Cloud Parts

Cloudflare

A global reverse-proxy network that puts a CDN, DNS, DDoS protection and a WAF in front of your site.

What it is
CDNs,DNS
Type
Commercial product
Made by
Cloudflare, Inc.
License
Proprietary
Facts checked
5 October 2026
Website

What it is

Cloudflare works by taking over your domain’s DNS. You point the domain’s nameservers at Cloudflare and mark records as “proxied”. A lookup then returns one of Cloudflare’s anycast IP addresses instead of your server’s, so every visitor connects to the nearest Cloudflare data center (Cloudflare lists more than 340 cities). That data center terminates TLS, filters attacks, answers from cache if it can, and only then forwards the request to your origin, whose real IP stays hidden.

The difference from a classic CDN is that caching is one feature on a general proxy. The same hop runs the WAF, bot filtering, rate limiting, load balancing and Workers scripts, and every plan, including the free one, gets unmetered DDoS mitigation with no bandwidth bill. By default it caches by file extension (images, CSS, JS, fonts and so on) but not HTML or JSON; you opt those in with cache rules. Tiered Cache lets edge locations ask an upper-tier data center before your origin, and a cache lock collapses simultaneous misses into one origin request.

Why teams pick it

  • Free plan includes the CDN, DNS and unmetered DDoS mitigation, with no charge for bandwidth
  • Security and caching live on one hop, configured in one place
  • Hides your origin’s IP address, so attackers can’t bypass the proxy as easily
  • Pairs with Workers and R2 to run code and store files on the same network

Watch out for

  • Doesn’t cache HTML or JSON until you add cache rules, which surprises people who expect full-page caching
  • Terms let Cloudflare limit sites that serve video or mostly large files through the CDN without paid products like Stream, Images or the Developer Platform
  • Outside Enterprise, the largest cacheable file is 512 MB and the origin read timeout is fixed at 125 seconds
  • Proxied records have a fixed 300-second TTL, and the normal setup makes Cloudflare your DNS provider

Alternatives

What all cdns have in common →
Amazon CloudFrontAWSAWS’s CDN: more than 750 edge locations that cache your S3 files and front your load balancers and APIs.Cloudflare PagesCommercialGit-connected hosting for static and full-stack sites: every push is built and deployed to Cloudflare’s CDN with its own preview URL, and a `functions/` folder becomes Workers behind the site. Cloudflare now tells new projects to use Workers instead.

How it fits with other technologies

Check whether a file came from cache, then purge it · bash

curl -sI https://acme.example/assets/app.css | grep -i cf-cache-status
# cf-cache-status: HIT

curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/purge_cache" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"files":["https://acme.example/assets/app.css"]}'

See it in a real stack

No architecture uses Cloudflare yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2004–2026

Cloudflare grew out of a side project about spam. In 2004 Matthew Prince and Lee Holloway built Project Honey Pot, which let any website owner track how spammers harvested email addresses. Thousands of sites joined, and their most common request was: don’t just track the bad guys, stop them. In 2009, at Harvard Business School, Prince met Michelle Zatlyn, who saw a business in doing exactly that. The name came from the idea of a “firewall in the cloud”.

The founders wanted to give everyone, from individual developers to large companies, the speed, protection and reliability that “only the likes of Google, Amazon, and Facebook could afford”. Their trick was to sit in front of a website as a proxy: change your domain’s nameservers and traffic flows through Cloudflare, no code or hardware needed. They launched at TechCrunch Disrupt on 27 September 2010 with five data centers, and hundreds of sites signed up before the judges finished their questions.

From that proxy Cloudflare kept adding services on the same hop: free TLS for every customer in 2014, the Workers edge runtime in 2017, the 1.1.1.1 public resolver in 2018. It went public on the NYSE in September 2019.

Why it’s built this way

Onboard by switching nameservers
Taking over DNS let Cloudflare route a site’s visitors through its proxy without the owner installing anything, which made a self-serve, free product possible.
Anycast for every IP address
Every data center announces the same addresses, so visitors reach the nearest one and an attacking botnet’s traffic is split across all of them instead of hitting one site.
A permanent free plan
A huge base of free sites gives Cloudflare early sight of new attacks, an instant test bed for new features, and the traffic that makes ISPs want to peer with it at no cost.
Never bill by attack size
Since 2017 DDoS mitigation has been unmetered on every plan. Cloudflare argued that charging victims more during an attack was wrong, and its network had grown big enough to absorb the largest ones.

Timeline

  1. 2004

    Prince and Holloway start Project Honey Pot to track spammers

  2. 2009

    Cloudflare founded; wins the Harvard Business School business plan competition

  3. 2010

    Public launch at TechCrunch Disrupt on 27 September

  4. 2014

    Universal SSL gives every customer, free plan included, HTTPS

  5. 2017

    Unmetered DDoS mitigation on all plans; Workers announced

  6. 2019

    IPO on the New York Stock Exchange as NET

  7. 2026

    Announces plans to become a public certificate authority with post-quantum certificates

Sources15 · facts checked 5 October 2026

Improve this page on GitHub