Cloudflare Review 2026

What is Cloudflare?

Cloudflare sits in front of your website and handles DNS, caching, SSL and attack filtering before a request ever reaches your server. For most small sites the free plan does all of that at no cost, which is why so many Indian blogs, SaaS startups and agency client sites run on it. This review covers what you get on each plan, how the developer products (Workers, Pages, R2) are priced, and a practical cloudflare vs aws cloudfront cdn comparison for teams deciding where to put their traffic.

What Cloudflare does for a website

Think of it as a reverse proxy with a very large network. You point your domain's nameservers to Cloudflare, mark DNS records as proxied (the orange cloud), and visitors then connect to the nearest Cloudflare data centre instead of your origin. Static files get cached at the edge. Bad traffic gets filtered. HTTPS works through a free Universal SSL certificate even if your host never set one up.

The network page lists 348 cities, and 22 of them are in India: Mumbai, New Delhi, Bangalore, Chennai, Hyderabad, Kolkata, Pune and Ahmedabad, plus smaller points such as Patna, Kochi, Nagpur, Coimbatore and Bhubaneswar. For an audience spread across tier-2 and tier-3 cities, that coverage matters more than any feature list.

Matthew Prince, Michelle Zatlyn and Lee Holloway started the company in 2009, and the service went public at TechCrunch Disrupt in September 2010. It is based in San Francisco and has been listed on the NYSE as NET since 2019.

Key features in practice

• Cloudflare DNS: authoritative DNS with a clean dashboard, an API, DNSSEC and per-record proxy control. Free on every plan.
• DDoS protection: the current DDoS docs list standard, unmetered protection across layers 3 to 7 on every plan, Free included, so a large attack does not turn into a large bill.
• Cloudflare WAF: the Free plan gets a free managed ruleset. Pro and Business add more managed rules and finer controls.
• Cloudflare Workers: serverless JavaScript and TypeScript at the edge, useful for redirects, A/B tests, APIs and small full-stack apps.
• Cloudflare Tunnel: the cloudflared daemon makes outbound-only connections, so you can publish a server without a public IP or open inbound ports. Handy for a home lab or an office NAS.
• Cloudflare Registrar: you pay only what the registry and ICANN charge, with no markup on registration or renewal.

Is Cloudflare free plan enough for an Indian business site?

Yes, for most of them. According to the plans page, Free includes DNS, CDN, a Universal SSL certificate, unmetered DDoS mitigation, the free managed WAF ruleset, SSO and role-based account access. That covers a WordPress blog, a WooCommerce shop, a marketing site or a small SaaS dashboard.

What you do not get on Free: lossless image optimisation and AMP (both start on Pro), PCI DSS 4.0 compliance and a 100% uptime SLA (Business and up), and network prioritisation, which is kept for Enterprise contracts. Support is also thin, mostly community and docs. If a payment page needs PCI paperwork or you sell an SLA to your own clients, Free stops being enough.

One trap catches video sites. Cloudflare's service-specific terms say that outside Enterprise, serving video or a disproportionate share of large files through the CDN needs a paid product like Stream, Images or the developer platform. Otherwise Cloudflare may limit the site. A course platform hosting MP4s directly is the classic case.

Pricing explained

Prices are listed only in US dollars. There is no INR price on the plans page, so Indian cards are charged in USD.

These prices are per domain (zone). An agency running 15 client sites on Pro pays for 15 Pro plans, which adds up fast. Many agencies keep clients on Free and upgrade only the ones that earn money from the site.

Cloudflare R2 pricing and the developer free tiers

Developer products are billed separately from website plans.

• Workers Free: 100,000 requests per day with 10 ms of CPU per invocation. Workers Paid starts at $5 a month per account with 10 million requests and 30 million CPU milliseconds included, then $0.30 per extra million requests and $0.02 per extra million CPU milliseconds.
• Pages Free: 500 builds a month, one build at a time, up to 100 projects, 20,000 files per site and 25 MiB per file. Static asset requests are free and unlimited; Pages Functions draw from the same 100,000 daily Workers requests.
• Cloudflare R2: 10 GB-month of storage, 1 million Class A (write) and 10 million Class B (read) operations free each month. After that, Standard storage costs $0.015 per GB-month, Class A $4.50 per million and Class B $0.36 per million. Egress to the internet is free.

Zero egress is the real story. S3-style storage usually charges for every GB downloaded. With R2, a 1 TB Standard bucket with 1 million reads comes to about $14.85 a month in Cloudflare's own worked example, and downloads do not change the bill.

Cloudflare vs AWS CloudFront CDN: price and fit

Amazon CloudFront is the obvious alternative if your stack already lives on AWS. Its pay-as-you-go always-free tier gives 1 TB of data transfer out, 10 million HTTP/HTTPS requests and 2 million CloudFront Function invocations every month. Beyond 1 TB, the next 9 TB costs $0.085 per GB from US edges and $0.109 per GB from India, with HTTPS requests at $0.0120 per 10,000 in India.

AWS now also sells flat-rate CloudFront plans, priced per distribution each month: Free ($0, 1M requests, 100 GB transfer, 5 WAF rules), Pro ($15, 10M requests, 50 TB), Business ($200, 125M requests, 50 TB) and Premium ($1,000, 500M requests, 50 TB). Each includes WAF rules and S3 storage, with no overage charges per the AWS pricing page.

My read: CloudFront makes sense when your origin is S3, ALB or EC2 and your team already manages IAM. Cloudflare is simpler for everyone else, especially when the DNS, WAF, SSL and CDN live behind one dashboard and the bill does not move with traffic.

Cloudflare Pages vs Vercel (and Netlify)

Cloudflare Pages deploys from Git and has framework guides for about 30 tools, including Astro, SvelteKit, Nuxt and Hugo. Next.js is the exception: the Pages guide covers only a static export, and Cloudflare points full-stack Next.js apps to Workers. Cloudflare's docs now steer new projects towards Workers. Vercel's Hobby plan is free but limited to personal, non-commercial use and 100 GB of Fast Data Transfer a month; Pro is $20 a month per developer seat. Netlify's free plan runs on 300 credits a month, with bandwidth metered at 20 credits per GB, and its Pro plan is $20 a month with unlimited members.

For a commercial landing page on a free tier, Pages is the safer choice, since static asset requests are not capped and commercial use is not ruled out by a Hobby clause. Vercel still has the smoothest Next.js experience, and Netlify's forms and plugins suit marketing teams. If your app needs server rendering in Next.js, plan for Workers rather than Pages.

Is Cloudflare WARP VPN safe to use?

Cloudflare WARP is the free app (sold as "1.1.1.1 with WARP") that encrypts device traffic and routes it through Cloudflare. Its FAQ says WARP replaces your IP with a Cloudflare IP that reflects your approximate location, so it does hide your address from websites, except for camera and microphone traffic, which bypasses it. It is not built for switching your country to reach foreign streaming catalogues, so treat it as a privacy and encryption layer rather than a classic VPN.

On data handling, the 1.1.1.1 resolver policy says Cloudflare does not sell resolver users' data, truncates client IPs, deletes resolver logs within 25 hours and has the practice audited by a top-four accounting firm. Cloudflare's main privacy policy says it will not sell or rent personal information. For a public cafe Wi-Fi in Bengaluru, that is a reasonable setup.

How to set up Cloudflare DNS for a domain

• Create an account, choose Onboard a domain, enter the root domain and pick the Free plan.
• Check the scanned records. Confirm the apex record, www, and MX plus SPF, DKIM and DMARC TXT records so email keeps working.
• Turn off DNSSEC at your current registrar (GoDaddy, BigRock, Hostinger, etc.) before switching.
• Replace the registrar's nameservers with the two Cloudflare assigns. Activation can take up to 24 hours.
• Once active, set SSL/TLS to Full (strict) if your origin has a certificate, and re-enable DNSSEC from Cloudflare.

Is Cloudflare safe, and why do you see error 520?

For most site owners, yes. Cloudflare publishes a public status page at cloudflarestatus.com and runs a formal privacy policy. The risk is concentration: when Cloudflare has an outage, thousands of sites go down together.

Most "Cloudflare is down" moments are actually origin problems. Error 520 means your server sent Cloudflare an empty or malformed response. Common causes listed in the docs are a crashed PHP app, a firewall or security plugin blocking Cloudflare IPs, headers over 128 KB from bloated cookies, and broken HTTP/2 on the origin. Check your host's error logs first, then the status page.

Limitations and alternatives

• No INR billing, and per-domain pricing gets expensive for agencies.
• Free plan support is limited to docs and community.
• Large-file and video delivery needs paid products outside Enterprise.
• The dashboard has grown crowded, so beginners can get lost between Zero Trust, Workers and website settings.

Other Cloudflare alternatives worth a look: Amazon CloudFront for AWS-heavy stacks, Fastly and Akamai for large media and enterprise contracts, and Vercel or Netlify if you mainly want frontend hosting.

Who should pay

Start on Free. Move one domain to Pro when image optimisation or extra WAF rules save real money or time, and look at Business only when PCI DSS or an uptime SLA is a contract requirement. Developers can stay on the free Workers, Pages and R2 tiers for a long time before the $5 Workers Paid plan becomes necessary.