Small teams often ask me whether they need a CDN, a WAF, a DDoS service, a tunnel product, a static hosting provider and a CAPTCHA vendor. For a surprising number of projects the answer is that Cloudflare's free plan covers a good part of all of them. The catch is that the free tier is spread across many products with their own limits, and the order you turn things on matters.

This guide gives a short overview of the paid plans, so you know what you are not getting, and then walks through the free services that are genuinely useful for a small company or side project, with a setup order and the mistakes I see most often. Plans, prices and limits change, so treat the specific numbers as a snapshot at the time of writing and check the official plan pages before deciding.

The plans at a glance

Cloudflare's core website plans are per domain (zone), with platform products such as Workers, R2 and Zero Trust billed separately.

Plan Typical buyer Notable additions over the tier below
Free Personal sites, side projects, small businesses DNS, CDN, Universal SSL, unmetered DDoS mitigation, free managed WAF rules, basic bot protection
Pro Professional sites Cloudflare managed WAF ruleset, image optimisation features, more rules, better analytics
Business Businesses with compliance or uptime needs Custom SSL certificates, higher rule limits, uptime SLA, priority support
Enterprise Large organisations Custom contracts, advanced bot management, dedicated support, many add-ons

Pro and Business are priced per month per domain, Enterprise is negotiated. What paid plans mostly buy is broader managed WAF coverage, more rules, more analytics depth, image and performance features, and support. The core network protection is the same.

What the free plan includes

Authoritative DNS

Fast, anycast DNS hosting for your domain at no cost, with DNSSEC in one click. Even if you use nothing else, it is a reliable DNS provider. Records can be "proxied" (orange cloud) through Cloudflare or "DNS only" (grey cloud).

CDN and caching

Proxied records get caching of static assets at the edge, HTTP/2 and HTTP/3, compression and Always Online. By default Cloudflare caches by file extension (images, CSS, JS), not HTML. Cache rules let you change that for specific paths.

Universal SSL

A free edge certificate for your domain and first-level subdomains, renewed automatically. The important setting is the SSL/TLS encryption mode between Cloudflare and your origin:

Mode Edge to origin Use
Off / Flexible HTTP Avoid; traffic to the origin is unencrypted, and redirect loops are common
Full HTTPS, certificate not validated Temporary only
Full (strict) HTTPS with a valid certificate The goal; a free Cloudflare Origin CA certificate works

Flexible mode combined with an origin that redirects HTTP to HTTPS causes the classic "too many redirects" loop, which is covered in an earlier post.

DDoS protection

Unmetered mitigation of network and HTTP DDoS attacks is included on every plan, including free. You do not pay for attack traffic. This alone is a reason to put a public site behind the proxy.

WAF on the free plan

  • Free managed ruleset: Cloudflare deploys protection for high-impact, widely exploited vulnerabilities to free zones.
  • Custom rules: a small number of your own rules, for example blocking a country you do not serve, challenging requests to /wp-login.php, or allowing only your office IP to /admin.
  • Rate limiting: a basic rate limiting rule, useful for a login or contact form endpoint.
  • Bot Fight Mode: challenges known automated traffic. Test it; it can interfere with legitimate API clients.

A useful first custom rule protects an admin path:

(http.request.uri.path contains "/admin" and not ip.src in {198.51.100.0/24})
Action: Block

Cloudflare Tunnel

Tunnel (cloudflared) creates an outbound-only connection from your server to Cloudflare, so you can publish an internal web app or a home lab service without opening any inbound port or exposing your IP. It is free.

cloudflared tunnel login
cloudflared tunnel create staging-app
cloudflared tunnel route dns staging-app staging.example.com
cloudflared tunnel run --url http://localhost:8080 staging-app

Zero Trust access for small teams

Cloudflare Zero Trust has a free tier for a limited number of users. Combined with Tunnel, Access lets you put an identity login (Google, GitHub, one-time PIN by email) in front of internal tools, which is a large improvement over basic auth or IP allow-lists.

Pages and Workers

  • Pages hosts static sites and front-end frameworks from a Git repository, with preview deployments for pull requests, on the free plan with monthly build limits.
  • Workers runs JavaScript or WebAssembly at the edge. The free plan has a daily request allowance, enough for redirects, small APIs, header rewriting and webhooks.

R2 object storage

R2 is S3-compatible storage without egress fees, with a free monthly allowance of storage and operations. For a small site's uploads or backups it can cost nothing.

Turnstile

A free CAPTCHA alternative that usually runs without asking users to solve puzzles. You can use it on any site, even one not proxied by Cloudflare.

Other useful free features

  • Email Routing: receive mail at addresses on your domain and forward to an existing inbox.
  • Web Analytics: privacy-friendly analytics without cookies.
  • Redirect rules and transform rules: HTTP to HTTPS, apex to www, header changes.

A setup order that avoids surprises

  1. Add the domain and review imported DNS records. The automatic scan misses some records, especially for mail. Compare with your current DNS before changing name servers.
  2. Keep mail and non-HTTP records as DNS only. MX, mail hosts, SSH and database hosts must not be proxied.
  3. Switch name servers at your registrar and wait for activation.
  4. Install an origin certificate and set SSL/TLS to Full (strict) before anything else.
  5. Enable "Always Use HTTPS" and, once stable, HSTS with a short max-age first.
  6. Turn on proxying for web records, one at a time, and test.
  7. Lock down the origin so it only accepts traffic from Cloudflare's published IP ranges, or move it behind a Tunnel. Otherwise attackers bypass every protection by hitting your IP directly.
  8. Add WAF custom rules for admin paths and a rate limit for login.
  9. Add caching rules only where you understand what is safe to cache. Never cache pages that contain user-specific data.

Common mistakes

Mistake Effect Fix
Flexible SSL mode Unencrypted origin traffic, redirect loops Full (strict) with an origin certificate
Proxying the mail record Mail stops arriving MX and mail hosts as DNS only
Origin open to the internet Attackers bypass WAF and DDoS protection Allow only Cloudflare IPs, or use Tunnel
Caching HTML with sessions Users see each other's pages Bypass cache for authenticated paths and cookies
Bot Fight Mode on an API Mobile apps and webhooks get challenged Skip rules for API paths, or disable on the zone
Real client IP lost in logs Every request appears to come from Cloudflare Restore the client IP from CF-Connecting-IP at the origin

When to pay

Upgrade when you need something specific: broader managed WAF coverage for an application handling payments or personal data, image optimisation at scale, an uptime SLA, custom certificates, or support with response times. For many small projects, the free plan plus careful configuration is enough for a long time.

Key takeaways

  • The free plan covers DNS, CDN, Universal SSL, unmetered DDoS mitigation and basic WAF protection.
  • Tunnel and the free Zero Trust tier publish internal tools without opening ports.
  • Pages, Workers, R2 and Turnstile cover hosting, edge logic, storage and bot checks for small projects.
  • Use Full (strict) SSL and lock the origin to Cloudflare, or the protection can be bypassed.
  • Check the official plan pages for current limits before relying on a specific number.

References