A detailed breakdown of what each Cloudflare plan includes — covering CDN, DNS, SSL, WAF, performance, network, rules, observability, and support — with exact technical limits sourced from official Cloudflare documentation.
Content delivery, caching behavior, and edge configuration limits
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Max Upload Size | 100 MB | 100 MB | 200 MB | 500 MB+ (configurable) |
| Cacheable File Size | 512 MB | 512 MB | 512 MB | 5 GB+ (configurable) |
| Cache Rules | 10 | 25 | 50 | 300 |
| Page Rules | 3 | 20 | 50 | 125 |
| Configuration Rules | 10 | 25 | 50 | 300 |
| Origin Cache Control | Default on | Default on | Default on | Configurable |
| Custom Cache Keys | ✗ | ✗ | ✗ | ✓ |
| Proxy Read Timeout | 120s (fixed) | 120s (fixed) | 120s (fixed) | Configurable (up to 600s) |
| Tiered Cache | Basic | Smart | Smart | Smart + Custom Topology |
| Cache Reserve (R2-backed) | Add-on | Add-on | Add-on | Add-on |
Authoritative DNS, records, security, and advanced features
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Authoritative DNS | ✓ | ✓ | ✓ | ✓ |
| DNS Records per Zone | 1,000 | 3,500 | 3,500 | 3,500+ |
| DNSSEC | ✓ | ✓ | ✓ | ✓ |
| CNAME Flattening | At root only | At root only | At any level | At any level |
| Secondary DNS | ✗ | ✗ | ✗ | ✓ Ent only |
| DNS Firewall | ✗ | ✗ | ✗ | ✓ Ent only |
| Outgoing Zone Transfers | ✗ | ✗ | ✗ | ✓ Ent only |
Certificate management, encryption, and TLS configuration
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Universal SSL | ✓ | ✓ | ✓ | ✓ |
| Advanced Certificate Manager | Add-on | Add-on | Add-on | Add-on |
| Dedicated Custom Certificates | ✗ | ✗ | ✗ | ✓ (included) Ent only |
| Total TLS | ✗ | ✗ | ✗ | ✓ Ent only |
| Certificate Pinning | ✗ | ✗ | ✗ | ✓ Ent only |
| Minimum TLS Version | 1.0 | 1.0 | 1.0 | Configurable |
| Keyless SSL | ✗ | ✗ | ✗ | ✓ Ent only |
Web Application Firewall, bot management, DDoS, and threat protection
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| WAF Managed Rules | Basic | Full | Full | Full + Custom |
| WAF Custom Rules | 5 | 20 | 100 | 1,000 |
| WAF Custom Rules (Regex) | ✗ | ✗ | ✓ | ✓ |
| Rate Limiting Rules | 1 rule, 10s period | 2 rules, up to 1 min | 5 rules, up to 10 min | 100 rules, up to 65,535s |
| Rate Limiting Characteristics | IP only | IP only | IP, IP+NAT | IP, IP+NAT, Headers, Cookie, ASN, Country, JA3/JA4, and more |
| IP Access Rules | ✓ | ✓ | ✓ | ✓ |
| Bot Fight Mode | Basic | Super Bot Fight Mode | Super Bot Fight Mode | Bot Management (full) |
| DDoS Protection | Unmetered | Unmetered | Unmetered | Unmetered + Advanced |
| Advanced DDoS (L7) | ✗ | ✗ | ✗ | ✓ Ent only |
| API Shield | ✗ | ✗ | ✗ | ✓ Ent only |
| Leaked Credential Detection | ✗ | ✗ | ✗ | ✓ Ent only |
| Account-level WAF Rulesets | ✗ | ✗ | ✗ | ✓ Ent only |
Protocol support, image optimization, and speed enhancements
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| HTTP/2 | ✓ | ✓ | ✓ | ✓ |
| HTTP/3 (QUIC) | ✓ | ✓ | ✓ | ✓ |
| Early Hints | ✓ | ✓ | ✓ | ✓ |
| Image Optimization | ✗ | Polish + Mirage | Polish + Mirage | Polish + Mirage + Images |
| Speed Brain (Prefetch) | ✗ | ✓ | ✓ | ✓ |
| Cloudflare Fonts | ✗ | ✓ | ✓ | ✓ |
| Zaraz (3rd-party manager) | Basic | Full | Full | Full |
| Rocket Loader | ✓ | ✓ | ✓ | ✓ |
| Minification (Auto) | ✓ | ✓ | ✓ | ✓ |
Network capabilities, routing, and connectivity options
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Anycast Network | Yes (shared) | Yes (shared) | Yes (shared) | Yes (dedicated IPs available) |
| gRPC Support | ✓ | ✓ | ✓ | ✓ |
| WebSocket Support | ✓ | ✓ | ✓ | ✓ |
| IPv6 Compatibility | ✓ | ✓ | ✓ | ✓ |
| Spectrum (TCP/UDP proxy) | ✗ | ✗ | ✗ | ✓ Ent only |
| Argo Smart Routing | Add-on | Add-on | Add-on | Add-on/included |
| China Network Access | ✗ | ✗ | ✗ | ✓ (add-on) Ent only |
| Bring Your Own IP (BYOIP) | ✗ | ✗ | ✗ | ✓ Ent only |
URL rewrites, redirects, header modification, load balancing, and edge logic
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Origin Rules | 10 | 25 | 50 | 300 |
| Origin Override (Host/SNI/DNS) | Port only | Port only | Port only | Full (Host, SNI, DNS, Port) |
| URL Rewrite Rules | 10 | 25 | 50 | 300 |
| Single Redirects | 10 | 25 | 50 | 300 |
| Bulk Redirects (per account) | 15 lists / 500 rules | 15 / 500 | 15 / 500 | 15 / 500+ |
| Request Header Modification | 10 | 25 | 50 | 300 |
| Response Header Modification | 10 | 25 | 50 | 300 |
| Snippets (JS at Edge) | 5 | 15 | 30 | 200 |
| Load Balancing | ✗ | Add-on | Add-on | Add-on/included |
| Waiting Room | ✗ | ✗ | Add-on | Add-on/included |
Logging, analytics, data retention, and monitoring capabilities
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Web Analytics | Yes (basic) | Yes (enhanced) | Yes (enhanced) | Yes (full) |
| HTTP Request Analytics | 24 hours | 72 hours | 1 week | Up to 6 months |
| Logs (Logpush) | ✗ | ✗ | ✗ | ✓ Ent only |
| Instant Logs | ✗ | ✗ | ✗ | ✓ Ent only |
| Custom Analytics Retention | ✗ | ✗ | ✗ | ✓ Ent only |
| GraphQL API Analytics | Limited | Full | Full | Full |
Support channels, response times, uptime guarantees, and contract terms
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Support Channel | Community | Email + Chat (24/7) | Named SA + Phone + Email + Chat | |
| Response Time SLA | None | None | None | Custom (P1: 1 hour) |
| Uptime SLA | None | None | 100% (credit-backed) | 100% (credit-backed, custom) |
| Dedicated Solutions Architect | ✗ | ✗ | ✗ | ✓ Ent only |
| Custom Contract Terms | ✗ | ✗ | ✗ | ✓ Ent only |