Introduction
Cloudflare already sits in front of my VPS — it's doing DNS and proxying for the AlmaLinux box behind Caddy, and I never gave much thought to what else was bundled into that same free account. Turns out "free" undersells it badly. A free Cloudflare signup gets you DNS, CDN, DDoS protection, a web application firewall, analytics, and a full serverless development platform, no credit card required.
Here's the part that trips people up: a free Cloudflare account is actually two separate free plans stacked on top of each other. There's the zone plan — what most people mean when they say "Cloudflare free," the thing that protects and speeds up a website. And there's Workers Free, which gives you edge compute, hosting, storage, and databases. They have independent limits, upgrade independently, and most personal projects never need to touch either paywall.
I went through both plans limit by limit and verified everything against Cloudflare's current docs. Here's what you get, exactly where the walls are, and what you can realistically run on $0.
The Two Free Plans in One Account
Sign up once, and you get both plans simultaneously:
| Plan | What it covers | Limit style |
|---|---|---|
| Free zone plan | DNS, CDN, SSL, WAF, DDoS, caching, analytics for one domain | Per-zone feature quotas |
| Workers Free | Workers, Pages, KV, D1, R2, Queues, AI | Daily and monthly usage caps |
Upgrading one doesn't touch the other. You could run a site on the Free zone plan with a paid Workers subscription, or the reverse. For a homelab or side-project setup, you'll likely never need either upgrade.
Protecting and Accelerating a Website
DNS
Cloudflare's DNS is fast and completely unmetered — there's no cap on query volume on Free. The record count is where people get surprised:
- 200 DNS records per zone for domains added on or after September 1, 2024
- 1,000 records for zones created before that date
If you're migrating a large existing zone file, 200 fills up faster than you'd expect. For a typical site running A, AAAA, CNAME, MX, and TXT records, it's plenty.
CDN and Performance
Once a DNS record is proxied (the orange cloud), static assets get served from Cloudflare's edge:
- Unmetered bandwidth, unlimited cached requests
- HTTP/2 and HTTP/3
- Automatic HTTPS rewrites, Brotli/Gzip compression
- Max cacheable object size: 512 MB
DDoS Protection
Unmetered Layer 3/4 and Layer 7 DDoS mitigation runs on every request, free plan included. There's no separate "DDoS tier" to buy — it's the same network absorbing attacks for enterprise customers.
SSL/TLS
Free Universal SSL certificates are issued automatically for every proxied domain and renew on their own. You get full control over encryption mode (Off, Flexible, Full, Full Strict), Always Use HTTPS, TLS 1.2/1.3 minimums, and opportunistic encryption.
Web Application Firewall
The WAF is real on Free, just trimmed down:
| Feature | Free plan |
|---|---|
| Managed rules | Free Managed Ruleset only (on by default) |
| Custom rules | 5, no regular expressions |
| Rate limiting rules | 1 rule, 10-second counting window |
| Request body inspection | Up to 1 MB |
The Free Managed Ruleset covers high-impact, widely-exploited patterns — SQLi, XSS, directory traversal — with zero config. Spend your 5 custom rules on login endpoints and admin paths; that's where they earn their keep.
Bot Protection
Bot Fight Mode is a free on/off toggle that challenges known bot traffic. The catch: it's not customizable, and you can't exempt your own automation — monitoring, CI, payment callbacks. If legitimate automation gets caught in it, your options are disable it entirely or upgrade to Super Bot Fight Mode on Pro.
Caching and Traffic Rules
Cloudflare replaced most of legacy Page Rules with a modern rules engine. Free plan quotas:
| Rule type | Free limit | Typical use |
|---|---|---|
| Cache Rules | 10 | Cache HTML, set TTLs, custom cache keys |
| Configuration Rules | 10 | Toggle features per path |
| Single Redirects | 10 per zone | Edge URL redirects |
| Bulk Redirects | 10,000 URLs across 5 lists | Large redirect maps |
| Page Rules (legacy) | 3 | Old-style URL pattern rules |
| WAF custom rules | 5 | Block/challenge traffic |
| Snippets | 0 | Paid only |
Combined, Free gets 65 rules per zone across the new rules engine — a big jump from the 3 Page Rules era. Cache purge is capped at 5 requests per minute.
In practice: you can cache aggressively, redirect at the edge, and ship a reasonable security policy without paying anything. The gaps are no regex in WAF custom rules and no response-header or body transformations beyond what a rule's own settings expose.
Analytics, Forms, and Email
Web Analytics
Web Analytics is free and privacy-first — no cookies, no data resale, and it works even on pages not hosted on Cloudflare (10 sites via JS snippet on Free, unlimited for proxied sites). Retention is 30 days on every plan.
Turnstile
Cloudflare's free CAPTCHA alternative: up to 20 widgets, unlimited challenge requests, 7 days of widget analytics. It solves the "prove you're human" problem on contact forms and logins without reCAPTCHA's friction or privacy baggage.
Email Routing
Free email forwarding for your domain. Cloudflare adds the TXT and MX records automatically — these count against your DNS record quota. Useful for a [email protected] that forwards straight to Gmail.
Zaraz and AI Gateway
Zaraz (load third-party scripts outside the browser, one line of code) and AI Gateway (caching, analytics, and rate limiting for LLM API calls) are both on every plan, Free included.
Build and Host on the Developer Platform
This is where the free tier stops looking like a CDN add-on and starts looking like a real platform.
Pages — Static Hosting
| Limit | Free |
|---|---|
| Sites | Unlimited |
| Bandwidth / static requests | Unlimited |
| Builds | 500/month, 1 concurrent, 20 min timeout |
| Files per site | 20,000 (25 MiB max per file) |
| Custom domains | 100 per project |
| Projects | 100 per account |
A blog, portfolio, or docs site costs $0 forever, with preview deployments on every push included.
Workers — Edge Compute
| Limit | Free |
|---|---|
| Requests | 100,000/day (resets 00:00 UTC; exceeding it returns Error 1027) |
| CPU time | 10 ms per invocation |
| Memory | 128 MB |
| Subrequests | 50 per request |
| Workers per account | 100 |
| Cron Triggers | 5 per Worker |
| Workers Logs | 200,000 events/day, 3 days retention |
Pages Functions draw from the same 100,000/day Workers quota — static asset requests don't count against it.
The 10 ms CPU limit is the real ceiling to design around: fine for routing, redirects, auth checks, and light API glue, not for anything CPU-heavy. Heavy computation belongs in a queue consumer on the paid plan or on your own box.
Storage and Data
| Product | Free limits |
|---|---|
| Workers KV | 100k reads/day, 1k writes/day, 1k deletes/day, 1 GB stored |
| D1 (SQLite) | 5M rows read/day, 100k rows written/day, 5 GB total (500 MB/DB), 10 databases, 7 days Time Travel |
| R2 (object storage) | 10 GB storage, 1M Class A ops/month, 10M Class B ops/month, $0 egress |
| Durable Objects (SQLite backend) | 100k requests/day, 13,000 GB-s/day, 5 GB stored |
| Queues | 10,000 operations/day, 24-hour retention |
| Hyperdrive | 100,000 queries/day (accelerates an existing Postgres/MySQL) |
| Workflows | 3,000 steps/day, 1 GB-month storage |
Two things here matter more than the rest of the table:
- R2 has zero egress fees at every tier. Store 10 GB, serve it to the whole internet, pay nothing for the transfer. That's the main reason to reach for R2 over S3 on a small project.
- D1 now hard-enforces its daily row limits. As of September 1, 2026, Cloudflare started failing queries outright once an account crosses 5 million rows read or 100,000 rows written in a day — previously this was softer. Queries return errors via both the Workers Binding API and the REST API until the midnight UTC reset; your stored data isn't touched. If you're running anything on D1 that sees real traffic, it's worth checking
rows_read/rows_writtenin the dashboard before you get surprised, and adding indexes where you're seeing full table scans.
Workers AI
Every account gets 10,000 Neurons per day for free — enough for light text-generation and embedding workloads. Some of the larger models need Workers Paid, and separate rate limits (300 req/min for text generation) apply on top of the Neuron budget.
Not free, any plan: Vectorize, Containers, Logpush, Snippets, and KV-backed Durable Objects.
What You Can Realistically Build on $0
- A blog or portfolio — Pages + custom domain + Web Analytics + Turnstile on the comments form. Unlimited bandwidth, 500 builds/month.
- A protected existing site — point DNS at Cloudflare and get CDN, free SSL, DDoS protection, WAF, Bot Fight Mode, and edge redirects for nothing. This is close to what I'm already running in front of my own VPS.
- A serverless API — Workers + D1 + KV. Inside 100k requests/day and 10 ms CPU, this comfortably handles a small API, webhook receiver, or URL shortener.
- An image/file CDN — an R2 bucket on a public
r2.devor custom domain. 10 GB storage, zero egress. - A scheduled job — Cron Trigger + Worker (5 triggers, 10 ms each) for daily reports, syncs, or monitoring checks.
- A password-protected staging site — Pages + Cloudflare Access, free for up to 50 users.
- A small AI feature — Workers AI's 10,000 free Neurons/day behind a Worker, for summarization, classification, or embeddings.
Where the Free Tier Stops
Know these before you build around them:
- 10 ms CPU per Worker request — no image processing, no heavy parsing, no long-running work in a request handler
- 100,000 Worker requests/day — resets 00:00 UTC; a traffic spike ends in Error 1027, not a surprise bill
- D1's daily row limits — enforced since September 2026, not advisory; queries fail until reset
- No regex in WAF custom rules — 5 rules, expression builder only
- Bot Fight Mode is all-or-nothing — can't exempt monitoring or payment traffic
- No image optimization — Polish, Mirage, and the full managed WAF ruleset are Pro features ($20–25/month per zone)
- No paid-grade support — community forum and docs only
- Cache purge capped at 5/minute — fine for small sites, annoying for high-churn media
Cloudflare doesn't bill you for crossing these limits — it blocks or throttles instead. That's part of what makes the free tier reasonable to run in production: the worst case is an error page, not an invoice.
When to Upgrade
Two cheap upgrades cover nearly everything above:
| Upgrade | Price | Unlocks |
|---|---|---|
| Workers Paid | $5/month (per account) | 10M requests + 30M CPU-ms/month included, 30s–5min CPU per request, higher KV/D1/R2/Queues quotas, Vectorize |
| Cloudflare Pro | $20/month annual ($25 monthly), per zone | Managed WAF ruleset, Super Bot Fight Mode, image optimization, 5,000 Pages builds, priority support |
Rule of thumb: upgrade Workers first when your API outgrows 100k requests/day or the 10 ms CPU ceiling. Upgrade Pro only once you actually need tunable bot management, image optimization, or the full WAF ruleset.
Conclusion
A free Cloudflare account buys a lot more than a CDN in front of your site. You get production-grade DNS, unmetered DDoS protection, free SSL, a working WAF, privacy-first analytics, CAPTCHA-free bot checks, and a serverless platform with hosting, compute, SQL, key-value storage, object storage, queues, and AI — all on one account, no card required.
The limits are real, but they're predictable: 100,000 Worker requests a day, 10 ms of CPU, 10 GB of object storage, 5 GB of database. For personal sites, side projects, internal tools, and small APIs, you're unlikely to hit most of them. Start free, learn where the walls actually are, and spend the $5 only when a specific number tells you to.
Sources: Cloudflare developer documentation (Workers, Pages, D1, R2, KV, WAF, Rules, Turnstile), Cloudflare's plans page, and Cloudflare's changelog — verified October 2026.
