0.36 per million. Internet egress is free.

At 1 TiB, or 1,024 GB, the storage line is $15.21 per month before billable operations: subtract the 10 GB free tier and multiply 1,014 GB by $0.015. If reads and writes remain inside the free operation allowances, that is the storage bill. A workload serving 10 million objects per day does not remain inside them, which is why free egress must never be translated into free delivery.

Infrequent Access is cheaper to hold at $0.01 per GB-month but more expensive to touch: $9 per million Class A operations, $0.90 per million Class B operations, and $0.01 per GB retrieved, with a 30-day minimum storage duration. Use it for genuinely cold objects, not as a reflexive discount on frequently read assets.

Cloudflare pricing, every tier and the bill behind it

Cloudflare pricing is attractive at the first domain and can become a serious infrastructure line when domains, add-ons, compute, and storage accumulate. The application tiers below were verified against the live Cloudflare plans page on 7 August 2026.

Free is the correct starting plan more often than Pro

Free includes the core reason most small sites adopt Cloudflare: fast DNS, CDN, Universal SSL, unmetered DDoS protection, WAF access, and the Free Managed Ruleset. Start here when the site is not contractually critical. Measure what is missing before upgrading.

Free is not a support plan. The published support matrix recommends Community and Discord and does not include support cases. It also has no uptime SLA. That is acceptable for a portfolio, early product, or secondary site. It is a poor operating model for a storefront whose owner expects a human response during an outage.

Pro buys a feature set, not business continuity

Pro costs $20 per month when billed annually or $25 month to month, per domain. Its label says professional websites that are not business-critical, and the absence of an uptime SLA matches that description.

Do not buy Pro expecting Argo Smart Routing to be included. Cloudflare currently lists Smart Shield + Argo as an add-on starting at $5 per month. Load Balancing also starts at $5, Advanced Certificate Manager at $10, and Log Explorer costs $1 per GB ingested after the first 10 GB. Upgrade because a specific Pro entitlement solves a measured problem, then price the required add-ons separately.

Business is a tenfold jump for a different risk class

Business costs $200 per month billed annually or $250 monthly, per domain. It adds a published 100% uptime SLA with a 1x service credit and raises the request-body limit from 100 MB to 200 MB. It also opens partial CNAME setup, which matters when authoritative DNS cannot move.

The price multiplication is the catch. Five Pro domains cost $1,200 per year at the annual-billing rate. Five Business domains cost $12,000 per year. Subdomains do not add another plan charge, so consolidate properties under a domain when the architecture and security boundary make sense. Do not distort the domain model solely to avoid a legitimate isolation requirement.

Contract buys support and control that lower tiers cannot imitate

Contract pricing is custom and billed annually. Cloudflare positions it for mission-critical applications. The published uptime service credit is 10x with Standard Success and 25x with Premium Success, and emergency phone support is limited to Enterprise customers. Premium Enterprise initial-response SLAs are 1 hour for P1 and 2 hours for P2; Standard Enterprise lists 2 hours and 4 hours respectively.

If emergency phone access, a contractual response target, a 500 MB default request body, or enterprise onboarding is mandatory, there is no honest Pro workaround. Put those requirements into procurement before negotiating price.

The application plan is only the first invoice layer

Add the separately billed services the architecture uses:

• Workers Paid starts at $5 per account per month, then meters requests and CPU beyond its allowance.
• R2 meters storage and operations, while Internet egress remains free.
• Smart Shield + Argo and Load Balancing each start at $5 per month.
• Advanced Certificate Manager starts at $10 per month.
• Log Explorer charges $1 per GB ingested after the first 10 GB.

The limitations that decide the purchase

Cloudflare's limitations are structural: authoritative DNS, per-domain plans, separate product meters, a lower-tier support ceiling, and edge-runtime limits. They matter more than whether the dashboard feels busy.

1. Free and Pro require authoritative DNS

Free and Pro only support the primary, full DNS setup. The domain must use Cloudflare's authoritative nameservers. A team that needs to preserve another authoritative provider cannot solve that with a Free or Pro checkbox.

Business and Enterprise support partial CNAME setup, but the compromise has a second edge: Cloudflare states that DNS-infrastructure DDoS protection is unavailable on partial setup. Keeping external authority preserves one form of control while giving up a protection that depends on Cloudflare answering DNS.

2. Paid application pricing multiplies per domain

Cloudflare bills application plans per domain, not per account. Multiple subdomains under one paid domain do not add separate charges, but five separate paid domains do create five subscriptions. That turns an innocent portfolio of brand, app, docs, status, and campaign domains into a procurement decision.

The $1,200 annual cost for five Pro domains can be sensible. The $12,000 annual cost for five Business domains demands a clear reason for each upgrade. A broad "we use Cloudflare" policy is not enough.

3. The developer platform is a second billing system

Workers Paid is separate from the application plans. R2 has its own storage and operation meters. Workflows adds step and state concepts. Images, Stream, logs, certificates, routing, and load balancing each have their own dimensions.

This modularity is useful because a team can buy only what it uses. It also means the top-level plan price is not a forecast. Assign every product an owner, budget alert, and deletion path before a prototype quietly becomes production.

4. Lower-tier support does not match the network's importance

Free customers have Community and Discord but no support-case entitlement in the current matrix. Pro and Business can open cases, yet Cloudflare's published contractual initial-response SLAs on the support page are for Enterprise and Premium Enterprise. Emergency phone support is Enterprise-only.

That asymmetry is the hardest limitation for a small revenue-bearing site. Cloudflare may sit in front of every request while the buyer has no phone escalation path. If an hour of outage costs more than the Business-to-Enterprise price difference, support belongs in the architecture decision, not the post-incident complaint.

5. Workers is not a large-memory general compute service

Workers has 128 MB memory on Free and Paid. Free has 10 ms CPU per invocation, and Paid uses a 30-second default with a configurable 5-minute HTTP maximum. Request bodies top out at 100 MB on Free and Pro, 200 MB on Business, and 500 MB by default on Enterprise. Cached objects top out at 512 MB below Enterprise and 5 GB on Enterprise.

Use Workers for request handling, policy, lightweight APIs, orchestration, and edge transformations. Move large in-memory processing, specialized binaries, and heavyweight batch jobs to a compute environment built for them. The fact that Workflows can wait for weeks does not give each step unlimited memory.

6. One control plane creates one large failure domain

Putting DNS, CDN, WAF, access policy, code, storage, and logs in one vendor reduces handoffs. It also means a bad account change, an overbroad rule, or a platform incident can affect several layers at once. Convenience and blast radius grow together.

Keep infrastructure configuration in version control where the product supports it. Separate account roles. Export the evidence needed for incident review. Maintain an origin recovery procedure. The goal is not to pretend Cloudflare will never fail. It is to make one failure understandable and reversible.

Cloudflare verdict and decision rule

Cloudflare earns the recommendation for most public websites, APIs, and lightweight edge applications. Free is unusually capable. The integrated path from DNS to cache to WAF to Worker removes enough operational glue to justify placing Cloudflare in front of a new site by default.

The paid verdict is narrower. Pro is worth it only when a named Pro feature produces more than $20 per domain per month in value at annual billing. Business is worth it when its feature set, 100% uptime SLA, 200 MB request bodies, or partial CNAME setup protects more value than the $200 per-domain annual-billing price. Contract is the correct tier when emergency phone support, response SLAs, enterprise controls, or a mission-critical agreement are requirements rather than preferences.

Use this decision rule: choose Cloudflare when all four statements are true: authoritative DNS can move or the budget covers a partial setup; the workload fits the 128 MB edge-runtime model; the full per-domain plus Workers plus storage plus add-on bill is acceptable; and the support channel matches the cost of downtime.

If the first statement is false, choose CloudFront inside AWS or another CDN that preserves the required DNS model. If only cheap delivery is needed, choose bunny.net. If a delivery team wants a separately owned, region-priced edge layer, shortlist Fastly. If the product needs large-memory compute or long-running processes, keep that compute elsewhere and use Cloudflare only where its edge strengths apply.

The blunt call is simple: start with Cloudflare Free, not Pro. Upgrade a domain only for a named entitlement. Add Workers only after pricing it as a separate platform. Skip Cloudflare entirely when DNS independence or lower-tier human escalation is non-negotiable.

Cloudflare FAQ

Is Cloudflare actually good?

Cloudflare is good for public sites and APIs that benefit from one layer for authoritative DNS, CDN, TLS, managed WAF, DDoS protection, and optional edge code. It is a weaker fit when another provider must remain authoritative for DNS, the workload needs more than 128 MB in Workers, or the business needs emergency phone support below Enterprise.

What is the downside of Cloudflare?

The main downsides are mandatory authoritative DNS on Free and Pro, paid application plans charged per domain, a separate $5 minimum Workers plan, separately metered storage and add-ons, and limited lower-tier escalation. Cloudflare also becomes a shared failure domain when it owns DNS, security, traffic policy, and compute.

Is Cloudflare really free?

Yes. The Free Application Services plan costs $0 and includes core DNS, CDN, Universal SSL, unmetered DDoS protection, WAF access, and a free managed ruleset. Workers Paid, R2 usage beyond its free tier, and add-ons such as Argo are separate purchases.

Who is Cloudflare's biggest competitor?

There is no single competitor for every Cloudflare product. Amazon CloudFront is the relevant alternative for an AWS-native stack, Fastly for a separately managed delivery platform, and bunny.net for simple low-cost content delivery. The best alternative depends on which part of Cloudflare you intend to replace.

Is Cloudflare worth it for a small business?

Cloudflare Free is worth trying for most small-business sites. Pay for Pro only when a specific feature justifies $20 per domain per month with annual billing. Choose Business only when its 100% uptime SLA, higher limits, or partial CNAME setup is worth $200 per domain per month annually.

How much does Cloudflare Workers cost?

Workers Free includes 100,000 requests per day and 10 ms CPU per invocation. Workers Paid is a separate plan starting at $5 per account per month, with 10 million requests and 30 million CPU milliseconds included, then $0.30 per additional million requests and $0.02 per additional million CPU milliseconds.

Does Cloudflare R2 charge egress fees?

R2 does not charge for Internet egress. Standard storage costs $0.015 per GB-month beyond the 10 GB-month free tier, and operations cost extra beyond 1 million Class A and 10 million Class B operations per month. Free egress removes one charge, not the entire storage bill.

Can Cloudflare keep my current DNS provider?

Not on Free or Pro, which require Cloudflare's primary full setup and authoritative nameservers. Business and Enterprise can use partial CNAME setup for selected hostnames, but Cloudflare documents that DNS-infrastructure DDoS protection is unavailable on that setup.