In the Cloudflare free vs Pro decision, most small business and blog sites can stay on Free. It already gives you the CDN, Universal SSL, unmetered DDoS protection, a free managed WAF ruleset, 5 custom firewall rules and 10 cache rules. Pro ($20 a month billed annually, $25 monthly) is worth it when you need the full Cloudflare Managed Ruleset, Polish image compression, Super Bot Fight Mode or proper support tickets.
“Do I need to pay for Pro?” is the first question most site owners ask when they move a domain onto Cloudflare. The plans page lists features as ticks and dashes, which doesn’t tell you much about what changes on a real WordPress or WooCommerce site.
So we went through Cloudflare’s own documentation, plan by plan, and pulled out the limits that matter for a typical business website. Below you’ll find what the free plan really includes, the exact rule limits, what Pro adds, and a simple way to decide. Every number here comes from Cloudflare’s docs or plans page, linked at the end.
Cloudflare free vs Pro at a glance
Here are the limits we check most often when setting up a client zone. Prices and limits are per domain (Cloudflare calls a domain a “zone”), except where noted.
| Feature | Free | Pro | Business |
|---|---|---|---|
| Price | $0 | $20/mo yearly, $25/mo monthly | $200/mo yearly, $250/mo monthly |
| CDN, Universal SSL, unmetered DDoS protection | Yes | Yes | Yes |
| WAF managed rules | Free Managed Ruleset only | Adds Cloudflare Managed Ruleset and OWASP Core Ruleset | Same as Pro |
| WAF custom rules | 5 | 20 | 100 |
| Rate limiting rules | 1 (10 s period, IP only) | 2 (up to 60 s period) | 5 (up to 10 min period) |
| Cache rules | 10 | 25 | 50 |
| Single redirect rules | 10 | 25 | 50 |
| Page Rules (deprecated) | 3 | 20 | 50 |
| Polish image optimization | No | Yes | Yes |
| Bot protection | Bot Fight Mode | Super Bot Fight Mode | Super Bot Fight Mode |
| Max upload size per request | 100 MB | 100 MB | 200 MB |
| Support cases | Billing, account and registrar only | Full support cases | Cases plus live chat |
| Uptime SLA | No | No | 100% |
Two things stand out. First, the core features most people sign up for (the CDN, free SSL and DDoS protection) are the same on every plan. Second, Pro mostly buys you more security rules, image compression and someone to talk to, not a faster site out of the box.
What the Cloudflare free plan includes
CDN and caching
The free plan caches your static files (CSS, JavaScript, images, PDFs and similar) at Cloudflare’s edge. One point trips people up: Cloudflare does not cache HTML or JSON by default, on any plan. Your pages are still generated by your host on every visit unless you tell Cloudflare otherwise.
You get 10 cache rules on Free, which is enough to cache HTML for a brochure site or exclude paths like /wp-admin/, /cart/ and /my-account/. The maximum cacheable file size is 512 MB on Free, Pro and Business alike.
Universal SSL
Every plan gets a free Universal SSL certificate. It covers your root domain and first-level subdomains, so example.com and www.example.com or shop.example.com are fine, but dev.shop.example.com is not. For deeper subdomains you need Total TLS or an advanced certificate from Advanced Certificate Manager, which is a paid add-on.
The certificate only covers the connection between the visitor and Cloudflare. The connection from Cloudflare to your server still needs its own certificate, which is where most SSL problems start. If your site ends up in a redirect loop after switching, our guide to fixing the Cloudflare too many redirects error walks through the SSL modes.
Security: DDoS, WAF and bots
DDoS protection is unmetered on all plans. On top of that, Free includes:
- Cloudflare Free Managed Ruleset, which Cloudflare describes as protection against “high-impact and widely exploited vulnerabilities”.
- 5 WAF custom rules, enough to block a country, challenge requests to
wp-login.phpandxmlrpc.php, and block a couple of bad user agents. - 1 rate limiting rule, with a fixed 10 second counting period and 10 second block, counted per IP.
- Bot Fight Mode, a simple on/off switch under Security > Settings, filtered by “Bot traffic”.
Bot Fight Mode can’t be bypassed with WAF custom rules or Page Rules, and Cloudflare warns it may challenge API or mobile app traffic. If a payment gateway webhook, uptime monitor or app stops working after you turn it on, this is the first switch to check.
Rules and redirects
Free includes 10 single redirect rules per zone, plus Bulk Redirects at account level (15 bulk redirect rules, 5 lists and up to 10,000 URL redirects across lists). That is plenty for an http to https, non-www to www, or old-URL-to-new-URL migration.
Page Rules still appear in many tutorials, but Cloudflare now marks them as deprecated. You get 3 on Free. For new setups, use Redirect Rules and Cache Rules instead, which give you far more on the free plan.
Cloudflare free plan limits to watch
These are the limits that actually cause problems on client sites, roughly in the order we run into them.
- 100 MB upload limit. Any single request through the proxy is capped at 100 MB on Free and Pro. Large plugin uploads, backup restores or video uploads through WordPress can fail. The usual fix is to upload via your host’s file manager or SFTP, or to temporarily grey-cloud the record.
- No HTML caching unless you add a rule. Out of the box, Cloudflare won’t make a slow host fast. You need a cache rule (or Cloudflare’s APO add-on for WordPress, listed at $5 a month on Free) to serve pages from the edge.
- Only 5 custom rules and 1 basic rate limit. Fine for one site with simple needs. An online store dealing with card-testing bots or login attacks can run out fast.
- Limited support. Free users can only open cases for billing, account and registrar issues. Technical help is the Community forum and Discord.
- Large files and video. Cloudflare’s terms prohibit streaming video through the standard CDN, and it may step in if a site serves “a disproportionate amount of large files without using the appropriate paid service”. Host video on YouTube, Vimeo or Cloudflare Stream instead.
Moving a domain’s DNS to Cloudflare can break email if mail records get proxied. Before you switch, read how to move DNS to Cloudflare without breaking email.
What Cloudflare Pro adds, and when it’s worth it
Pro is $20 a month billed annually or $25 billed monthly, per domain. Here’s what you actually get for that.
Free
Best for: blogs, brochure sites, small stores on decent hosting
- CDN, Universal SSL and DDoS protection
- Free Managed Ruleset and 5 custom rules
- 10 cache rules, 10 redirect rules
- Bot Fight Mode
Pro
Best for: busy stores, sites under attack, image-heavy sites
- Cloudflare Managed Ruleset and OWASP Core Ruleset
- 20 custom rules, 2 rate limiting rules
- Polish image compression
- Super Bot Fight Mode and full support cases
Better WAF coverage
The biggest real upgrade. Pro adds the Cloudflare Managed Ruleset and the OWASP Core Ruleset on top of the free ruleset. Cloudflare notes that if you run the Cloudflare Managed Ruleset, you don’t need the free one, because it covers more. For a WooCommerce store or a site that’s been hacked before, this is the main reason to pay.
Super Bot Fight Mode
Instead of one on/off switch, you choose an action for “Definitely automated”, “Likely automated” and “Verified bots” traffic, with options for static resource protection and an “Optimize for WordPress” setting. Unlike the free version, you can exempt traffic with a Skip custom rule, which solves the webhook problem above.
Polish image optimization
Polish compresses images at the edge, and it’s only on Pro and above. If your images are already compressed by a WordPress plugin or your theme, the gain is small. If your client uploads 5 MB photos straight from a phone, it helps.
Upgrade to Pro if
- You run a store and see login, checkout or card-testing attacks
- You’ve used all 5 custom rules and still need more
- Bot Fight Mode blocks a service you can’t exempt
- You want technical support tickets from Cloudflare
Stay on Free if
- You want speed: caching rules are free, Pro won’t fix a slow host
- Your images are already optimised
- You only need SSL, DNS and basic protection
- You need a bigger upload limit (Pro is still 100 MB)
Is the Cloudflare free plan enough for WordPress?
For most WordPress sites we look after, yes. A sensible free setup looks like this:
- Set SSL/TLS to Full (strict) with a valid certificate on your server. If cPanel’s AutoSSL fails once the proxy is on, see our fix for AutoSSL not working with Cloudflare.
- Add one WAF custom rule that challenges
/wp-login.phpand blocks/xmlrpc.phpif you don’t use it. - Use your single rate limiting rule on the login URL.
- Add cache rules to bypass
/wp-admin/and, for WooCommerce, cart, checkout and account pages. - Turn on Bot Fight Mode, then test forms, payments and any connected apps.
After any caching change, purge Cloudflare’s cache along with your WordPress cache plugin. If edits still don’t appear, our guide on clearing caches in the right order covers each layer.
Cloudflare’s plans and limits change from time to time. Check the Availability tables in the docs (linked below) before you build a setup that depends on an exact number of rules.
Start every site on the Cloudflare free plan. It covers the CDN, SSL, DDoS protection and enough rules for a typical WordPress site. Move to Pro when security, not speed, becomes the problem: you need the full managed WAF, more custom rules, Super Bot Fight Mode exceptions or real technical support.
Frequently asked questions
Is Cloudflare really free forever?
Yes, the Free plan is listed at $0 a month with no time limit. Paid extras such as APO, Argo Smart Routing or Advanced Certificate Manager are optional add-ons.
Does Cloudflare Pro make my website faster?
Not much on its own. The CDN is the same on every plan. Pro adds Polish image compression, which helps image-heavy pages, but HTML caching is done with cache rules, which you can create on Free.
How many firewall rules do you get on the Cloudflare free plan?
Five WAF custom rules and one rate limiting rule per domain, plus the Cloudflare Free Managed Ruleset. Pro raises this to 20 custom rules and 2 rate limiting rules.
Can I use Cloudflare free with WooCommerce?
Yes. Make sure cart, checkout and account pages are never cached, and test your payment gateway after turning on Bot Fight Mode, since it can challenge automated requests such as webhooks.
What is the Cloudflare free plan upload limit?
100 MB per request on Free and Pro, and 200 MB on Business. Upload larger files through your host’s file manager or SFTP instead.
Sources: Cloudflare plans; WAF custom rules; Rate limiting rules; WAF managed rules; Cache Rules; Default cache behavior; Redirects; Page Rules; Universal SSL; Polish; Bot Fight Mode; Super Bot Fight Mode; Contacting Cloudflare Support; Delivering videos with Cloudflare. Checked October 2026.
More in Comparisons
Best Free WordPress Caching Plugin: 4 Options Compared
Which free WordPress caching plugin should you install? LiteSpeed Cache, WP Super Cache, W3 Total Cache and WP Fastest Cache compared by host, features and limits.
Rank Math vs Yoast SEO: Which Free Plugin Should You Use?
Rank Math vs Yoast SEO: what each free plugin includes, what costs extra, how to switch, and which one suits your WordPress site best in 2026.
Elementor Free vs Pro: What You Actually Get for the Money
Elementor free vs Pro compared: what the free plugin covers, what each Pro plan adds, real 2026 prices, free workarounds, and which plan fits your site.