What Is Cloudflare? Free Plan, Pricing, AI Tools, and Bot Controls

👁 116 reads

Cloudflare is an American technology company whose infrastructure handles traffic for over a quarter of the web: it accelerates websites, mitigates DDoS attacks, manages bots, and increasingly powers AI models and autonomous agents. For regular users, it provides the free 1.1.1.1 DNS service and WARP application; for site owners, its Free tier covers the vast majority of web projects. Here is a complete overview of what Cloudflare offers for free, its commercial pricing, its AI developer stack, how it controls AI web scrapers, how it stacks up against competitors, and what to do during outages.

What is Cloudflare and how does it work?

When you visit a website powered by Cloudflare, your request does not connect directly to the origin server. Instead, it hits the nearest Cloudflare data center edge, which:

• Serves cached static and dynamic assets instantly (a Content Delivery Network, or CDN);
• Filters malicious DDoS traffic, abusive bots, and suspicious requests (occasionally presenting an interstitial verification check);
• Encrypts the communication via automated SSL/TLS certificates;
• Passes legitimate, uncached requests back to the actual origin host.

Beyond edge proxying, the platform provides standalone utilities: the 1.1.1.1 public DNS resolver, the WARP client, wholesale-price domain registrations, an edge compute environment (Workers), S3-compatible object storage (R2), and an expanding AI inference ecosystem. A data point published on the company blog on September 30, 2026, illustrates this volume: Cloudflare processes an average of 115 million HTTP requests per second, with peak volumes exceeding 150 million.

Founded in 2009 by Matthew Prince, Michelle Zatlyn, and Lee Holloway, the service launched publicly on September 27, 2010. San Francisco-based Cloudflare Inc. trades on the New York Stock Exchange under the ticker NET. In September 2026, the company announced workforce reductions affecting roughly 20% of its staff - covered in detail in Cloudflare cuts 20 percent of workforce.

Cloudflare Free Plan: what is included at zero cost?

Cloudflare’s Free tier is not a time-limited trial; millions of blogs, portfolios, and commercial sites run on it indefinitely. As of October 2026, the free account provides:

• Authoritative DNS, global CDN caching, and unmetered DDoS mitigation with no bandwidth caps;
• Free managed SSL/TLS certificates (Universal SSL);
• Turnstile - frictionless smart verification replacing interactive CAPTCHAs (up to 20 widgets);
• Cloudflare Tunnel - secure edge routing from local workstations and servers without open public ports;
• Workers edge compute: 100,000 free requests per day; R2 storage: 10 GB with zero egress fees;
• Workers AI: 10,000 daily inference “neurons” and core AI Gateway tooling (analytics, edge caching, rate limiting);
• Zero Trust access controls for teams up to 50 users;
• AI crawler preferences, including Bot Preference Sync, plus pay-per-use Logpush options added on October 2.

How to set up a website on Cloudflare

1. Register an account on cloudflare.com and enter your domain name.
2. Cloudflare scans and imports your existing DNS records - verify that they match your current hosting setup.
3. For new domains, specify your monetization model to configure recommended default AI crawler rules.
4. Log in to your domain registrar and point your nameservers to the two designated Cloudflare addresses.
5. Allow DNS propagation to complete (typically within minutes to a few hours, up to a maximum of 48 hours).
6. Set the SSL/TLS encryption mode to “Full (strict)” if your origin has its own valid certificate, then test the site in an incognito window.

Cloudflare pricing breakdown (October 2026)

Cloudflare bills its self-serve platform directly in US dollars across global regions.

Cloudflare for AI development

Since 2024, AI deployment has formed the core of Cloudflare’s platform roadmap. The foundational pieces include:

Workers AI: Serverless inference without managing GPUs

Run open-weights models across Cloudflare’s worldwide GPU fleet on a serverless, pay-per-use basis. The catalog hosts 69 text models, including Gemma 4 26B, gpt-oss-120b, DeepSeek V4 Flash and Pro, Kimi K2.6, GLM 5.3, Llama 4 Scout, and Qwen 3.8 27B, alongside image generation (FLUX.2), audio processing (Whisper, Aura), and embedding engines. Current pricing examples: Llama 3.1 8B costs $0.045 per million prompt tokens, while DeepSeek V4 Flash runs at $0.44 per million tokens. As of October 1, the platform also added European models EuroLLM (covering all 24 official EU languages) and Apertus.

AI Gateway: Multi-provider orchestration and cost governance

Proxy outgoing API traffic to OpenAI, Anthropic, Google, or Workers AI endpoints to gain unified audit logs, edge response caching, automated budget limits, and dynamic failover routing. Introduced on September 30, Auto Router (cloudflare/auto) selects the most cost-efficient capable model per prompt; in Cloudflare’s internal benchmarks, the cost per successful task dropped to $0.0084 compared to $0.0210 when querying Claude Opus 5.5 directly. On October 2, native web search retrieval was introduced into the gateway. Read more: AI Gateway and API cost controls.

Agents, MCP, and headless browsers

• Agents SDK and MCP: Cloudflare has supported remote Model Context Protocol (MCP) servers since March 2025. Following the July 28, 2026, MCP specification update that established stateless client-server sessions, full MCP endpoints can run natively inside standard edge Workers.
• Browser Run: Formerly Browser Rendering, this service provides sandboxed cloud browsers for agents, featuring live streaming feeds and interactive human-in-the-loop takeovers. In parallel, Cloudflare is building Kitesurf - explored in Cloudflare launches Kitesurf agent browser.
• AI Search: Native vector and semantic search indexing over private documentation, generally available since October 1, transitioning to metered billing on November 1, 2026 (retaining a free allowance).
• Cloudflare OS: An agentic workspace framework for organizations. Its open-source core was released in August (read the analysis here), with a managed enterprise waitlist opened on October 1.

Clef decision models

On October 1, Cloudflare released Clef and Clef-flash as Apache 2.0 open-source releases - specialized classification and decision models engineered to output deterministic categorizations rather than freeform text, designed for fast routing and pipeline steering. Both models run natively inside Workers AI with reinforcement learning fine-tuning support, reflecting the broader industry shift covered in our guide to AI decision models.

AI bot management: rules for publishers and webmasters

Cloudflare sits as the primary gatekeeper controlling how AI web scrapers index the open internet. As of September 15, 2026, the dashboard provides three distinct category controls - Search (search engine indexing), Training (model training datasets), and Agent (delegated autonomous user tasks) - configurable to Allow, Block, Block on pages with ads, or Disallow AI Training.

• Disallow AI Training: Preserves visibility in mainstream search engines (Google, Bing, Apple) while restricting training scrapers from Amazon, Anthropic, Meta, and OpenAI. Google, Apple, and Microsoft carry Cloudflare’s “Accountable” designation, committing to respect training opt-outs without demoting search rankings.
• Block: Applying a blanket block under the updated September 15 taxonomy also halts Googlebot, Bingbot, and Applebot, effectively de-indexing the domain from major search engines.
• Bot Preference Sync: Enabled across all plans since August 21, this automatically mirrors dashboard scraper selections directly into the site’s dynamic robots.txt file.
• Monetization mechanisms: Pay Per Crawl (introduced July 2025) allows publishers to set per-request scraping fees, while Pay Per Use (beta launched September 30, 2026) meters actual content ingestion by AI aggregators. Read the analysis: Pay Per Use: can publishers monetize AI bots?

For implementation guidance, read how to configure AI bots in Cloudflare and our general tutorial on blocking AI bots on your website. The operational timeline is documented in Cloudflare AI bot rules change and blocking bots on ad-supported sites.

Bot scraping benchmark: how major sites handle AI crawlers

On October 5, we analyzed the robots.txt files of 50 prominent European and international publishing domains (48 resolved cleanly) against 13 recognized AI crawler signatures:

• 21 of the 48 audited domains blocked at least one AI bot;
• The most frequently restricted agents were GPTBot (15 sites), CCBot (14), and Bytespider (11);
• 14 of the 15 domains blocking GPTBot explicitly allowed OAI-SearchBot, ensuring citations within ChatGPT search outputs;
• While 19 of the 50 domains were proxied by Cloudflare, none had adopted dynamic Bot Preference Sync yet.

Read the complete data breakdown: robots.txt AI bot audit report.

1.1.1.1 and WARP for end users

1.1.1.1 is Cloudflare’s free, privacy-first public DNS resolver that translates hostnames to IP addresses, operating as a drop-in replacement for standard ISP DNS servers. On September 10, 2026, the service added post-quantum DNSSEC signature validation. WARP is a consumer application (supported on Android, iOS, Windows, and macOS) that encapsulates and encrypts device outbound traffic through the Cloudflare edge network, boasting over 100 million installs on Google Play with a 4.2-star rating.

Note: WARP is not a conventional privacy VPN for bypassing geographic restrictions or masking your nationality. It secures connections against surveillance on insecure public Wi-Fi networks, but target web destinations still receive your approximate geographic origin.

DNS performance comparison: 1.1.1.1 vs competitors

To measure lookup latency, we executed two testing rounds of 50 consecutive queries for top global domains alongside 50 cold queries to pseudo-random non-existent subdomains that force complete root and authoritative resolution cycles. Tests were performed on a broadband Windows 11 workstation. The table reports median round-trip times across Rounds 1 and 2.

Key takeaway: Cloudflare 1.1.1.1 matched optimized local telecom resolvers on cached requests and demonstrated significantly lower response times than Google Public DNS on both cached and cold queries.

Cloudflare Tunnel: exposing local AI models securely

Cloudflare Tunnel allows developers to expose local background services - such as an Ollama instance running self-hosted models - to the wider internet without acquiring static public IPs, configuring NAT, or modifying router firewall ports. Quick Tunnel generates an ephemeral trycloudflare.com endpoint without requiring account authentication. Following the cloudflared 2026.9.3 update on October 2, tunnels can be locked down via the --allowed-mail flag to permit authenticated access only to authorized email addresses. Note that unconfigured Ollama instances (tested on v0.35.1) return an HTTP 403 Forbidden error when accessed through tunnel proxies unless appropriate host binding flags are specified.

Handling outages

Due to Cloudflare’s scale, edge infrastructure incidents disrupt substantial portions of web services simultaneously. Significant interruptions over the past year include November 18, 2025 (resolved after 5 hours and 46 minutes, marking its most extensive disruption since 2019), December 5, 2025 (a 25-minute incident degrading 28% of global HTTP traffic), and February 20, 2026 (a 6-hour, 7-minute outage affecting Bring Your Own IP customers). To verify service availability during connectivity problems, consult Cloudflare outage tracker and status history. For troubleshooting interstitial security blocks, review our guide to resolving Cloudflare verification loops.

Cloudflare compared to industry alternatives

In summary: For small-to-medium businesses and content publishers, Cloudflare Free provides unmatched value. Bunny.net remains attractive for dedicated high-volume file delivery where transfer pricing predictability is critical. Vercel delivers superior developer ergonomics for modern Next.js deployments, though its entry tier forbids commercial production usage.

Who should use Cloudflare?

• Publishers and bloggers: Free tier caching, automatic SSL, DDoS hardening, and granular controls over AI scrapers.
• AI application engineers: Serverless pay-as-you-go inference via Workers AI and centralized model routing via AI Gateway without dedicated GPU leases.
• Everyday web users: High-performance encrypted lookups with 1.1.1.1 and encrypted transit over public Wi-Fi via WARP.
• Media networks: Programmatic crawler monetization through Pay Per Crawl and Pay Per Use.

When to consider alternative architectures: If your business model demands strict uptime isolation independent of Cloudflare’s core infrastructure (such as critical transactional checkouts), deploy an active-active secondary CDN configuration.

Related Cloudflare guides and coverage

• Cloudflare Birthday Week 2026 feature review
• Pay Per Use: can web publishers monetize AI crawlers?
• Cloudflare verification loops and “Verify you are human” fixes
• Cloudflare outage status, diagnostic steps, and history
• Configuring Cloudflare AI bot controls
• Crawler audit: AI bots in top publishers’ robots.txt
• AI Gateway setup and API cost management

Frequently Asked Questions

What is Cloudflare and what does it do?

Cloudflare operates a global reverse proxy network positioned between end users and origin servers. It optimizes load times via edge caching (CDN), mitigates cyberattacks and malicious bots, manages DNS lookups, and provides developer infrastructure. If you encounter a Cloudflare interstitial screen or error notice while browsing, the site you are accessing routes its traffic through their network.

Is Cloudflare truly free?

Yes. The Cloudflare Free tier costs $0 per month and includes globally distributed authoritative DNS, unmetered CDN caching, automated Universal SSL certificates, and L3-L7 DDoS defense. The 1.1.1.1 resolver, WARP client, and Turnstile CAPTCHA replacement are also free. Users pay only when upgrading to self-serve tiers (Pro from $20/month) or exceeding developer compute allowances.

How much does Cloudflare cost?

The Pro tier runs $20 per month billed annually or $25 on a monthly cadence; Business costs $200 or $250 per month; Enterprise tiers require custom agreements. Developer services like Workers begin at $5 per month for paid account features with additional metered usage.

Is Cloudflare WARP a VPN?

WARP encrypts device traffic between your computer and the Cloudflare edge similarly to a VPN tunnel, but it does not mask your origin country or spoof alternate geographies. Remote destinations can still ascertain your approximate region. Its primary purpose is securing transit on untrusted networks and accelerating DNS queries.

Why does Cloudflare block access to certain websites?

Cloudflare does not unilaterally ban users; rather, it enforces the firewall rules configured by individual site operators. Visitors arriving through commercial VPNs, Tor exit nodes, shared mobile gateway IP addresses, or browsers with aggressive script blocking are more frequently flagged for interactive verification. For diagnostic steps, see fixing Cloudflare verification issues.

How can I check if Cloudflare is down today?

Check cloudflarestatus.com, radar.cloudflare.com, and major incident trackers. If several unrelated high-profile sites simultaneously report HTTP 5xx errors displaying Cloudflare branding, the interruption is likely rooted in an upstream network event.

Is Cloudflare safe and private?

Yes, Cloudflare is an established global network security enterprise, and its 1.1.1.1 DNS service undergoes regular independent privacy audits. Keep in mind that as a reverse proxy, Cloudflare inspects unencrypted payload traffic passing to its hosted endpoints. Furthermore, beware of malware schemes using fake “Verify you are human” prompts that instruct users to paste scripts into system command terminals; those represent phishing attacks, not legitimate Cloudflare security checks.

What are the primary Cloudflare DNS server addresses?

Standard IPv4 addresses are 1.1.1.1 and 1.0.0.1; IPv6 addresses are 2606:4700:4700::1111 and 2606:4700:4700::1001. Cloudflare also offers malware-filtering DNS at 1.1.1.2 / 1.0.0.2 and family-safe DNS (blocking both malware and adult domains) at 1.1.1.3 / 1.0.0.3.

Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →

Sources and verification

Platform specifications and pricing verified as of October 5, 2026. DNS latency benchmarks and robots.txt scrapers were captured on the same date.

• Cloudflare Plan Overview and Pricing
• Cloudflare Workers Platform Pricing
• Cloudflare Workers AI Platform Pricing
• Cloudflare Workers AI Model Directory
• Cloudflare AI Gateway Pricing Documentation
• Cloudflare Global Network Coverage
• W3Techs Web Technology Survey: Cloudflare Market Share
• Cloudflare: Disallow AI Training Specification (September 15, 2026)
• Cloudflare: The Internet Has a Second Audience (September 30, 2026)
• Cloudflare Clef Open-Source Decision Models (October 1, 2026)
• Cloudflare: Next Generation MCP Support (August 6, 2026)
• Cloudflare Browser Run for AI Agents (April 15, 2026)
• Cloudflare: Post-Quantum DNSSEC for 1.1.1.1 (September 10, 2026)
• Vercel Plans and Pricing, Netlify Platform Pricing, Bunny.net CDN Rates, Fastly Bandwidth and Service Pricing

Kinetyra