Cloudflare

What Cloudflare actually is

Cloudflare runs one of the largest networks on the public internet, and its CDN is the front door most customers meet the company through. You move your domain's nameservers to Cloudflare, and from that point every request for your site is intercepted at one of Cloudflare's 330-plus data centers, where cached static assets are answered from the location nearest the visitor and everything else is proxied back to your origin. In our view the honest description is not "a caching layer" but "a front door": caching, TLS termination, DDoS absorption, a managed firewall ruleset, image optimization and DNS all sit in the same request path, configured from one dashboard and one API.

That consolidation is the product's real argument. A small team that would otherwise run a CDN, a WAF, a DNS host and a certificate manager as four separate vendor relationships gets one bill and one control plane. Universal SSL is issued and renewed automatically for free, HTTP/3 and IPv6 compatibility are on by default, and the Terraform provider means the whole configuration lives in version control. For the audience reading ServerSpotter — people comparing infrastructure options and trying to avoid paying enterprise prices for a personal project or a small production site — the free tier is not a trial. It is a usable, unmetered CDN that most sites will never need to leave.

What it is not: a compute platform or a host. Cloudflare sells those separately (Workers, Pages, R2), and we review them on their own pages. This review covers the CDN and application services bundle: caching, performance, and the security stack that rides along with it. If you want a comparison against other delivery networks, our /benchmarks series covers infrastructure we have tested hands-on; we have not yet run our own CDN latency measurements, so we will not claim any here.

Pricing: what you really pay

The published application plans are Free at $0, Pro at $20 per month billed annually ($240 per year) or $25 billed monthly, Business at $200 per month billed annually ($2,400 per year) or $250 billed monthly, and Enterprise on a custom annual contract. That is the whole price list for the CDN itself. There is no bandwidth metering on these plans and no per-request charge: a site serving 50 TB a month pays the same flat fee as one serving 5 GB. In our view that flat structure is the single strongest commercial argument for Cloudflare against metered delivery networks, where egress is exactly where the invoice grows.

Billing is per domain, not per account. Ten domains on Pro means ten subscriptions; subdomains are free. That is the pricing trap to model before you commit — portfolio owners sometimes discover it late. The other trap is the shape of the tiers rather than their price. Free carries the managed ruleset, unmetered DDoS protection and Universal SSL; Pro adds image optimization and a higher tier of WAF features; Business adds PCI DSS 4.0 compliance support and the first uptime SLA. Enterprise is where contract negotiation, dedicated support and network prioritization live.

What changes between the tiers matters more than the headline numbers. Lossless image optimization is not on the free plan. The free managed ruleset is genuinely present on every plan — we checked the plan comparison directly — but the finer WAF tuning, rate limiting granularity and attack-score-based rules step up with the plan. Support is ticket-based for paid plans and community-forum-based for free ones. There is no paid support add-on for the free tier, which we think is reasonable at this price.

Our practical rule: if your site earns money, at minimum you should know what the Business plan's 100 percent uptime guarantee actually buys. It comes with service credits at 1x the monthly fee for proportional disruption; the Enterprise standard offering is 10x, and premium success is 25x. Free and Pro have no SLA at all. If an outage of your marketing site costs you less than $200 a month in revenue, paying for Business is probably not rational. If it costs more, the SLA math may work.

Performance & infrastructure

Cloudflare's network spans 330-plus cities across more than 120 countries, which puts cached content within a short round trip of most of the world's internet population. The company's own reporting is consistent on that count, and the network map is public, so you can check whether there is a facility near your audience before you sign up. Anycast routing means every visitor hits the same anycast address and is directed to a nearby facility automatically; there is no region selection to configure and no "multi-region" surcharge.

On top of the baseline, Cloudflare sells tuning add-ons: Argo Smart Routing for better origin-to-visitor paths, Tiered Cache for reducing origin fetches, and Polish and Mirage for image work on the higher plans. We would treat these as opt-in only after you have measured a real problem. The default configuration — caching static assets, proxying the rest — already handles most brochure sites, SaaS marketing pages and content sites without any add-on spend.

Reliability deserves a sober sentence. The scale that makes Cloudflare fast also makes it a concentration risk: when Cloudflare has a network-level incident, every site behind it is affected at once, and your origin being healthy does not help. Their status page is public and their incident write-ups are detailed by industry standards, which is more transparency than most infrastructure vendors offer. Still, "we proxy everything through one vendor" is a decision to own consciously. We typically recommend keeping a documented break-glass path — a way to swap nameservers to your DNS host's records and go direct-to-origin — even if you never use it.

Where it falls short

The free and Pro tiers carry no contractual uptime commitment, so the "four nines" reputation is an operational track record, not something you can bill against. The managed ruleset on lower plans is coarser than what security teams may want; serious WAF tuning means Business or Enterprise. Rate limiting exists but the more advanced variants are plan-gated. If you are choosing a WAF specifically, our /category/firewall-ddos page covers the dedicated comparison.

Per-domain billing penalizes portfolios. A domain registrar with fifty active sites will pay more with Cloudflare than with a bandwidth-metered provider that prices per account, even at high per-GB rates. Model both shapes against your actual traffic.

There is also the configurability tax. The dashboard exposes a large surface — page rules, cache rules, workers, transforms, zero trust — and getting the caching behavior right for a dynamic application requires understanding which paths are cached and for how long. The defaults are safe; the mistakes are silent. And because Cloudflare is a proxy, debugging origin problems means debugging two layers.

Finally: the CDN review on our database mentions R2's egress story, and it is worth separating the claims. Cloudflare's CDN plans are unmetered, full stop. R2's zero-egress promise applies to object storage traffic. Do not conflate the two when modeling costs.

Who should pick this

Our pick for /category/cdn-providers for nearly everyone running websites rather than exotic delivery workloads. The combination of a usable free tier, unmetered bandwidth, free TLS, and security defaults that would cost real money elsewhere is hard to argue with. Hobby projects should start and likely stay on Free. Small production sites should look at Pro for the image optimization and WAF upgrades, and at Business only when the SLA or compliance needs justify it. Enterprises negotiating with Cloudflare should push on support terms rather than price — the list price is already low; the contract terms are where the value sits.

If you need object storage with predictable delivery costs, read our Cloudflare R2 review next. If you want to serve a static site straight from Git, Pages is the better entry point than configuring the CDN by hand. And if you are comparing against metered CDNs for a genuinely bandwidth-heavy workload — large downloads, video, software distribution — get the metered quote anyway. Flat-rate pricing stops being an advantage exactly where your traffic becomes someone else's loss leader.

Key takeaways

• Unmetered bandwidth on every plan, including a free tier that is a real product rather than a trial.
• Pro is $20 per month billed annually ($240 per year), Business $200 billed annually ($2,400 per year) or $250 monthly; Enterprise is custom.
• 330-plus data centers in 120-plus countries, with free Universal SSL, IPv6 and HTTP/3 by default.
• No uptime SLA below the Business plan; Business carries 100 percent with 1x credits, Enterprise 10x or 25x.
• Billing is per domain, which adds up fast for portfolios; bandwidth metering never does.
• The proxy architecture is a concentration risk — keep a break-glass path to origin documented.

Sources

• https://www.cloudflare.com/plans/
• https://www.cloudflare.com/plans/faq/
• https://www.cloudflare.com/network/
• https://www.cloudflare.com/our-story/
• https://www.cloudflare.com/about/
• https://www.cloudflare.com/resource/2026-cloudflare-security-signals-report/
• https://www.cloudflare.com/small-business/