Application Services
CDN, Security & Performance Plans
Core website protection and acceleration. Every plan includes global CDN, unmetered DDoS mitigation, free universal SSL/TLS, and DNS.
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Monthly Price | $0 | $20/mo | $200/mo | Custom |
| DDoS Protection | Unmetered L3/4/7 | Unmetered L3/4/7 | Unmetered L3/4/7 | Unmetered + advanced analytics |
| WAF Rulesets | Managed basic | Cloudflare + OWASP managed | Cloudflare + OWASP managed | Custom + managed + advanced rate limiting |
| Custom WAF Rules | 5 rules | 20 rules | 100 rules | 1,000+ rules |
| Page Rules | 3 | 20 | 50 | 125+ |
| SSL / TLS | Universal (shared) | Universal + dedicated | Universal + dedicated + custom | Custom certificates + keyless SSL |
| Image Optimization | — | Polish + Mirage | Polish + Mirage | Polish + Mirage + Image Resizing |
| Bot Management | Basic bot detection | Super Bot Fight Mode | Super Bot Fight Mode | Enterprise Bot Management (ML) |
| Analytics | Basic (24h) | Enhanced (72h) | Advanced (7d + logs) | Full + Logpush + Log Explorer |
| Uptime SLA | — | — | — | 100% uptime guarantee |
| Support | Community | Email + chat | 24/7 email, chat & phone |
Developer Platform
Workers, R2, D1, KV & More
Serverless compute, object storage, databases, and media services. The Workers Paid plan starts at $5/mo and all products share the same subscription.
Workers (Serverless Compute)
| Free Plan | |
| Requests | 100,000 / day |
| CPU time | 10 ms / invocation |
| Paid Plan (Standard) — $5/mo base | |
| Requests included | 10M / month |
| Extra requests | +$0.30 / million |
| CPU ms included | 30M CPU-ms / month |
| Extra CPU | +$0.02 / million CPU-ms |
| Static asset requests | Free & unlimited |
| Max CPU / invocation | 5 minutes |
R2 (Object Storage) — Zero Egress Fees
| Free Tier (monthly) | |
| Storage | 10 GB |
| Class A ops | 1M requests |
| Class B ops | 10M requests |
| Standard Storage | |
| Storage | $0.015 / GB-mo |
| Class A (writes) | $4.50 / million |
| Class B (reads) | $0.36 / million |
| Infrequent Access | |
| Storage | $0.01 / GB-mo |
| Class A (writes) | $9.00 / million |
| Class B (reads) | $0.90 / million |
| Data retrieval | $0.01 / GB |
| Egress | Free |
D1 (Serverless SQL Database)
| Free Plan (daily limits) | |
| Rows read | 5M / day |
| Rows written | 100K / day |
| Storage | 5 GB total |
| Paid Plan | |
| Rows read included | 25B / month |
| Extra rows read | +$0.001 / million |
| Rows written included | 50M / month |
| Extra rows written | +$1.00 / million |
| Storage included | 5 GB |
| Extra storage | +$0.75 / GB-mo |
Workers KV (Key-Value Store)
| Free Plan (daily limits) | |
| Reads | 100K / day |
| Writes | 1K / day |
| Deletes | 1K / day |
| Storage | 1 GB |
| Paid Plan | |
| Reads included | 10M / month |
| Extra reads | +$0.50 / million |
| Writes included | 1M / month |
| Extra writes | +$5.00 / million |
| Storage included | 1 GB |
| Extra storage | +$0.50 / GB-mo |
Durable Objects (Stateful Serverless)
| Free Plan (daily, SQLite only) | |
| Requests | 100K / day |
| Duration | 13,000 GB-s / day |
| Paid Plan | |
| Requests included | 1M / month |
| Extra requests | +$0.15 / million |
| Duration included | 400K GB-s / month |
| Extra duration | +$12.50 / million GB-s |
| SQLite Storage (per DO) | |
| Rows read incl. | 25B / month |
| Rows written incl. | 50M / month |
| Storage incl. | 5 GB |
| Extra storage | +$0.20 / GB-mo |
Queues (Message Queuing)
| Free Plan | |
| Operations | 10K / day |
| Retention | 24 hours |
| Paid Plan | |
| Operations included | 1M / month |
| Extra operations | +$0.40 / million |
| Retention | Up to 14 days |
| Operation unit | Per 64 KB chunk |
Vectorize (Vector Database)
| Free Plan | |
| Queried dimensions | 30M / month |
| Stored dimensions | 5M |
| Paid Plan | |
| Queried dims incl. | 50M / month |
| Extra queried dims | +$0.01 / million |
| Stored dims incl. | 10M |
| Extra stored dims | +$0.05 / 100M |
Containers (Serverless Containers)
| Paid Plan Only — included monthly: | |
| Memory | 25 GiB-hours |
| CPU | 375 vCPU-minutes |
| Disk | 200 GB-hours |
| Overage (per 10ms billing) | |
| Memory | $0.0000025 / GiB-s |
| CPU | $0.000020 / vCPU-s |
| Disk | $0.00000007 / GB-s |
| Network Egress | |
| NA & Europe | $0.025/GB (1 TB incl.) |
| Oceania/Korea/TW | $0.05/GB (500 GB incl.) |
| Rest of world | $0.04/GB (500 GB incl.) |
Stream (Video Storage & Delivery)
| Storage | $5 / 1,000 min stored |
| Delivery | $1 / 1,000 min delivered |
| Encoding / ingress | Free |
| Egress (bandwidth) | Included in delivery |
| Pro/Biz plan bonus | 100 min storage incl. |
Images (Image Storage & Optimization)
| Transformations (Free & Paid) | |
| Free tier | 5,000 unique / month |
| Extra transforms | +$0.50 / 1,000 |
| Paid Plan (Storage in Images) | |
| Images stored | $5 / 100K images / mo |
| Images delivered | $1 / 100K images / mo |
Hyperdrive (Database Accelerator)
| Free plan | 100K queries / day |
| Paid plan | Unlimited queries |
| Connection pooling | Included |
Pages (Fullstack Web Hosting)
| Static assets | Free & unlimited |
| Functions (SSR) | Billed as Workers |
| Builds | 500/mo (free), unlimited (paid) |
| Bandwidth | Unlimited |
Workers Logs: Free plan = 200K log events/day (3-day retention). Paid plan = 20M/month included, +$0.60/million (7-day retention).
Workers Logpush: Paid only — 10M/month included, +$0.05/million.
Workers Logpush: Paid only — 10M/month included, +$0.05/million.
Zero Trust / SASE
Cloudflare One — Zero Trust & SASE
Protect employees, apps, email, and data. Cloudflare One converges workspace security (Access, Gateway, CASB, DLP, Email Security, Browser Isolation) with network services into a single SASE platform.
| Feature / Tier | Free | Pay-as-you-go | Contract | Enterprise |
|---|---|---|---|---|
| Price | $0 | $7 /user/mo | Contact Sales | Contact Sales |
| Max Users | 50 users | Unlimited | Unlimited | Unlimited |
| Access (ZTNA) | Yes | Yes | Yes | Yes (advanced policies) |
| Gateway (SWG) | DNS only | DNS + HTTP + network | DNS + HTTP + network | Full + DLP integration |
| CASB | — | API-driven | API-driven | API + inline |
| Data Loss Prevention (DLP) | — | Basic | Advanced | Advanced + exact data match |
| Email Security | — | — | Add-on | Included |
| Browser Isolation (RBI) | — | Add-on | Included | Included |
| Digital Experience Monitoring (DEX) | — | Basic | Advanced | Full fleet monitoring |
| Logpush & SIEM Integration | — | Limited | Full | Full + custom retention |
| Support | Community | Email & chat | Priority | 24/7 phone + TAM option |
Cloudflare One (SASE): Combines the workspace security services above with Network Services (Magic WAN, Magic Firewall). Contact sales for SASE packaging options and volume discounts. Every Externa enterprise package also includes 50 free Interna (SASE) seats.
Network Services
Network Security & Connectivity
Enterprise-grade products for on-premise and hybrid networks. All require custom contracts through Cloudflare sales.
| Product | Description | Pricing |
|---|---|---|
| Magic Transit | BGP-based DDoS protection and traffic acceleration for on-prem and cloud networks. Replaces dedicated DDoS scrubbing appliances. | Contact Sales |
| Magic WAN | Software-defined WAN as a service. Replace legacy MPLS with Cloudflare's backbone for branch-to-branch and branch-to-cloud connectivity. | Contact Sales |
| Magic Firewall | Cloud-native network firewall (packet-level filtering) deployed at every Cloudflare data center. | Contact Sales |
| Cloudflare Network Interconnect (CNI) | Direct physical or virtual private connections to Cloudflare at 1,600+ locations. | Freewith enterprise contract |
| Argo Smart Routing for Packets | Optimized routing for network-layer (L3/L4) traffic via Magic Transit. | Custom |
Enterprise Packages: Cloudflare now offers pre-configured Externa (public-facing systems) and Interna (internal/SASE) bundles with simplified, value-driven pricing, a 100% uptime SLA, and 24/7 support. Contact your account team for details.
Add-Ons
Platform Add-Ons
Available across Free, Pro, Business, and Enterprise application plans unless noted.
| Add-On | Description | Pricing |
|---|---|---|
| Smart Shield + Argo Smart Routing | Optimized routing via Cloudflare's network for faster, more reliable responses. Includes tiered caching. | From $5/mo + usage based on data transfer |
| Load Balancing | Global & local traffic load balancing, geographic routing, health checks, and failover. | From $5/mo per origin; additional origins extra |
| Advanced Certificate Manager | Custom certificates, dedicated certs, certificate pinning, and advanced TLS settings. | $10/mo |
| Rate Limiting | Protect against brute-force, DDoS at L7, and abusive traffic with configurable thresholds. | Usage-based priced on HTTP traffic volume |
| Cache Reserve | Persistent cache in R2 — eliminates origin egress, improves cache hit ratio. | Usage-based based on data stored + operations |
| Log Explorer | Real-time log retention, search, and analysis. Meet compliance retention requirements. | $1/GB ingested first 10 GB free |
| Automatic Platform Optimization (APO) | One-click WordPress CDN optimization (up to 300% faster). | $5/mo Included w/ Pro, Biz & Enterprise |
| Client-Side Security (Page Shield) | Defend against supply-chain attacks on client-side JavaScript dependencies. | $0.099 / 1K requests |
| Waiting Room | Virtual queue for high-traffic events; protect origin servers from traffic spikes. | Enterprise add-on |
| Spectrum | DDoS protection & traffic acceleration for any TCP/UDP application (SSH, gaming, etc.). | Enterprise add-on |
| SSL for SaaS | Provision and manage SSL certificates for your customers' custom vanity domains. | Enterprise add-on |
| Data Localization Suite | Control where your data is inspected and stored to meet regional compliance. | Enterprise add-on |
| Cloudflare Registrar | At-cost domain registration — you pay what Cloudflare pays. No markup, no surprise renewals. | From $7.85/yr varies by TLD |