Cloudflare Free Plan Limits: What You Really Get

Almost every article about Cloudflare free plan limits is really an article about upselling you to Pro. The genuine restrictions are duller and more useful than that: a fixed number of rules, a set of features held back for paid tiers, and one clause in the terms of service that almost nobody reads.

The thing that actually catches WordPress owners out is not a cap at all. It is that Cloudflare does not cache your HTML by default, on any plan, so people switch it on, see no change in Time to First Byte, and conclude the free tier is throttled. It is not. It is doing exactly what it says it does.

This post covers what is capped, what is genuinely missing, what the terms say about bandwidth, and the specific symptoms that justify paying. If you want the money side of the argument instead, the effective cost per GB of Cloudflare’s CDN is worked through separately.

What the Cloudflare free plan actually includes

The free plan includes the full global CDN, unmetered DDoS protection, Universal SSL, DNS, the free managed WAF ruleset, and Cache Rules, with no published limit on requests or bandwidth. Cloudflare’s own plan comparison lists unmetered DDoS protection, CDN, Universal SSL and the free managed ruleset as present at every tier, including $0.

What is capped is configuration surface. You get three Page Rules instead of twenty. Five custom WAF rules instead of a hundred. Ten Cache Rules instead of three hundred. Nothing about the delivery network itself is slower or smaller.

The one-line version: upgrade when you run out of rules, need image optimisation you cannot do in WordPress, or need an uptime SLA in a contract. Traffic volume alone is not a reason.

Cloudflare free plan limits compared with Pro, Business and Enterprise

Here is the master table, with every figure taken from Cloudflare’s own documentation rather than from a competitor’s summary. Where Cloudflare does not publish a per-plan number, the cell says so instead of guessing.

Limit or feature	Free	Pro	Business	Enterprise
Price	$0	$20/mo billed annually, $25/mo monthly	$200/mo billed annually, $250/mo monthly	Custom, billed annually
Custom WAF rules	5	20	100	1,000
Custom rulesets (zone)	1	2	5	10
Cache Rules	10	25	50	300
Page Rules (legacy, deprecated)	3	20	50	125
Max cacheable object size	512 MB	512 MB	512 MB	5 GB by default
Max upload / request body size	100 MB	100 MB	200 MB	500 MB and above
HTML cached by default	No	No	No	No
DDoS protection	Unmetered	Unmetered	Unmetered	Unmetered
Uptime SLA	None	None	100%, 1x service credits	100%, 10x standard or 25x premium credits
SSL	Universal SSL only	Universal SSL	Universal SSL plus custom certificate options	Full certificate control
Image optimisation (Polish, Images)	Not included	Paid feature set	Paid feature set	Paid feature set
Support	Community and ticket, no published response time	Ticket	Chat added	Named account team, 24/7

Page Rules are the old system, Rules are the new one

Most competing articles still describe the free plan as “three Page Rules and that is your lot”, which has been wrong for a while. Cloudflare has split Page Rules into separate Rules products, and Page Rules are now documented as deprecated.

The practical effect is that the free plan is far less cramped than its reputation. Caching behaviour now belongs to Cache Rules, where free gets ten, and redirects, header transforms and origin rules each have their own allowance. If you are still burning one of your three Page Rules on a cache setting, you are using a deprecated product to hit a limit you do not need to hit.

Is Cloudflare’s bandwidth really unlimited?

Yes for normal web traffic, and there is no published GB cap on the self-serve plans, but the terms restrict using the CDN predominantly for large non-HTML files. This is the single most misreported part of the free plan, in both directions: people either believe it is a trap, or they believe they can host a video library on it.

The relevant text lives in Cloudflare’s service specific terms for application services, in the section headed “Content Delivery Network (Free, Pro, or Business)”. It states that Cloudflare offers specific paid services, naming the Developer Platform, Images and Stream, that you must use in order to serve video and other large files via the CDN. It reserves the right to disable or limit CDN access where the service is used to serve video or a disproportionate percentage of pictures, audio files or other large files.

Read that carefully. It is not a bandwidth cap, and it is not aimed at a busy blog with a lot of images. It is aimed at using a free HTML-oriented CDN as an origin-free file host: video, disk images, game assets, software distribution.

An enforcement conversation, when it happens, is normally an email pointing at the clause and asking you to move the offending traffic to a product designed for it. The legitimate alternatives are R2 for object storage with no egress fees, Stream for video, or an Enterprise contract that prices the traffic properly. Nobody nukes a WordPress site over a 40 MB PDF.

Workers on free versus paid

The Workers free tier gives you 100,000 requests per day, resetting at midnight UTC, with 10 ms of CPU time per invocation. Those quotas are independent of your CDN plan: a zone on the free plan and a zone on Business get the same Workers allowance, because Workers is billed as its own product.

Workers limit	Free	Paid
Requests	100,000/day, reset at midnight UTC	No daily cap, billed per request
CPU time per invocation	10 ms	Up to 5 minutes, 30 seconds by default
Script size after gzip	3 MB	10 MB
Subrequests per invocation	50	Substantially higher
Memory per isolate	128 MB	128 MB
Environment variables	64 per Worker, 5 KB each	128 per Worker, 5 KB each
Workers per account	100	500

The limit that bites first is CPU time, not requests. Ten milliseconds is generous for a header rewrite, a redirect map or a bot check, and tight for anything that parses a large HTML body or does cryptography. The 50-subrequest ceiling matters if you are stitching together several origin calls per page. Full figures are on the Workers platform limits page, which is worth checking directly because these numbers move.

What the free plan genuinely does not give you

Five things are missing that WordPress owners routinely assume are included. None of them are bandwidth or speed.

• Image optimisation. Cloudflare’s own image products are not part of the free plan. Free will cache and serve your images; it will not recompress them or convert them to modern formats for you.
• WAF beyond the basics. You get the free managed ruleset and five custom rules. You do not get the full managed rulesets, and five rules disappears quickly once you are blocking specific bots, paths and countries by pattern.
• Fast configuration and purge behaviour. Free plan setting changes and cache purges propagate, but higher tiers get quicker and more granular purge options. If you publish twenty times a day and need the change live everywhere immediately, that gap is real.
• Prioritised support. There is no published response-time commitment on free. When something is broken at 2am, you have the community forum and a ticket queue.
• Per-hostname certificate control. Universal SSL covers the apex and one wildcard level. Uploading your own certificate, or controlling certificates per hostname, is not a free-plan capability.

Why your WordPress site is not being cached on the free plan

Because Cloudflare does not cache HTML by default, and a WordPress page is HTML. The default cache behavior documentation says it plainly: the Cloudflare CDN does not cache HTML or JSON by default. It caches a long list of static extensions including CSS, JS, JPG, PNG, WEBP, SVG, WOFF2, PDF and MP4.

So the out-of-the-box result is that your theme files and images come from an edge close to the visitor, and every single page view still hits PHP on your origin. That is a useful offload. It is not page caching, and it will not move your TTFB much.

On the free plan Cloudflare is a security and delivery layer, not a page cache. It becomes a page cache only when you explicitly tell it to be one.

Turning on HTML caching without breaking logged-in users

You do this with a Cache Rule set to eligible for cache, and the entire difficulty is in the exclusions. Cache a logged-in page or a WooCommerce cart at the edge and you will serve one visitor’s session to everyone.

The bypass condition needs to cover, at minimum, the WordPress login cookie, the WooCommerce cart and session cookies, and the admin, cart, checkout and account paths. An expression along these lines, used as a bypass cache rule ordered above your cache-everything rule:

(http.cookie contains "wordpress_logged_in_")
or (http.cookie contains "wp-postpass_")
or (http.cookie contains "comment_author_")
or (http.cookie contains "woocommerce_items_in_cart")
or (http.cookie contains "wp_woocommerce_session_")
or (starts_with(http.request.uri.path, "/wp-admin"))
or (starts_with(http.request.uri.path, "/wp-login.php"))
or (starts_with(http.request.uri.path, "/cart"))
or (starts_with(http.request.uri.path, "/checkout"))
or (starts_with(http.request.uri.path, "/my-account"))
or (starts_with(http.request.uri.path, "/wp-json"))

Adjust the paths for your permalink structure and language prefixes. Ten Cache Rules on free is plenty for this: one bypass rule, one cache-everything rule with an edge TTL, and you still have eight spare.

Reading cf-cache-status

The cf-cache-status response header tells you what the edge did with the request, and it is the only honest way to check whether any of the above is working. Fetch headers for a page you are not logged into:

curl -sI https://example.com/ | grep -i 'cf-cache-status\|cache-control\|age\|cf-ray'

# run it twice; the first request warms the edge, the second shows the real state

Value	What it means	What to do about it
HIT	Served from the Cloudflare edge without touching your origin	Nothing. This is the goal.
MISS	Eligible for cache, but this edge did not have it and fetched from origin	Normal on first request. Persistent MISS means your origin is sending no-store or a short max-age.
DYNAMIC	Not eligible for cache at all, so Cloudflare passed it through	This is what an untouched WordPress HTML page returns. You need a Cache Rule.
BYPASS	Eligible, but a rule, cookie or header told Cloudflare not to serve from cache	Expected on cart and admin. Unexpected elsewhere means your bypass expression is too broad.
EXPIRED	The cached copy was stale, so Cloudflare revalidated with your origin	Fine occasionally. Constant EXPIRED means your TTL is shorter than your traffic pattern.

If you are seeing BYPASS where you expect HIT, the cause is almost always a cookie your rules did not anticipate, and there is a full walkthrough of diagnosing Cloudflare cache bypass that goes through the usual suspects. If you would rather not read headers by hand, the free Cache Inspector in the WPColt toolbox checks page cache, server cache and CDN layers together and tells you which one is actually answering.

Upgrade triggers: the symptom, and the plan that fixes it

Upgrade when a specific limit is blocking a specific task, not when your traffic grows. Here are the triggers that hold up.

Symptom you can name	Plan that fixes it
You have written five custom WAF rules blocking scrapers and abusive paths by pattern, and you need a sixth	Pro (20 rules) or Business (100)
You need the full managed WAF rulesets, not just the free managed ruleset	Pro and above
Your users upload files between 100 MB and 200 MB through WordPress and requests fail at the edge	Business (200 MB request body)
A client contract or procurement form requires a written uptime SLA	Business (100% SLA with service credits)
You must upload and control your own TLS certificate	Business or Enterprise
You need a support channel with a person on the other end during an incident	Business (chat) or Enterprise (account team)
You need to cache objects larger than 512 MB	Enterprise
Your egress is mostly video or large binaries	Not a plan change: move to Stream, R2 or Enterprise

The most common bad reason to buy Pro is image optimisation. Paying $20 a month so a CDN can recompress images it did not create is backwards when the images are generated by your own CMS. Converting and sizing them properly at upload time with one of the WordPress WebP plugins gives you smaller files on every layer, including your origin and your backups. If you want a sense of the size reduction available before you spend anything, the ShortPixel write-up covers what a compression pass actually removes.

Misconceptions worth killing

Four beliefs about the free plan survive mainly because they are repeated, not because they are true.

“Free traffic gets slower routing”

Free zones use the same anycast network and the same edge locations. What paid tiers can add is Argo Smart Routing, a separately priced usage-based add-on that routes requests over less congested paths between Cloudflare data centres. That is an optimisation on top of the standard network, not the removal of a handicap. Free is the standard, not a degraded version of it.

“Free plans are dropped first during an attack”

DDoS protection is listed as unmetered on every plan including free, and Cloudflare’s public position has been consistent for years that it does not meter or bill attack traffic by plan. What paid tiers buy is more control during an attack: more custom rules, more managed rulesets, better analytics to see what is happening, and someone to talk to.

“Unmetered DDoS protection means nothing can take my site down”

It means volumetric attacks are absorbed at the edge without a bandwidth bill. It does not mean application-layer abuse stops reaching your origin. A slow, well-formed crawl of your WooCommerce filter URLs will happily exhaust PHP workers while every DDoS metric stays flat, because it does not look like an attack. That is what rules and caching are for.

“Cloudflare replaces my caching plugin”

It does not, and this is the one that costs people the most performance. Cloudflare caches at the edge for anonymous visitors. A page cache on the origin serves the request that reaches your server anyway, including every MISS, every BYPASS and every logged-in view. The two layers do different jobs, which is the same argument as the one about running Varnish alongside a WordPress page cache.

Verdict: which plan for which site

For the large majority of WordPress sites the free plan is the correct plan, not a trial you are supposed to grow out of. Here is where I would put specific profiles.

• Blog, portfolio, brochure site, small publisher. Free, permanently. Add one bypass Cache Rule and one cache-everything rule and you have most of what Pro would give you. Spend the $20 on hosting or images instead.
• Membership or community site. Free is fine, but the edge will bypass most of your traffic because those users are logged in. Your money belongs in origin caching and object caching, not in a CDN tier.
• WooCommerce store, moderate catalogue. Free until you run out of custom WAF rules fighting scrapers and card testers, then Pro. Cache category and product pages, bypass cart, checkout and account.
• Agency or SaaS marketing site with a procurement process. Business, for the SLA and certificate control, which you are buying as contract terms rather than as speed.
• Course platform or download site with heavy media. No plan tier fixes this. Move the media to object storage or a video product and keep the site itself on free.

The one thing worth doing today, whichever plan you are on, is checking what cf-cache-status says on your own home page. If it says DYNAMIC, you do not have a plan problem. You have an unconfigured cache, and that is free to fix.

Frequently asked questions