Compare all the features between the plans.

Argo's smart routing algorithm uses real-time network intelligence to route traffic through the fastest Cloudflare network paths, while maintaining open, secure connections to eliminate latency imposed by connection-setup.

Argo's tiered caching technology uses regional tier 1 Cloudflare data centers to propagate content to Cloudflare’s global network, minimizing static content requests to your server and reducing costs.

Our 194 data centers located across the globe provide visitors with location-based access to your website, while removing latency and improving performance.

Cloudflare Stream makes streaming high quality video at scale, easy and affordable.

Usage based pricing is determined by the number of DNS requests made by visitors.

Base fees for Load Balancing are determined by the number of origin servers.

Health checks continually ping origin servers to determine if it's online.

Health Check locations are regions from which Cloudflare's data centers run health checks against origin servers.

Global Load Balancing ensures that visitors receive dynamic content from origin servers closest to them.

Load Balancing event logs allow for the review and filtering of status changes of your Load Balancing origins and pools.

Configurable weighting offers fine-grained control of traffic hitting origin servers.

Cloudflare saves you CPU resources and bandwidth by serving your static content directly from our global data centers.

Purge the entire Cloudflare cache or just a single file without waiting.

Cloudflare respects all existing headers, unless you choose to overwrite them. The minimum edge cache expire TTL sets the refetch time for when Cloudflare checks the origin server for a new resource.

The amount of data visitors can upload to your website in a single request.

Web optimization to ensure that the connection between your origin server and the Cloudflare network is as fast as possible. Railgun compresses previously unreachable web objects by leveraging techniques similar to those used in the compression of high-quality video. This can result in additional performance increase.

Custom Cache Keys allow caching to be extended to something more specific than just the URL, this allows you to extend caching beyond just static files.

Argo’s tiered caching technology uses regional tier 1 Cloudflare data centers to propagate content to Cloudflare’s global network, minimizing static content requests to your server and reducing costs.

Automatically optimizes your pages to minimize the number of network connections and ensure even third party resources won't slow down page rendering.

Polish applies "lossless" or optional "lossy" image optimization to reduce your image sizes by 35% on average.

Mirage automatically optimizes image loading through virtualized and lazyloaded images. It detects the browser type of a visitor and optimizes performance for the particular device, improving the performance of images on a mobile connection.

Resize images for a variety of device types and connections from a single-source image master. Images can be manipulated by dimensions, compression ratios, and format (WebP conversion where supported). Included with Business and Enterprise plans (with limits).

Support both IPv4 and IPv6 connections to your site without a single change to your existing infrastructure.

HTTP/2 is the latest update to the HTTP protocol. HTTP/2 brings advancements in efficiency, security, and speed, particularly on high-latency and mobile connections. Cloudflare provides automatic HTTP/2 and SPDY coverage for your visitors.

A WebSocket is a persistent full-duplex protocol which provides low latency client-server communication without the overhead of HTTP.

Set up forwarding, extend or exclude caching, require SSL connections, and generally exercise fine-grained control over how Cloudflare interacts with your site on a page-by-page basis.

Cloudflare's API exposes the entire Cloudflare infrastructure via a standardized programmatic interface. Using Cloudflare's API, you can do just about anything you can do on cloudflare.com via the customer dashboard.

Cloudflare’s Accelerated Mobile Links, powered by AMP, loads AMP-enabled external links inside of a viewing window, within the same tab, at least 3 times faster than normal mobile pages.

Cloudflare’s unmetered mitigation of DDoS stops illegitimate volumetric traffic at the Cloudflare edge. All Cloudflare plans include unmetered mitigation without fear of being dropped.

Backed by a full SLA, our DDoS experts will keep you online 24/7/365 no matter the size, type, or duration of the attack

Using a lightweight agent installed on origin infrastructure, including containers or virtual machines, Cloudflare creates an encrypted tunnel between its nearest data center and an application’s origin server without opening a public inbound port.

Cloudflare is compatible with your existing SSL configuration. If you do not currently use SSL, Cloudflare can provide you with SSL capabilities — no configuration required.

Dedicated SSL Certificates allow you to secure multiple levels of your subdomains and include your fully qualified domain name in the Common Name (CN).

Choose between Cloudflare-issued wildcard SSL certificates (issued automatically) and your own dedicated SSL certificate (upload to our network; supports EV certificates).

Opportunistic Encryption provides HTTP-only domains that can't upgrade to HTTPS, due to mixed content or other legacy issues, with the benefits of encryption and web optimization features.

Automatic HTTPS Rewrites eliminate mixed content issues, while enhancing performance and security; it achieves this by rewriting insecure URLs dynamically from known (secure) hosts to their secure counterpart. Automatic HTTPS Rewrites forces a secure connection and enables the latest security standards and features only available over HTTPS.

Cloudflare optimizes your websites SSL connection to ensure a fast HTTPS experience for your visitors.

SSL on all paid plans activate instantly. SSL on free plans take up to 24 hours for activation.

Universal SSL on the Free plan works with most modern browsers and on paid plans with all browsers.

Cloudflare's cloudbased WAF runs in real-time preventing automated attacks, SQL injection, XSS javascript injections and other real-time POST actions. It contains rules to thwart attacks commonly seen in popular applications, including: WordPress, Magento, Drupal, PHP, Joomla, and more . No hardware or software required.

Includes OWASP ModSecurity Core Rule Set automatically to protect you against the Top 10 vulnerabilities identified by the Open Web Application Security Project (OWASP).

Import your own rules and write custom ones; global update will take effect in less than 30 seconds.

Regular Expressions (regex), sometimes called a pattern, is an expression used to specify a set of strings. Like wildcards, but more powerful, regex gives you the ability to pattern-match text strings occuring in supported fields to target specific traffic.

Cloudflare gets smarter about security threats as more sites join. Protection from attacks on one site is extended to the entire Cloudflare community within seconds.

Block known malicious threats from accessing your site. Security levels are customizable site by site.

Stop spammers from posting to your website.

Protect all of your content including text, images and email addresses from web scrapers with Cloudflare's ScrapeShield™ service.

Fully block or challenge visitors by country, IP address, or AS number. Outside of the Enterprise plan, you can only 'Challenge' visitors by two letter country code, which means a human visitor could still enter the site by passing the captcha.

Create a rule to block or challenge a specific User Agent from accessing your domain. This works similarly to Zone Lockdown, except the block examines incoming User-Agent strings rather than IPs. User Agent blocking applies to an entire zone, and sub-domains cannot not be specified.

Zone Lockdown allows for the whitelisting of specific IP addresses and IP ranges, whereby all other IPs are effectively blacklisted. This supports specific sub-domains and URLs and is useful to protect an administrative area from non-specified IP addresses.

Invite others to manage the account as an Administrator. Invited Administrators have full control over the account except for managing members and changing billing information. Visit the ‘Members’ tab, in the new Account area within the Cloudflare dashboard to get started.

The Cloudflare dashboard now supports Single Sign On (SSO) for ease of centralized identity and access management. Cloudflare Account Owners will be able to setup and define who can access their Cloudflare accounts with the same Identity Provider (IdP) they currently use.

Supports the following identity providers: Facebook, Google, GitHub, Yandex, One-Time Pin

Supports Access Basic identity providers plus:
Okta
OneLogin
Centrify
Microsoft AzureAD
Gsuite

Bring your business into compliance with the latest PCI DSS 3.2 standards by enabling Cloudflare's web application firewall (WAF) and Modern TLS Only mode.

The total number of individual rules per plan type, with which to instruct rate limiting how to function on your website, application, or API.

CAPTCHA will serve a Google Captcha to visitors matching the triggered rules, and JS Challenge will run a JavaScript challenge that validates whether the visitor is using a legitimate browser.

Set up rules based on values in the header response from either origin or cache.

The number of rules where the Header Response is used as a trigger. One header rule is already used by default to determine whether to count based on origin traffic or traffic served from the cache.

The length of time in which counts of an individual IP address take place. For example, a 1 minute sampling period means that an individual IP addresses requests against a rate limited asset is counted for 1 full minute.

The amount of time in which a visitor (individual IP address) is blocked from access.

"Live" mode is when a Rate Limiting rule becomes active and billed on your website, application, or API. "Simulate" mode allows you to test, un-billed, a Rate Limiting rule to determine request traffic and adjust accordingly.

The HTTP method that must match to count a request against your threshold. For example, if you only want to count requests that use POST, select POST.

Allowing the origin server to serve a response code to visitors who exceed Rate Limiting thresholds. For example, for AUTH failures code 403 could be used.

The response body defines what is returned to the visitor once the threshold has been exceeded and the action is to "block." Allowable formats include JSON, text, and HTML (using the Customize app). There is a 32kb maximum.

"False" means Rate Limiting only counts requests which are routed to origin servers. "True" means that Rate Limiting counts requests routed to both Cloudflare's edge network and origin servers.

Gain valuable insights with Rate Limiting analytics, to determine which Rate Limiting rules are triggered by action, rule, or data center.

Pricing for each plan type.

DNSSEC ensures that a website’s traffic is safely directed to the correct servers, so that a connection to a website is not intercepted by a man-in-the-middle.

Fast responsive times globally and nearinstant updates.

Cloudflare offers a simple and intuitive DNS management interface.

Cloudflare supports wildcard DNS at all plan levels. For Enterprise plans, Cloudflare will full proxy wildcards providing security and performance for these subdomains.

Cloudflare offers a simple and intuitive DNS management interface.

Custom nameservers allow you to create your own, unique nameservers in place of your assigned Cloudflare nameservers.

Keeps the static portions of your site online even if your origin server goes down.

The Cloudflare analytics dashboard provides the ability to magnify your data by time range scopes of 1 hour, 15 minutes, or 1 minute, depending on your plan type.

Cloudflare saves you bandwidth by serving cached versions of your content from our data centers. This means that only a small number of requests actually go back to your origin server. The more content served by our edge servers, the more bandwidth you save.

Total Threats Stopped measures the number of "suspicious" and "bad" requests that were aimed at your website. In addition, you can view top threat origins by country and threat type.

Cloudflare aggregates two types of requests: Requests that are answered directly from your origin server (uncached) and requests that are answered from Cloudflare’s cache (cached). This helps you to understand the amount of "cache coverage" over time. The higher the amount cached by Cloudflare, the lower number of requests your origin has to , freeing up server resources.

Cloudflare measures and reports on operational metrics such as traffic served over SSL, fewer servers needed, and unique visitors.

View and download the most recent changes made within your account via UI or API.

View the history of your DNS queries by up to a certain amount of time.

Filter DNS query data by a variety of dimensions, according to plan type.

Filter DNS query data by a variety of metrics, according to plan type.

See where queries for valid and invalid DNS queries are coming from.

All Cloudflare customers receive access to varying levels of support options, based on plan type.

In the rare event of downtime, customers receive a service credit against the monthly fee, in proportion to the respective disruption and affected customer ratio.

An individual script can be applied to one or more paths on your domain. They are limited to 1MB in size.

CPU time is only the time a script spends executing. Any time spent waiting for I/O (e.g. fetch requests) does not count.

The number of Cloudflare network locations where Workers are deployed.