Cloudflare Pricing in 2026: Plans, Features and Hidden Costs

The single biggest change to Cloudflare pricing since this article was first published is the Business plan: it moved from $200 to $250 per month per zone for new customers in late 2025, and as of 2026 that is the list price you will be quoted. That 25% jump matters because the Business tier is where most multi-tenant SaaS teams land, and because Business is priced per zone — 12 production domains is $3,000/month before a single Worker executes. This article gives you the 2026 plan matrix, the feature cliffs between tiers, the per-unit costs of Workers, R2, Stream and Zero Trust seats, and the traffic threshold at which a dedicated delivery provider becomes the cheaper answer.

Cloudflare pricing in 2026: the four-tier structure

Cloudflare plans are still sold per zone on self-serve, and per contract on Enterprise. The per-zone model is the detail that surprises architects migrating from a per-account CDN billing relationship. Subdomains ride under the parent zone; separate apex domains do not.

The three feature cliffs that actually drive plan choice

Cliff one: bring-your-own certificate. If you need to upload a certificate — EV, a customer-supplied chain, or something pinned by a mobile client — you are on Business or above. There is no $20 path. This single requirement pushes more teams from Pro to Business than any security feature.

Cliff two: log egress. Business gives you sampled analytics and an HTTP request log API. Logpush into S3, GCS, Splunk or a Kafka sink is Enterprise. If your SRE practice depends on full-fidelity edge logs correlated with origin traces, budget Enterprise from day one rather than discovering the gap during an incident review.

Cliff three: cache key control. Custom cache keys, cache deception protections at scale and account-level rules live on Enterprise. On Business you shape caching through Page Rules and Cache Rules, which is workable but constrains multi-tenant designs where the tenant identifier lives in a header rather than the path.

Hidden costs in Cloudflare pricing that inflate the 2026 invoice

Plan price is the floor, not the bill. Here are the 2026 per-unit numbers that matter, and the shapes of workload that make them bite.

• Workers Paid: $5/month including 10 million requests and 30 million CPU-milliseconds. Beyond that, roughly $0.30 per million requests and $0.02 per million CPU-ms. A 300 million request/month edge API with modest CPU lands near $90–$120/month.
• Workers KV: about $0.50 per million reads, $5 per million writes, $5 per million deletes, plus $0.50/GB-month stored. Write-heavy patterns are the trap; a per-request KV write at 50 million requests is $250/month on its own.
• Durable Objects and D1: billed on requests plus duration (DO) and rows read/written (D1). Stateful edge designs routinely add $50–$400/month before they feel large.
• R2: $0.015/GB-month storage, $4.50 per million Class A operations, $0.36 per million Class B, zero egress. A 10 TB bucket with moderate operation volume runs roughly $165–$195/month.
• Stream: around $5 per 1,000 minutes stored and $1 per 1,000 minutes delivered. For a 500-hour library with 200,000 viewer-minutes a day this is the line item that dwarfs the plan fee.
• Images: approximately $5 per 100,000 images stored and $1 per 100,000 transformations, billed monthly.
• Dedicated certificates: roughly $10/month per certificate pack, plus about $5 per custom hostname/month on SaaS-style setups. Multiply by tenant count and this becomes the dominant cost of a white-label product.
• Legacy rate limiting: still around $0.05 per 10,000 good requests on Pro and Business where enabled.
• Argo Smart Routing: about $5/month base plus $0.10/GB of routed traffic. At 5 TB that is $500/month — easy to forget when someone toggles it during a latency investigation.

Cloudflare Zero Trust pricing in 2026

Zero Trust is a separate meter from the zone plan. As of 2026 the free tier covers up to 50 users. Paid self-serve sits around $7 per user/month, and the Zero Trust bundle with browser isolation, CASB and DLP is commonly quoted in the $10–$25 per user/month range depending on modules and commit. Two details catch people out: seat counts are billed on provisioned identities, not concurrent sessions, and network-layer tunnels for private application access are often scoped under the same contract as your zone Enterprise agreement, which means the negotiation is bundled whether you want it to be or not.

For a 2,000-seat organisation, that is $14,000/month at the base paid rate before any zone spend. Model it separately from CDN spend or your comparison against point solutions will be wrong.

Cloudflare Enterprise pricing: how quotes are actually built in 2026

Enterprise quotes in 2026 typically start at $5,000–$8,000/month for delivery plus baseline security on a handful of zones. Bundles that add Zero Trust seats, bot management and data localisation land between $12,000 and $40,000/month. The variables that move the number, roughly in order of weight:

1. Committed bandwidth and request volume, with non-HTML ratio scrutinised closely.
2. Zone count and whether you need account-level rulesets across all of them.
3. Add-on modules — bot management and isolation are the largest single uplifts.
4. Data residency and regional processing requirements.
5. Term length. Multi-year commits commonly return 15–25% off the annual figure.

One negotiation note grounded in how these contracts are structured: overage rates are usually the softest part of the quote and the hardest to fix later. Push for a defined overage price per GB and per million requests in the order form, not a reference to a rate card.

Workload decision matrix: which plan fits which shape of traffic

Where unmetered bandwidth stops being unmetered

"Unmetered" applies to HTTP/S traffic on self-serve plans, subject to the terms that restrict disproportionate delivery of non-HTML content. In practice, if large files, game patches or video make up the bulk of your bytes, the outcome is a conversation with sales rather than a throttle. The trigger is ratio-driven, not a published byte count, which makes it impossible to budget against.

Above roughly 25 TB/month of predominantly non-HTML egress, run the comparison. A delivery-specialised provider prices bytes explicitly, which is easier to forecast than an Enterprise quote shaped by your content mix. BlazingCDN's volume pricing starts at $100/month for up to 25 TB with additional gigabytes at $0.004, moving to $350 for 100 TB, $1,500 for 500 TB and $4,000 for 2 PB where marginal bytes reach $0.002/GB — around $2 per TB.

For large media and software distributors the argument is stability at a lower unit cost: BlazingCDN targets 100% uptime with fault tolerance comparable to Amazon CloudFront, scales quickly under release-day spikes, and exposes flexible per-origin and per-path configuration. Teams shipping 100 TB+ of patches or VOD frequently keep Cloudflare in front of the application edge and move bulk object delivery to a dedicated provider — a split that usually cuts delivery spend by more than half at that volume.

A 90-day audit before you sign anything

Pull four numbers from the last 90 days before choosing a plan: total egress by content type, cache-hit ratio at the edge and at origin shield, Workers request and CPU-ms distribution, and log volume you actually need retained. If non-HTML bytes exceed 60% of egress and cache-hit ratio is already above 90%, you are buying delivery, not security, and should price it as delivery. If the reverse is true, Cloudflare Enterprise usually wins on consolidated tooling.

FAQ

How much does the Cloudflare Business plan cost in 2026?

$250 per month per zone at 2026 list price for new customers, up from $200 before the November 2025 change. Existing subscriptions in some cases remain grandfathered at the older rate until renewal. Remember that the charge is per zone, so multi-domain estates multiply quickly.

Is Cloudflare bandwidth really unlimited?

HTTP/S bandwidth is unmetered on all plans, but the terms of service restrict disproportionate delivery of non-HTML content such as video and large binaries. There is no published byte threshold; enforcement is based on the ratio of non-HTML to HTML traffic. High-volume file or video delivery typically ends in an Enterprise conversation.

What does Cloudflare Zero Trust pricing look like for a mid-sized company?

As of 2026, up to 50 users is free, self-serve paid seats are around $7 per user per month, and full bundles with browser isolation, CASB and DLP commonly quote between $10 and $25 per user per month. Billing follows provisioned identities rather than concurrent sessions. At 500 seats, budget $3,500–$12,500/month depending on modules.

Do Workers and R2 costs get bundled into my plan?

No. Workers, R2, D1, Durable Objects, Stream and Images are metered independently of the zone plan and appear as separate line items. A Free-plan zone can carry a four-figure Workers bill. Model them as their own budget, especially write-heavy KV and Durable Object patterns.

When is a dedicated CDN cheaper than Cloudflare Enterprise?

Broadly when non-HTML bytes dominate your egress and you exceed about 25 TB/month. At 100 TB, dedicated delivery pricing around $350/month compares against an Enterprise quote that typically starts several thousand dollars higher, because the Enterprise price includes security and platform features a pure-delivery workload may not use.

Which plan do I need to upload my own TLS certificate?

Business or Enterprise. Pro and Free are limited to Cloudflare-issued universal certificates. If you need EV certificates, a customer-supplied chain, or pinned certificates for mobile clients, $250/month per zone is the entry price.

Run this comparison this week

Export 90 days of edge analytics and split egress into HTML versus everything else. If non-HTML crosses 60% of bytes and you are past 25 TB/month, take the same traffic profile and price it against an explicit per-TB delivery contract, then compare against your renewal quote. Then instrument Workers CPU-ms and KV writes per request — that ratio, not request count, is what turns a $5 Workers bill into a $500 one.

If you have already split application edge and bulk delivery across two providers, what was your actual measured cache-hit ratio on the delivery side after the move? That number decides whether the split pays for its operational complexity.