cloudflare plans pricing claude-curated
Cloudflare offers four tiers per zone: Free, Pro, Business, and Enterprise. Plan choice is per-zone, not per-account. Critical features are gated by tier, and several only unlock on Business or Enterprise.
Tier Overview
| Tier | Typical Use | Approx. Cost |
|---|---|---|
| Free | Personal / hobbyist sites | $0 |
| Pro | Small business sites needing basic WAF | ~$25/mo |
| Business | Production SaaS, custom SSL, advanced WAF | ~$250/mo |
| Enterprise | Large orgs, custom contracts, BYOIP | Negotiated |
Feature Gates
Page Rules
Legacy URL-pattern based rule engine. Counts are per zone.
| Plan | Page Rules |
|---|---|
| Free | 3 |
| Pro | 20 |
| Business | 50 |
| Enterprise | 125 |
Cloudflare is migrating Page Rules functionality to the Rulesets engine (Configuration Rules, Redirect Rules, Origin Rules, Cache Rules). New deployments should prefer Rulesets.
Rulesets Engine
Replaces and supersedes Page Rules. Available on all plans, but rule limits and feature sets vary. Categories:
- Custom Rules (formerly Firewall Rules)
- Rate-limit Rules
- Configuration Rules
- Redirect Rules
- Origin Rules
- Cache Rules
- Transform Rules
Rate-Limit Rules
| Plan | Rules | Min Period | Action Granularity |
|---|---|---|---|
| Free | 1 | 10s | Block only |
| Pro | 5 | 10s | Block, JS challenge, managed challenge |
| Business | 15 | 10s | + custom response |
| Enterprise | 100+ | 1s | Full action set, complex expressions |
WAF
| Capability | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Cloudflare Managed Ruleset | Limited | Yes | Yes | Yes |
| OWASP Core Ruleset | No | Yes | Yes | Yes |
| Custom WAF Rules | 5 | 20 | 100 | 1000+ |
| Exposed Credentials Check | No | No | Yes | Yes |
| Sensitive Data Detection | No | No | No | Yes |
| Payload logging | No | No | Limited | Yes |
See Cloudflare WAF for engine details. OWASP CRS is the foundation of the managed ruleset on Pro+.
Image Resizing / Cloudflare Images
- Image Resizing: requires Pro or higher (URL-based transforms).
- Cloudflare Images (storage + delivery): consumption-priced, available on any plan.
- Polish (lossy/lossless image optimization): Pro+.
Apex Proxying (BYOIP)
Pointing A/AAAA records at Cloudflare for an apex domain when proxying through Cloudflare for SaaS requires dedicated IPs, available only as an Enterprise paid add-on. This is the practical blocker for offering custom apex hostnames in a SaaS product. See Cloudflare for SaaS and Apex Domain Limitations.
Cloudflare for SaaS Plan Compatibility
| Plan | Custom Hostnames |
|---|---|
| Free | Not supported |
| Pro | Available, billed per-hostname |
| Business | Available, billed per-hostname |
| Enterprise | Available, custom pricing & limits |
The SaaS feature is enabled per-zone, and per-hostname pricing applies above included tiers.
Other Notable Gates
| Feature | Minimum Plan |
|---|---|
| Custom SSL upload | Business |
| Cloudflare Access (zero-trust SSO) | Free tier (50 users), Enterprise for advanced |
| Argo Smart Routing | Add-on, any plan |
| Load Balancing | Add-on, any plan |
| Logpush to S3/R2/Splunk | Enterprise |
| Bot Management (advanced) | Enterprise |
| Account Takeover Protection | Enterprise |
| HTTP/3 | All plans |
| TLS 1.3 | All plans |
When Each Plan is Justified
- Free: static sites, personal projects, dev environments. No SLA.
- Pro: small commercial sites needing OWASP CRS, image polish, basic Rate Limiting.
- Business: SaaS products needing custom SSL, custom hostnames, exposed-credentials checking, and 100 custom WAF rules. The most common production tier.
- Enterprise: required for Logpush, Bot Management, Apex Proxying, advanced rate-limiting, and SLAs. Justified when audit/compliance, sophisticated bot mitigation, or custom apex hostnames are needed.
See also
- Cloudflare for SaaS
- Cloudflare WAF
- Monitoring Cloudflare Security Events
- Cloudflare Terraform Provider Pitfalls
- OWASP
- Rate Limiting
- Apex Domain Limitations
- Cloud Providers