Book a Call
Cloudflare

Cloudflare, configured by people who operate it every day

Caching that holds, bot defense that does not block your customers, and a rules architecture someone can still understand next year. On a five-page site or a national platform.

  • 120M+ monthly requests served through Cloudflare
  • 5M+ monthly page views on one platform
  • 230+ chapter sites behind a single edge
  • ~1.5 MB cut from first-visit page weight

Figures from the SCORE.org platform we build and operate. Read the case study →

What We Do

The parts most configurations get wrong.

Cloudflare is easy to turn on and hard to get right. Almost every account we inherit is caching too little, blocking the wrong things, or carrying five years of rules nobody has read since.

Edge caching that actually holds

Most sites on Cloudflare cache almost nothing beyond images and CSS. Getting HTML cached safely — with correct bypass for logged-in users, carts and previews — is where the performance and the cost savings live.

Traffic and bot defense

Tiered enforcement: cache first, verified bots allowed on their merits, junk paths answered cheaply, challenges and rate limits scoped to the routes that are actually expensive.

WAF and rules architecture

Managed rulesets tuned to the application rather than left at defaults, custom rules that survive a redesign, and redirect logic that does not quietly exceed platform limits.

Purge strategy

Publishing has to invalidate the right things and nothing more. Aggressive purging turns a cheap request back into an expensive one and can create the traffic surge it was meant to prevent.

DNS, TLS and email authentication

Migrations without downtime, SPF, DKIM and DMARC that survive the move, and a records set someone can still understand a year later.

Workers and Pages

Static delivery, edge redirects, and small pieces of logic run at the edge instead of at origin — including the site you are reading, which is Astro on Cloudflare Pages.

Which Plan You Actually Need

Most sites need less than they are sold.

Cloudflare's free tier is unusually generous, and a lot of what matters is in it. Knowing where the real lines fall saves money more often than it spends it — and the strongest pieces are not on the plan ladder at all.

Free plan

Brochure sites, small business, anyone starting out

  • Global CDN and caching
  • Unmetered DDoS protection
  • TLS certificates
  • A managed WAF ruleset
  • Cache, redirect and transform rules
  • Basic bot filtering

Genuinely useful. Most small sites never need to leave it, and the ones that do usually need one specific thing rather than the whole tier.

Pro and Business

Growing sites, ecommerce, content platforms

  • Image optimization
  • More WAF and rate-limiting rules
  • Better analytics retention
  • Advanced caching controls

This is where scoped rate limits and route-specific rules stop being a squeeze against rule counts.

Enterprise

National platforms and high-traffic fleets

  • Bot Management with bot scoring
  • Verified-bot identity as a field you can write rules against
  • Advanced rate limiting
  • Custom certificates, SLAs and support

The line worth knowing: bot scoring is Enterprise. Below it you can still verify a crawler properly, it just takes a reverse DNS check rather than a one-line rule.

Add-ons

Priced separately — any plan, including free

  • Workers — code at the edge, free up to 100k requests a day
  • Pages — static hosting and build pipeline, free for unlimited sites
  • R2 — object storage with no egress fees
  • Images — storage, optimization and delivery variants
  • Stream — video hosting, encoding and delivery
  • Image optimization for media already on your origin

These are products, not plan levels — you can run Workers and R2 on a free account. R2 is the one that changes budgets: object storage with zero egress charges, against the per-gigabyte bill that makes media-heavy sites expensive on S3.

Plan limits move around — check Cloudflare's current pricing rather than this page. The shape of the split has been stable for years: the cheap layers are free, precise identification is paid.

In Production

A national platform on one edge.

SCORE.org is the front door for America's largest network of volunteer business mentors — 230+ local chapters, one multi-tenant platform, delivered globally through Cloudflare. It serves more than 5 million page views and 120 million requests a month, with content flowing in from Salesforce and publishing within seconds.

We have been SCORE's technology partner since 2016 and webmaster for 160+ chapters. The operations tooling built to run that fleet — fleet health, cache verification, guarded production actions — became a product of its own.

Read the SCORE case study → Explore ControlPlane
Further Reading

How we think about traffic at the edge.

Support & Security Your Website Traffic Is More Bot Than Human

Roughly 75% of the requests to this site over eight days did not come from a browser. What a tiered defense looks like, and how much of it you can do on a free plan.

Read the article →
Questions

What people ask first.

Do we need to move hosting to work with Cloudflare?

No. Cloudflare sits in front of whatever you already run — WordPress on a VPS, a static site, a Shopify store, an application server. Changing hosts and adopting Cloudflare are separate decisions, and doing both at once is usually a mistake.

Is the free plan really enough?

For a lot of sites, yes. Caching, DDoS protection, TLS and a managed ruleset cover most of what a small site needs. What you pay for is precision — more rules, better analytics, and at the top end the ability to identify bots by score rather than by user agent.

Will caching break my site?

It breaks sites when it is applied without care, which is why most sites cache nothing but assets. Doing it properly means being explicit about what must never be cached — sessions, carts, admin, previews — and then being aggressive about everything else.

Can you work with our existing team?

Usually the best arrangement. We are often brought in to design the edge architecture and hand it over, or to review a configuration that grew organically and nobody fully owns any more.

What if we are already on Cloudflare and it is a mess?

That is the common case. Page rules layered over redirect rules layered over Workers, added by three different people over five years. An audit that documents what each rule does, what it can safely be replaced by, and what is silently doing nothing is usually the first piece of work.

Want a second pair of eyes on your Cloudflare setup?

Send us the domain. We'll tell you what is cached, what is not, and what the configuration is quietly costing you.

Book a Cloudflare Review →