Cloudflare licensing is the set of plans, units and contracts under which Cloudflare, Inc. sells its network services: application security and performance (DNS, CDN, DDoS protection, web application firewall), SASE and Zero Trust services for a workforce, network services, and a serverless developer platform. Cloudflare does not sell perpetual software licences. Customers subscribe to cloud services, and the Enterprise Subscription Agreement defines “Service(s)” as “all Cloudflare services and products listed at www.cloudflare.com, along with any software made available by Cloudflare in connection with such services, including software development kits and application programming interfaces”.[3] The contracting entity on the enterprise agreement is Cloudflare, Inc., a Delaware company with its principal office in San Francisco.[3]
Three counting models sit side by side. Application services are sold as plans that are “billed per domain on your account”.[5] Cloudflare Zero Trust is “made available on a Seat licensing basis, unless a different unit of measurement is specified on your Order Form”.[7] The developer platform, including Workers and the R2 object store, is billed on metered usage.[10] A single account can combine all three, so one invoice can carry flat plan fees per domain, per-user seat fees and usage charges.[6] Catalog proof: Domain plans are billed per domain; Zero Trust is licensed per Seat, with substitution allowed; Usage-based products are billed in arrears.
Editions
Cloudflare’s public pricing page groups its offers into three tabs: Network & CDN, SASE / Zero Trust, and Compute & Storage.[1] Each tab has a free entry level, a self-serve paid level and a contract level.
| Product line | Plans | Unit | List price (USD) | Deeper article |
|---|---|---|---|---|
| Application services (Network & CDN) | Free, Pro, Business, Contract (Enterprise) | Domain | Free $0; Pro $20 a month billed annually or $25 monthly; Business $200 a month billed annually or $250 monthly; Contract custom[1] | Application services plans |
| SASE / Zero Trust | Free, Pay-as-you-go, Contract | Seat (user) | Free $0 up to 50 users; Pay-as-you-go $7 per user per month; Contract custom annual price per user[1] | Zero Trust seat licensing |
| Developer platform (Compute & Storage) | Workers Free, Workers Paid | Account, then usage | Workers Paid minimum $5 a month per account; usage above the included amounts is billed[9] | Workers and developer platform pricing |
The application services plans differ mainly in features, support and service levels. The Business plan carries a 100% uptime SLA with 1x Service Credits; the Contract plan carries a 100% uptime SLA with 10x Service Credits on the Standard success plan and 25x on Premium, and adds network prioritization.[1] Free and Pro have no uptime SLA.[1]
For enterprise SASE, Cloudflare also sells named packages. The Units of Measurement define Interna Essentials, Interna Advantage and Interna Premier, and Externa Essentials, Advantage and Premier, as the packages of Services identified on Cloudflare’s website.[4] The Interna page describes a “single per-seat price” for remote, hybrid and branch users.[16]
Metrics
Cloudflare publishes the units used in orders and invoices in the “Units of Measurement” section of its Service-Specific Terms. These definitions apply “regardless of whether such terms are capitalized or uncapitalized” unless an Order Form says otherwise.[4] The main ones for licence management are:
- Domain: a publicly registrable domain with its child subdomains, configured individually and given its own zone ID. Pro domain and Business domain are domains entitled to those plan levels.[4]
- Zone: an instance in the dashboard with a unique zone ID, normally one registrable domain and its subdomains.[4]
- Seat: “an employee, agent, contractor, or other third party, in each case, authorized by you to use a Cloudflare Service”.[4]
- Request: a single HTTP/S request received at Cloudflare’s edge; for the developer platform, one that invokes a Worker or Durable Object.[4]
- Custom hostname, Neuron (machine-learning compute capacity) and Storage, measured as the average hourly amount stored in a monthly billing period.[4]
Product price pages add their own billing units, such as CPU milliseconds for Workers and GB-months for R2 storage.[9][15]
Counting / floors
Each domain on a plan is one billed unit. Cloudflare issues a separate invoice line for every domain in an account, and “Subdomains do not count as billable domains.”[5] A subdomain becomes a separate billable domain only if it has to be managed separately and gets its own zone ID.[4] Catalog proof: Subdomains are not billable domains; A separately managed subdomain counts as a separate domain.
For Zero Trust, a user consumes a seat on an authentication event and “will occupy and consume a single seat regardless of the number of applications accessed or login events”. Once the seats in the subscription are used up, further users who try to log in are blocked.[8] Gateway DNS-only use has a volume limit of 150,000 average monthly DNS queries per Seat, and Cloudflare may require more Seats above that.[7] Catalog proof: One seat per user, consumed on authentication; Gateway DNS-only is limited to 150,000 queries per Seat per month.
The developer platform has a floor of $5 per month per account on Workers Paid, which includes monthly usage allotments.[9] R2 rounds usage up to the next billing unit.[15] Free tiers do not convert into charges: on Workers Free, operations beyond a daily limit fail with an error.[9] Catalog proof: Workers Paid has a $5 monthly minimum per account; R2 usage is rounded up to the next billing unit.
Virtualization & partitioning
Cloudflare does not license per processor, core, server or virtual machine, so the partitioning rules described in virtualization and partitioning do not apply. The nearest equivalent is how an estate is split into zones. In general a zone covers one registrable domain and all of its subdomains, unless a subdomain needs different performance or security settings and is given its own zone ID.[4] Splitting a domain into several zones can therefore increase the number of billable domains.
Cloud / BYOL
There is no bring-your-own-licence model, because the services run on Cloudflare’s own network. Two scope limits matter instead. First, unless authorized in writing, Cloudflare Services “are for use only with Zones that are associated with Domains owned by Customer”; a customer may not configure zones for its end customers’ domains.[4] Second, the Free, Pro and Business CDN may not be used to serve video or a disproportionate share of large files without specific Paid Services such as the developer platform, Images or Stream; Enterprise customers are not subject to this restriction.[14] Cloudflare’s China Service is operated by its partner JD Cloud, and customers must accept that partner’s terms.[4] Catalog proof: Zones only for domains the customer owns; Free, Pro and Business CDN may not be used to serve video or large files.
Programs
- Self-serve subscription. Bought in the dashboard with a payment card under the Self-Serve Subscription Agreement. Paid subscriptions renew automatically at then-current rates and fees are non-refundable.[2]
- Enterprise Subscription. Bought on an Order Form under the Enterprise Subscription Agreement, invoiced annually in advance unless the Order Form says otherwise, with 12-month Renewal Terms by default.[3]
- Purchase through Reseller. The customer signs Order Forms with an authorized reseller, and Cloudflare’s payment terms do not apply.[3]
- Workers Paid plan and Zero Trust Pay-as-you-go. Self-serve subscriptions for the developer platform and for Zero Trust.[9][1]
- Preview services. Contracted customers can try certain products for 30 days. A preview “is not an officially contracted service until you purchase it”.[12]
The two master agreements are compared in Cloudflare self-serve and enterprise subscription agreements.
Compliance and measurement
Cloudflare meters use of its services itself, and neither master agreement contains a customer licence audit clause. Under the Enterprise Subscription Agreement, Cloudflare may invoice separately for use above the usage caps in the Order Form, and “Cloudflare’s measurement of Customer’s use of the Services is final”.[3] The customer also warrants that the network-usage information it gave to obtain a price quote, including bandwidth, number of domains, user locations and SSL requirements, is truthful, accurate and complete to the best of its knowledge.[3] Catalog proof: Use above Order Form usage caps is invoiced; Cloudflare measurement is final.
Compliance work therefore centres on three questions: which domains and zones sit on which plan, how many users hold Zero Trust seats, and what metered usage costs. Self-serve usage charges are billed in arrears for the previous billing period, and combined usage can trigger one mid-cycle threshold invoice per account; Enterprise accounts are not subject to threshold billing.[10][11] Revoking a Zero Trust user ends sessions but does not free the seat; only removing the user does.[8] Products enabled as previews show up on the Account Subscriptions page with the Terms value “NOT IN CONTRACT”.[12] Catalog proof: Self-serve usage can trigger a one-time mid-cycle threshold invoice; Revoking a user does not free the seat.
Service levels are a separate commercial lever. Under the Enterprise SLA, Service Credits are the sole remedy for missed service levels and are capped at six months of Monthly Fees paid in an annual billing period.[13] Catalog proof: Enterprise Service Credits are capped at six months of fees per year.
Out of scope
This page does not cover the Cloudflare Registrar and its Domain Registration Agreement, Professional Services, Cloudflare hardware such as the WAN Connector appliance, third-party apps bought through Cloudflare’s app marketplace, or the open-source projects Cloudflare publishes, which carry their own licences. Network services such as Cloudflare WAN are sold on enterprise contracts and are not covered in detail.