What Cloudflare’s Free Plan Actually Gives You, and Why Almost Nobody Uses It

Most of the Cloudflare zones we audit are sitting on the free plan, proxied through Cloudflare’s network, and otherwise untouched since the day someone pointed the nameservers there. The orange cloud is on. Nobody has written a single custom rule. And in almost every case, the free plan itself was never the limiting factor. It has real capability sitting unused.

What the free plan actually gives you

Cloudflare’s free tier includes five custom WAF rules per zone, basic DDoS mitigation, SSL/TLS termination, CDN caching, and Bot Fight Mode. Five custom rules sounds small until you realise most small business sites only need three or four to close the gaps that actually get exploited: rate-limiting login attempts, blocking XML-RPC, restricting REST API write endpoints, and challenging traffic from known bad ASNs. None of that requires a paid plan. It requires someone who knows which five rules are worth writing.

Why almost nobody uses it

Turning Cloudflare on feels like finishing the job. The nameservers point there, the padlock shows up in the browser, and the default assumption is that “Cloudflare” and “protected” mean the same thing. They don’t. Cloudflare out of the box is a CDN and a basic DDoS shield. The actual security layer, the part that stops the specific attacks a WordPress or Astro site actually faces, lives in rules nobody wrote yet. We see this on client sites constantly: free plan, zero custom rules, Bot Fight Mode left on its default setting, and a firewall events log that has never been opened.

The audit conversation is almost always the same

When we onboard a new maintenance or hosting client, checking their existing Cloudflare configuration is one of the first things we do, and the pattern repeats often enough that we stopped being surprised by it. DNS-only or basic proxy mode, default security level, zero custom rules, Bot Fight Mode untouched since setup. It is not that these businesses made a bad decision. Nobody sold them the five rules they were entitled to, so nobody wrote them.

What a properly configured free-tier zone actually blocks

We cover the specific rule logic in more depth in our WAF rules post, but the short version: a rule matching /wp-login.php with rate limiting instead of an outright block, a rule blocking /xmlrpc.php entirely unless something specific needs it, and a rule restricting write methods against /wp-json/ to expected origins. On an Astro build, the equivalent is rate-limiting the handful of API routes that actually accept POST requests. None of this needs a Cloudflare subscription. It needs someone to sit down, look at what that specific site is actually exposing, and write the rules that match it.

Bot Fight Mode does less than its name implies

Bot Fight Mode is on by default for free-plan zones and it does genuinely reduce basic bot traffic, but it is a blunt instrument tuned for the average site, not the specific one it happens to be protecting. It cannot distinguish between a scraper hitting a WordPress site’s REST API and a legitimate service integration doing the same thing, because it has no visibility into what that specific site actually needs to allow. That distinction only comes from a human looking at the traffic and writing a rule that matches reality, which is exactly the five-rule budget most zones never touch.

The firewall events log is the free diagnostic nobody opens

Every Cloudflare zone, free tier included, logs every request the WAF and managed rules acted on: what was challenged, what was blocked, and why. It is one of the more useful pieces of security telemetry a small business site has access to, and in our experience almost nobody has ever looked at it. Reading that log for ten minutes tells you more about what is actually attacking a given site than any generic security checklist, because it is specific to that zone’s real traffic rather than a hypothetical average.

Where the free plan’s real ceiling is

Five custom rules is a real limit, and being honest about it matters more than pretending it doesn’t exist. Sites with more complex rule logic, Cloudflare’s own managed ruleset for known CVEs, advanced rate limiting across multiple endpoints, or Zero Trust access for a team all genuinely need a paid tier or an Enterprise-grade configuration. That is a real conversation we have when a site’s risk profile calls for it. But that conversation happens after we have actually used the five rules a free zone already gives you, not instead of using them. Most sites never get anywhere near that ceiling before they stop maintaining the zone at all.

What we actually do to a zone

Our Cloudflare Hardening engagement is a full zone audit: SSL/TLS and HSTS configuration, DNS hygiene review, bot and AI crawler policy, and a custom WAF rule set deployed for whatever platform the site actually runs on, not a generic template. Every deployment gets validated live from outside the network before we call it done, and the client gets a plain-English before-and-after report rather than a screenshot of a dashboard. It runs on Cloudflare’s free plan. No subscription requirement, no lock-in. If a specific site genuinely needs a paid tier, we say so and let the client decide, rather than defaulting to an upsell.

Configuration drifts, which is why it needs revisiting

A WAF rule set that was correct on deployment day does not stay correct forever. New plugins get installed, new API integrations get added, attack patterns shift, and a rule written for last year’s threat landscape can quietly stop doing its job. Our Cloudflare Management plan covers ongoing rule tuning, firewall event review, configuration drift checks, and a monthly report, specifically so the zone doesn’t slide back into the “turned on and forgotten” state it started in. This is the same logic behind why we run scheduled WordPress maintenance rather than a one-off cleanup: security is a process, not a single deployment.

The actual gap we’re selling

None of this is about pushing anyone toward a bigger Cloudflare bill. The gap we close is expertise and attention, not platform tier. A free Cloudflare zone with five well-written rules, sane SSL settings, and someone actually watching the firewall events log will stop more real attacks than a paid plan left on its defaults. If you want to see exactly where your own zone stands, our Cloudflare & Security page has the full breakdown: Hardening from $495 one-off, ongoing Management from $50 a month, and bespoke work for anything past that.