Fifteen years of Cloudflare: what a network company got right before everyone else

This blog runs on Cloudflare Pages, in front of a Worker, behind their nameservers. It costs me almost nothing, it has never been the reason a reader could not reach a post, and I have never once had to think about a region, an instance size, or a load balancer. That is the pitch, and after nine years of using their products I still find it slightly unreasonable that it works.

So this is a seven part series, and I should say the bias out loud at the start: I am a fan. This first post is the appreciative one. The six that follow are about their products, vision and tools, particularly. Each takes one recent Cloudflare launch, works out what problem it actually solves, checks who else solves it, and says plainly where the competition is ahead. If a thing is good I will say so. If it is a beta with holes in it I will say that too.

The pattern: give away the thing everyone else is charging for#

Cloudflare launched publicly at TechCrunch Disrupt on 27 September 2010, out of a spam-tracking side project called Project Honey Pot that Matthew Prince and Lee Holloway had started in 2004.¹ The company priced its IPO at $15 a share on 12 September 2019 and began trading on the NYSE the following day.²

The move that told you what kind of company it was going to be came in 2014. On 29 September that year, Cloudflare turned on Universal SSL for every customer including the free tier.³ At the time, HTTPS certificates cost money and required a dedicated IP address. Cloudflare used SNI to put many certificates on one IP and ECDSA to cut the CPU cost of the handshake, then gave it away. The number of HTTPS-capable sites on the internet roughly doubled overnight, from about two million to about four million.³

That is the pattern, repeated for a decade. Take something the industry treats as a premium line item, work out why it is expensive, “engineer the expense away”, then price it at zero and sell the layer above it.

• 1.1.1.1, launched 1 April 2018 with address space from APNIC, shipped DNS-over-TLS and DNS-over-HTTPS at a time when encrypted DNS was a research topic, with a commitment never to write querying IPs to disk and an annual third-party audit.⁴
• Encrypted Client Hello shipped across all plans on 29 September 2023, closing the last plaintext hole in TLS by hiding the destination hostname inside an encrypted inner ClientHello.⁵
• R2, announced 28 September 2021, charges $0.015 per GB-month and zero egress fees, aimed squarely at the cloud industry’s most resented charge.⁶

The R2 one deserves a caveat, because it is the claim people repeat most loosely. Zero egress is real and material, but R2’s Class A operations at $4.50 per million are not cheap, and in November 2025 AWS launched flat-rate CloudFront plans with no overage charges, which blunts a lot of the bill-shock argument for CDN-fronted workloads.⁷ The honest version of the claim is narrower than the marketing: R2 wins decisively for high-egress, low-operation workloads, and loses on plenty of others.

The engineering underneath#

What makes the giveaway sustainable is that Cloudflare keeps rewriting its own foundations rather than buying capacity.

Workers, launched 29 September 2017 by Kenton Varda, put JavaScript on the edge using V8 isolates rather than containers, and built on the W3C Service Workers API instead of inventing a proprietary hook model.⁸ An isolate starts roughly a hundred times faster than a Node process in a container and uses an order of magnitude less memory at startup.⁹ Cloudflare is also straight about the trade: isolates are not guaranteed to persist and can be evicted, so global mutable state is unsafe.⁹ Durable Objects, in beta from 28 September 2020, were the answer to that, giving you a globally unique, single-location object with transactional storage co-located with the compute.¹⁰ Almost every product in the rest of this series is built on those two primitives.

Pingora is the one I find most impressive as pure engineering. In September 2022 Cloudflare described replacing NGINX with a proxy they wrote in Rust, serving over a trillion requests a day with roughly 70% less CPU and 67% less memory than the setup it replaced.¹¹ The root cause they were chasing was mundane and beautiful: NGINX’s per-worker connection pools fragment reuse, so a request landing on the wrong worker opens a new upstream connection. One customer’s connection reuse went from 87.1% to 99.92%, a 160-fold drop in new connections.¹¹

And they are early on post-quantum in a way almost nobody else is. As of April 2026, over 65% of human traffic to Cloudflare is already post-quantum encrypted, with a published roadmap targeting full post-quantum security by 2029.¹² Most enterprises I talk to are still at the inventory stage.

The consistent thing across Universal SSL, 1.1.1.1, ECH and post-quantum is that Cloudflare keeps deploying security upgrades that individual site owners would never get around to, by making them the default at the layer above.

Scale, and what scale costs#

The network reaches 337 cities, sits within 50ms of 95% of the world’s internet users, holds more than 13,000 interconnections, and averages 102 million HTTP requests per second.¹³ Roughly one site in five on the internet sits behind it.¹⁴

That scale shows up most clearly in DDoS. In December 2025, Cloudflare mitigated a 31.4 Tbps attack that lasted 35 seconds, part of a campaign from the Aisuru-Kimwolf botnet running largely on infected Android TV devices, which across its run peaked at 9 billion packets per second and 205 million requests per second. It was detected and mitigated automatically, with no human in the loop.¹⁵ Across 2025 they mitigated 47.1 million DDoS attacks, an average of 5,376 an hour.¹⁵

The same scale is also the risk, and Cloudflare’s response to that is the part of their culture I would most like the rest of the industry to copy. When they break, they publish. On 18 November 2025 a database permissions change caused a ClickHouse query to return duplicate column metadata, which doubled the size of a Bot Management feature file, which exceeded a hard-coded 200-feature memory limit, which panicked the proxy. Core traffic stopped for five hours and forty-six minutes, and Matthew Prince wrote it up himself with the full causal chain and the sentence “in the last 6+ years we’ve not had another outage that has caused the majority of core traffic to stop flowing.”¹⁶ On 20 February 2026 a cleanup task in the Addressing API read an empty parameter as “delete all” and withdrew about 1,100 of 4,306 BYOIP prefixes for six hours.¹⁷

Those postmortems are better than most vendors’ marketing. They are also a reminder that when 20% of the web sits behind one control plane, a bad config push is a systemic event. The December 2025 “Code Orange: Fail Small” plan, which extends staged rollout controls to configuration changes and not just software, is the right correction, and it exists because the failure mode is structural rather than accidental.¹⁸

Pre-AI to post-AI#

The pivot is not the AI products, it is the traffic. In the second quarter of 2026, for the first time, more than half of the traffic on Cloudflare’s network was non-human.¹⁹ Their 2026 threat report puts 94% of all login attempts as bot-originated, with 63% of logins using credentials already compromised elsewhere within the previous three months.²⁰

A company that sells “protect and accelerate what humans request” has to become something else when humans are the minority. Cloudflare’s answer has two halves.

The first is economic. On 1 July 2025 they became the first major infrastructure provider to block AI crawlers by default on new domains, and launched Pay Per Crawl with more than forty publishers signed on.²¹ In September 2025 they extended robots.txt with a Content Signals Policy expressing not just whether content may be fetched but how it may be used.²² Then on 1 July 2026 they moved from Pay Per Crawl to Pay Per Use, paying publishers when content generates value in an AI answer rather than when a page is fetched, and set a 15 September 2026 deadline after which mixed-use crawlers that do not separate search from training from agent use get blocked by default on any page carrying advertising.²³ Their stated justification includes a detail worth sitting with: over half of AI crawler traffic re-fetches pages that have not changed.²³

The second half is the developer platform, which is where the rest of this series lives. Workers AI and AI Gateway launched together on 27 September 2023.²⁴ Agents Week in April 2026 shipped Sandboxes to GA, Durable Object Facets, Cloudflare Mesh, Agent Memory, Browser Run and about fifteen other things.²⁵ August 2026 added Cloudflare OS, AI Search, Kitesurf, Radar Researcher, WebMCP and Cloudflare Computer inside a single week.

Where I would push back#

Three things temper the admiration.

1. The financials are two different stories. Q2 2026 revenue was $696.1 million, up 36% year on year, with full-year guidance raised to roughly $2.87 billion.²⁶ That is excellent. GAAP operating loss in the same quarter was $205.7 million against non-GAAP operating income of $96.1 million, a gap driven substantially by the May 2026 restructuring in which Cloudflare cut 1,100 jobs, about 20% of the workforce, with Prince attributing it to AI-driven productivity gains.²⁷ You can believe the productivity story and still notice that “AI made these roles obsolete” is a convenient frame for a cost action, and that the company projecting more employees in 2027 than 2026 slightly undercuts it.

2. Concentration is a real security concern, not a theoretical one. If you are a CISO, the correct reading of 18 November 2025 is not “Cloudflare had an outage.” It is “our availability has a dependency we did not model, shared with a fifth of the internet, and our failover plan assumed the failure would be regional.” Multi-CDN is expensive and annoying. It is also the only answer to that specific question.

3. Competitors are closer than the fandom admits. Akamai’s EdgeWorkers documents sub-five-millisecond cold starts on a larger PoP footprint.²⁸ Fastly’s Compute uses a fresh WebAssembly instance per request, which is arguably a stronger isolation story than V8 isolates, and its free tier is more generous on request count.²⁹ AWS’s flat-rate CloudFront plans are a direct copy of Cloudflare’s pricing pitch.⁷ Cloudflare’s advantage is breadth and coherence. They do not hold a monopoly on any single capability in that list.

What comes next in this series#

Six posts, one product each, in no particular order, written the way I would evaluate or test them than the way I would tweet about them:

1. Cloudflare OS, the internal agent platform they open-sourced, and the capability model underneath it
2. AI Search, managed retrieval that bundles the parts you would otherwise assemble yourself
3. Kitesurf, a browser engine written from scratch for agents rather than people
4. Radar Researcher, natural language over fifteen years of internet measurement data
5. WebMCP, MCP Portal and WriteGuard, the governance layer for agent write access
6. Cloudflare Computer, the argument that giving every agent a container does not scale

The thread running through all six is the same one running through Universal SSL in 2014: work out what everyone is paying too much for, engineer the cost out, then make it the default.