Cloudflare got my money, and I knew exactly what it was doing while it took it.
A free tier is the little pink tasting spoon at an ice cream shop. They hand it to you for nothing, the ice cream is good, and a minute later you’re paying for a cone. Nobody walks out holding only the spoon. Cloudflare’s free plan is the best tasting spoon I’ve ever been handed, and I’m still a little amazed at how well it worked on me. With 33 years in enterprise IT behind me, I know a come-on when I see one, and I bought anyway, because the product earned it.
How I ended up on Cloudflare in the first place
I didn’t go shopping for a CDN. I got pushed.
My site was getting hammered by bots, around 50,000 a day, and a lot of them weren’t coming from data centers you could block with one rule. They came from residential addresses, so you’d get hit from a thousand different houses at once. Then I had a breach. Malicious code got planted on one of my sites. My security stopped it, but it left tracks, and I wrote up the whole mess in my post on the WordPress supply-chain attack.
That makes me furious. Somebody bought a plugin I trusted and turned it into a weapon against hundreds of thousands of sites, mine included. Who does that to people?
So I moved everything behind Cloudflare. It was a pain in the ass. I’m technical, so I got through it, but it took time to figure out.
The bot traffic dropped off a cliff. Cloudflare spots those residential bots in a way I could never manage from inside WordPress. Its dashboard also shows me which bots hit my site and how hard. I’ve written about what that dashboard told me in Most of Your Website Traffic Was Never Human, and it still makes me angry how much of the web is machines poking at doors.
My domains went over too, close to twenty of them, in under ten minutes. DNS, security and caching all run through one place now. I’ve had nothing but good luck with it.
What does Cloudflare’s free plan include for a small website?
More than a lot of paid hosting add-ons. As of 2026, the free plan gives you DNS, a global content delivery network, a universal SSL certificate, unmetered DDoS protection, a free managed firewall ruleset, and five custom firewall rules of your own. There’s no time limit on it. You can run a site on it forever.
Five rules are plenty to build a nice little layer of security that catches most of the junk. Block the countries you’ll never sell a book in. Put a challenge in front of your login page. Use the rest to stop requests that go hunting for files WordPress sites leave lying around. For an author site with a few hundred real visitors a day, that covers the threats that come at you automatically.
Writers will feel the caching most. Cloudflare keeps copies of your pages on its servers around the world and hands visitors those copies, so your actual web host barely gets touched. My site scores 100 on Google PageSpeed every time I test it. That’s because of Cloudflare, and I’ll take credit for nothing else in that number. If you’ve ever stared at a red score in a Core Web Vitals audit and felt sick about it, caching is the first fix I’d reach for.
Traffic spikes stop mattering too. If a post of mine gets a million visits, it doesn’t touch my website. It touches Cloudflare. I don’t sit up wondering whether my host is about to fall over, and I love that.
Cloudflare also lets you host small static sites for free. I have three one-page portal sites up there, and they’re fast as hell.
How can a company afford to give all this away? They’re huge, they’ve got tons of spare capacity, and every free customer is a future paying one.
The tasting spoon worked on me
On a call with a friend, I put it this way: “The freebie, of course, is exactly what happened to me. I did the free, it worked fine, but I needed a little bit more, so then I started buying pieces.”
You give people enough that they like it, and then you get some money out of them. I called it brilliant on that call and I still think so.
Two things went on my bill. First came the advanced security, at $25 per site for the two sites I had on it then. That took me from five custom rules to twenty. Second came disk space, because I started parking video and audio files on Cloudflare’s storage. Both were optional. Both were cheap. Neither one felt like a trick, because I’d already run the free version and it worked fine.
A bad company hides the bill until you’re trapped. Cloudflare let me find out the product was good before it asked for a dime, and when it did ask, it asked for small amounts tied to things I could see.
I respect that. A lot of software companies can’t manage it.
A free tier is a tasting spoon. Nobody walks out of the shop holding only the spoon. – Richard LoweShare on X
When should a writer pay for Cloudflare Pro?
When five rules stop being enough, and not one day before.
As of 2026, Cloudflare Pro runs $20 a month per domain on annual billing or $25 month to month. You get twenty custom firewall rules instead of five, the full managed rulesets, image optimization, and more caching controls. Business is $200 to $250 a month, and no author website on earth needs it. Why would a novelist pay for PCI compliance paperwork and an uptime guarantee built for online stores?
If a consultant tells a novelist with a blog to buy the Business plan, walk away from that person.
My test is simple. Run the free plan for a month and look at the security events in the dashboard. If your five rules are catching what’s coming at you and the site is fast, you’re done, and you should feel good about spending zero. If you’ve been attacked, if you’re running a store or a membership area, or if you keep wishing you had a sixth and seventh rule, pay for Pro on that one site.
I paid because I needed the security. People had tried to hack me.
Anybody who logs into my WordPress admin now has to log into Cloudflare first and then log into the site. You go through Cloudflare’s front gate before you ever see my door. That setup was a little complicated, and it was worth every minute. Most writers don’t need to go that far. A writer who’s already been burned should.
Is Cloudflare hard to set up for a WordPress site?
Yes, a bit, and it’s hard for a better reason than its competitors.
I’ve used Amazon, Google and Microsoft for similar things, and they all suck because they’re complicated. Amazon is complicated because it’s Amazon. Google’s interface makes me want to ask who designed that crap. Facebook is the worst of the lot; I can’t believe a human being came up with something so stupid, and I’m a designer, so I know how this stuff is supposed to work. Why would anybody design it that way? I wanted a routine to post to Facebook automatically, and the thing was so complicated that Claude barfed on it.
Cloudflare is complicated too, because there’s a lot of it. That’s a different animal from complicated because nobody cared. The interface is really nice, and the free plan doesn’t bury you in options you can’t use.
Setup goes in this order. Add your site to Cloudflare and let it scan your existing DNS records. Check every record against what your host has, especially mail records, because a missing one means your email stops arriving and nobody tells you. Change your nameservers at your registrar to the two Cloudflare gives you. Turn on SSL in Full (strict) mode if your host has a valid certificate, and leave the default caching alone for the first week. Then write your five rules.
Claude helped me write my twenty rules. They’re complicated, it would have taken me weeks on my own, and I’d have gotten them wrong. Claude got them wrong too at first, and we fixed them together. I use AI every day that way, as a digital assistant that does the grunt work while I make the decisions.
Caching makes my site fast, and it also makes me crazy
Nobody mentions the downside of all that speed on the sign-up page.
Caches stack up. There’s one in Cloudflare, one in my website, one in the hardware, and more at the internet providers between my server and your screen. When I create or change a page, the question becomes which cache it’s stuck in. Edit a page, and if the change doesn’t show up, it’s sitting in a cache somewhere and you can wait up to a day for it. Caching improves performance enormously. It also drives me nuts.
Learn where the purge button is before you need it. Cloudflare lets you clear a single URL from its cache, and you’ll use that more than you expect. If your WordPress host has its own caching, find that purge button too. Clear your site’s cache first and Cloudflare’s second, or Cloudflare grabs the stale copy again.
Why is metered cloud pricing dangerous for a small website?
I hate not knowing what a bill is going to be. I said so on that same call, and I meant it.
Flat pricing I can plan around. Usage pricing punishes success. The moment people start reading or watching your stuff, the meter spins. Who wants to get fined for writing something people like? Cloudflare has products on both sides of that line, and the difference is enormous for anybody on a writer’s budget.
Video taught me this. Cloudflare’s streaming product charges for usage, and it’s expensive. The moment your videos start getting watched, you’re paying a lot, and the amount changes every month. So I didn’t use it.
So my videos went onto plain storage instead. It charges for space and not for views, and I encoded the files so they stream anyway. I’ve got close to 100GB of video and hundreds of audio files out there now, and last I checked it cost me 86 cents a month. As of 2026, that storage product (R2) charges $0.015 per gigabyte per month after the first 10GB free, and it charges nothing for the bandwidth when people download your files. With free bandwidth, a viral post can’t wreck the bill.
My backups work the same way. They go to Backblaze, and my bill for about 100GB was six cents. Six cents! I love that.
Read every pricing page for the word “per.” Per gigabyte stored is fine. Per request or per gigabyte delivered can turn a $5 month into a $300 month after one post goes viral. If you can’t predict the bill, don’t build on it.
Is Cloudflare’s free tier safe to rely on?
For a writer’s website, yes, with your eyes open.
Every vendor my business depends on sits on a scorecard I keep, and it flags each one green, yellow or red. Cloudflare sat at green until it had 13 incidents in 8 days and turned yellow. None of them affected me. If Cloudflare went down for five hours, my site would be slow or offline for five hours, and I’d shrug.
Every big provider has bad weeks. People attack everything, and Cloudflare carries a huge share of the web.
The bigger risk with any free tier is the model changing under you. The AI image service I use for book covers is moving from a flat subscription to buying tokens as you go, and that’s probably going to cost more. My email marketing provider went yellow on my scorecard for the same reason.
A free tier lasts exactly as long as the company says it does. They can change their minds whenever they like. That should make you nervous.
So protect yourself. Keep your domain registration somewhere you control and know the login. Keep backups off the platform, the way I describe in my website backup guide. Write down every Cloudflare setting you change, so you could rebuild it somewhere else in an afternoon. And treat Cloudflare as one layer of a security posture, with your host’s scanning and a short list of trusted plugins behind it.
What free tiers taught me about my own business
The come-on only works when the free part is good.
Most free tiers are bait with nothing behind it: a crippled version designed to annoy you into paying, or a trial that turns into a subscription you forgot about. I despise those. Why would anybody trust a company that hides its own price?
Cloudflare went the other way. It gave me a product good enough to run my site on for nothing, let me find its limits on my own schedule, and then sold me the next piece when I hit one. That’s how you earn a customer, and I’ll pay them without a grudge.
Writers can learn from that. A free chapter or a free newsletter is your tasting spoon, so make it good enough that the reader wants the cone. My book The Day Your Website Died covers what a writer’s website has to do now that AI search reads it, and a slow, hacked site makes a terrible free sample.
Start on the free plan today. Put your domain behind it, write your five rules, and turn on caching. Pay for Pro only when you’ve earned the need for it, and run from anything that bills by usage you can’t predict.
The Technology of Writing Hub collects more on the tools behind a writer’s site, and my WordPress service is there if you’d rather hand your site to somebody who’s already been through this. Cloudflare handed me the spoon, I bought the cone, and I’d do it again tomorrow. I only wish the rest of the industry were that straight about what the spoon is for.
