Overview
Cloudflare works as a reverse proxy: you move your domain's nameservers to Cloudflare, mark records as proxied, and traffic then passes through its network of more than 330 locations. That gives you caching, TLS certificates, DDoS mitigation and firewall rules without changing your origin server.
The plan ladder is about features and guarantees, not traffic. Free already includes DNS, the CDN, universal SSL, unmetered DDoS protection and a free managed WAF ruleset. Pro ($20 a month on annual billing, $25 monthly) adds the full WAF and image optimisation, Business ($200 a month annual, $250 monthly) adds a 100% uptime SLA and PCI DSS 4.0 support, and Contract plans are negotiated.
Before you commit, note that Cloudflare's DNS generally requires using its nameservers for full-zone setup on self-serve plans, and proxied traffic means Cloudflare terminates TLS. Developer products such as Workers, R2 and D1 are priced separately on usage, and features like Load Balancing are add-ons.
Pricing and plans
checked 28 Sept 2026Free tier · no card
Free plan: DNS, CDN, universal SSL, unmetered DDoS protection and the free managed WAF ruleset, with no bandwidth charge; no SLA.
| Plan | Price | What you get |
|---|---|---|
| Free | $0 | DNS, CDN, universal SSL, unmetered DDoS, free managed ruleset |
| Pro | $20/mo annual, $25/mo monthly | Adds WAF, lossless image optimisation; no additional usage charges |
| Business | $200/mo annual, $250/mo monthly | 100% uptime SLA, PCI DSS 4.0 support |
| Contract (Enterprise) | Custom | Billed annually; 10x or 25x SLA credits, network prioritisation |
What it does
- Authoritative DNS
- Free DNS hosting on every plan with one-click DNSSEC and API access.
- CDN
- Caches static and dynamic content across 330+ locations; Cloudflare says it is within about 50 ms of ~95% of internet users.
- DDoS protection
- Unmetered DDoS mitigation is included on all plans, including Free.
- WAF
- A free managed ruleset on the Free plan; the full Web Application Firewall starts at Pro.
- Universal SSL
- Automatic edge TLS certificates for proxied hostnames on every plan.
- Edge compute
- Workers runs code at the edge with 100k free requests per day, then $0.30 per million requests.
Strengths and limitations
Strengths
- A free plan that includes DNS, CDN, SSL and DDoS protection with no bandwidth bill.
- Flat plan pricing makes costs predictable even when traffic spikes.
- One dashboard and API for DNS, caching, security rules and edge code.
- Large network of 330+ locations.
- Long list of stated certifications, including SOC 2, ISO 27001 and FedRAMP High.
Limitations
- No uptime SLA on Free or Pro; the 100% SLA starts at Business.
- PCI DSS 4.0 compliance support is listed only for Business and Contract plans.
- Load balancing, Workers, R2 and other products are billed on top of the plan.
- EU data localisation controls are an enterprise offering.
Who it suits
Good for
- Hobby and indie sites that want free DNS and CDN
- Startups needing DDoS protection and a WAF at a flat price
- Teams that want DNS, caching and edge code in one place
Look elsewhere if
- Teams that want a plain DNS host without a proxy in the traffic path
- Workloads that need an SLA on a budget below the Business plan
Alternatives to Cloudflare
| Tool | From | Free option | Stages |
|---|---|---|---|
| Amazon CloudFront CDN with bundled WAF and DNS plans | $15/mo | Free tier | |
| DNSimple DNS hosting and domain management | $0.5/mo | ||
| Gcore CDN Pay-as-you-go CDN with DNS and WAF | Usage-based | Free tier | |
| Amazon Route 53 Managed DNS and traffic routing | $0.5/mo | ||
| Azure DNS Managed public and private DNS | $0.5/mo | ||
| Bunny CDN Pay-as-you-go CDN with DNS and WAF | Usage-based |
Questions
Is Cloudflare's free plan really free for bandwidth?
Yes. The Free, Pro and Business plans are priced per plan, and the plans page lists no per-GB bandwidth charge for the CDN.
Does the Cloudflare free plan include a WAF?
It includes the free managed ruleset. The full WAF with managed rules starts at the Pro plan.
Which Cloudflare plan has an uptime SLA?
Business ($200/mo annual) has a 100% uptime SLA with 1x service credits; Contract plans offer 10x or 25x credits.
Can I use Cloudflare only for DNS?
Yes. Records can be set to DNS-only so traffic goes straight to your origin while Cloudflare answers DNS queries.
Sources read for this page