Cloudflare web hosting, and the security layer we run on top of it

01 / 09

Is Cloudflare a web host?

Yes and no, depending on the site. For a static site, Cloudflare is the host: Cloudflare Pages and Workers serve the files from its own network, with no separate server. For a dynamic site such as WordPress, Cloudflare is a reverse proxy, a network that sits in front of the server you already rent and handles every request on its way in.

The distinction matters because most of the pages answering this question are written by hosting resellers who need you to keep buying hosting. Cloudflare's own documentation describes the proxy model plainly: "A reverse proxy is a network of servers that sits in front of web servers," and proxied traffic routes "through Cloudflare on its way between the client and the origin server" (Cloudflare Docs, 2026). In that setup your files and database still live with your host. Cloudflare caches, filters and accelerates what sits in front of them.

The other model is newer and, for the right site, simpler. A site built as static HTML, the way we build with Astro, can be deployed straight to Cloudflare Pages. There is no origin server to patch, no PHP to update and no database to breach, because every page is a finished file sitting on Cloudflare's network. This very site works that way, which is why we can describe the trade-offs from operating it rather than from a brochure.

So the honest answer to "is Cloudflare a web host" is: it is the host for static sites, and the front door for everything else. Most small business sites can be either. The choice comes down to how often the content changes, who edits it, and whether the site needs server-side features such as logins, carts or a plugin ecosystem.

02 / 09

Is Cloudflare a good host for a business website?

For a brochure, service or content site, it is one of the best options available: fast everywhere, secure by default, and very cheap to run. It is a weaker fit when a business depends on WordPress plugins, a live editor for non-technical staff, or server-side features. In those cases Cloudflare belongs in front of a good host, not instead of one.

The strengths are structural. A static site served from Cloudflare's network has no server for an attacker to log into and no plugin for them to exploit, and the pages are already built when a visitor arrives, so they load fast on a mid-range phone. For SEO that matters twice over: Core Web Vitals depend on delivery speed, and AI crawlers read raw HTML, so a page that is finished before the request even arrives is a page every engine can read. Our AI crawlability work starts from exactly that principle.

The limits are real too, and they are published. On the free plan a Pages site can hold "up to 20,000 files," and "the maximum file size for a single Cloudflare Pages site asset is 25 MiB," with 500 builds a month and one build at a time (Cloudflare Pages docs, 2026). A business site rarely comes near those numbers. A large catalog, a media library of long videos, or a team publishing dozens of times a day can.

The bigger limitation is human. A static site means edits go through a build, and that suits a business where an agency or one technical person updates the site. It suits a business with five people editing pages every afternoon far less, and for them a managed WordPress host with Cloudflare in front is often the better answer. We recommend the platform that fits the business, which is the same position our website design page takes.

We also hold ourselves to what we learned running it. In July 2026 a Cloudflare-managed setting added AI-crawler blocks to our own robots.txt while our hand-written rules welcomed those crawlers. We found it, removed it and documented it. Cloudflare is a powerful default, and powerful defaults need someone watching what they change on your behalf.

03 / 09

How much does Cloudflare web hosting cost?

Hosting a static business site on Cloudflare can cost nothing: Cloudflare's free plan is $0 a month, and requests to static assets are free and unlimited. Paid zone plans add security and control: Pro is $20 a month billed annually or $25 monthly, Business $200 or $250, and the top tier is custom-priced. Dynamic code on Workers starts at a $5 monthly minimum.

Those figures come straight from Cloudflare. Its plans page lists Free at "$0" a month, Pro at "$20 /mo billed annually, or $25/mo billed monthly," Business at "$200 /mo billed annually, or $250/mo billed monthly," and the top tier as custom pricing billed annually (Cloudflare, 2026). On the developer side, "Requests to static assets are free and unlimited," the free Workers plan allows 100,000 requests a day, and the paid Workers plan carries "a minimum charge of $5 USD per month for an account" (Cloudflare Workers docs, 2026).

In practice that means the hosting line on a well-built static business site can be zero, and the money goes where it does the most good: the build, the content, and the security layer in front of it. Compare that with a typical managed WordPress plan plus a security plugin plus a caching plugin, and the economics are not close for a site that does not need WordPress.

What the price list does not tell you is what each plan does about bots, and that is where the cheap plans and the expensive plans differ most. Free and Pro protect you from simple bots across the whole domain. The fine-grained tools, a bot score on every request and the ability to act on likely automated traffic, sit higher up. The next section walks through exactly what changes at each tier.

If you want a budget for the whole project rather than the hosting line, the cost and timeline estimator below works through it, and a migration from an existing site is scoped on our site migration page. For our own part, most of our engagements run $1,200 to $3,500 per month, scaled to the site and the market, and we quote after a free audit, never before.

04 / 09

Can you host a WordPress site on Cloudflare?

Not directly. WordPress needs PHP and a database, which Cloudflare Pages does not run, so a WordPress site keeps its origin host and puts Cloudflare in front as a proxy for caching, SSL and filtering. The alternative is to rebuild the site as static HTML and host it on Cloudflare outright, which removes the server, the plugins and most of the attack surface.

Putting Cloudflare in front of WordPress is the common setup and a sensible one. You point your domain's DNS at Cloudflare, it proxies requests to your host, and you gain caching, a certificate and a first line of bot filtering. Nothing about how you edit the site changes. What does not change either is the origin: the PHP, the plugins and the admin login are all still there, and an attacker who reaches the origin directly can skip everything Cloudflare does.

Moving off WordPress is the bigger decision. We did it with our own site: a WordPress and Elementor build of 502 URLs, rebuilt as static Astro on Cloudflare Pages: 374 kept, 113 permanently redirected and 15 low-quality URLs removed for good, with those removals served as 410s from an edge function. The full method, including what Cloudflare's redirect file does and does not support, is on our site migration page.

Which path is right depends on the site, not on a preference. A WordPress site with a heavy plugin dependency, an online store, or many in-house editors usually stays on WordPress behind Cloudflare. A brochure or service site that changes a few times a month is usually faster, safer and cheaper rebuilt as static, and that is the build our technical SEO work is designed around.

05 / 09

What does each Cloudflare plan do about bots?

The free plan's Bot Fight Mode challenges simple bots from cloud hosting providers and headless browsers across the whole domain. Pro adds Super Bot Fight Mode, where you choose to allow, block or challenge definitely automated traffic. Only Enterprise Bot Management exposes a bot score on every request, plus JA3 and JA4 fingerprints, and lets you act on traffic that is likely, not just definitely, automated.

Cloudflare documents the tiers precisely. On Free, Bot Fight Mode targets "Simple bots from cloud hosting providers and headless browsers," responds with "a computationally expensive challenge," and is "Applied to all traffic across a domain" (Cloudflare Bots docs, 2026). That last phrase is the catch: it is one switch for the whole site, which is why it sometimes challenges a legitimate tool or integration along with the bots.

Pro adds Super Bot Fight Mode, where the "Customer chooses whether to allow, block, or challenge," with controls for verified bots and static resources. Its own comparison table marks the next step clearly: blocking or challenging "likely automated traffic" is "Not available on Pro," and is offered instead "with Bot Management" (Cloudflare Bots docs, 2026).

Bot Management is the Enterprise product, and it is what the serious bot defense is built on: "Access to bot score, JA3/JA4 fingerprint, bot tags fields, and detection IDs," which can drive custom rules (Cloudflare Bots docs, 2026). A bot score turns a yes-or-no guess into a graded signal, so a rule can challenge a 20 and let a 90 through instead of treating every visitor the same.

For most small businesses that leaves a gap. The free and Pro tools catch the obvious bots, the graded tools are priced for large companies, and the traffic in between, scrapers and click bots that look almost human, gets through. That gap is the reason the RankShield edge exists.

06 / 09

Does bot traffic affect SEO?

Mostly indirectly, and expensively. The damage shows up around rankings rather than in them: bots inflate and distort the analytics you make decisions from, click paid ads without buying, scrape your content to republish elsewhere, and add server load. With bots now the majority of web traffic, ignoring them means steering by a broken instrument.

The scale is not a guess. Thales, which publishes the Imperva Bad Bot Report, found that "In 2025, bots made up more than 53% of all web traffic, up from 51% the previous year, while human activity fell to 47%," with "40% classified as malicious" (Thales, 2026). Some of that automation is welcome: search engine crawlers and the AI crawlers that read your pages before citing you. The rest is the traffic you are paying for without knowing it.

Analytics is where it hurts SEO first. When a share of your sessions are bots, conversion rates look worse than they are, engagement metrics drift, and the landing pages that seem to be failing may simply be the ones scrapers visit most. Decisions made from that data, which pages to rewrite and which keywords to chase, inherit the error.

Ad spend is the second cost. A click bot on a paid search ad costs exactly what a customer's click costs, and it never calls. And scraped content is the third: a page copied onto other sites is still yours, but it competes with copies of itself, and the scraper got it for the price of a request.

The fix is not to block bots wholesale, which would also block Google and the AI engines you want to be cited by. It is to tell them apart at the edge, before they reach the site, and let the right ones in. That is a filtering problem, and it is the job we hand to the RankShield edge.

07 / 09

Where does the RankShield edge fit on top of Cloudflare?

The RankShield edge is a managed filtering layer that runs on Cloudflare's global network, in front of the whole site, refusing the automated traffic that drains ad spend and scrapes pages before it reaches the origin. It fills the gaps Cloudflare's free tier leaves, costs $39 a month set up for you, and works alongside the RankShield plugin, which keeps scoring at the origin.

In plain terms, Cloudflare gets every request to the site, and the RankShield edge runs inside that same network to decide what happens next. Customers, Google and the AI engines get through. Scrapers, click bots and spoofed agents get challenged or refused before your host ever sees them. Because it runs on Cloudflare, there is no extra server, and because it is managed, nobody on your team has to write firewall rules.

It is built to cover the space between Cloudflare's tiers that the previous sections describe. RankShield describes it as "a managed filtering layer on Cloudflare's global network that sits in front of your whole site" that "runs on top of Cloudflare, filling the gaps its free tier leaves," at $39 a month. If the site also runs the RankShield plugin, the plugin keeps scoring and challenging at the origin, so there are two layers and nothing switched off to get the second one. The details and the signup are on the RankShield edge page.

A disclosure, because it matters: RankShield is our founder's security company. We put its edge in front of sites we build on Cloudflare because it is the layer we trust and can see inside, and we tell every client that relationship before they choose it. It is an add-on, never a condition of working with us.

08 / 09

What is RankShield's relationship with Cloudflare?

RankShield works in partnership with Cloudflare through the Cloudflare Startup Program. The program granted RankShield $10,000 in Cloudflare credits running from July 2026 to July 2027, and its Enterprise domains, which is why rankshield.co itself runs on Cloudflare's Enterprise plan. These are credits and platform access, not an investment, and we describe them exactly that way.

The facts are specific, so here they are with their limits. The Cloudflare Startup Program's first tier provides "$10k" in credits and, as "part of the program," access to "three Enterprise domains" (Cloudflare Startup Program, 2026). RankShield's credits run from July 17, 2026 to July 17, 2027, and rankshield.co is one of its domains on the Enterprise plan, where Bot Management's bot score is available to the edge.

Equally specific is what it is not. That tier of the program is defined for companies that are "Bootstrapped or self-funded," so RankShield is not funded by Cloudflare and we will not say it is. It is not a reseller agreement, it does not make us part of Cloudflare's formal partner program, and it does not put every site we build on Enterprise: this site, seoeliteagency.com, runs on Cloudflare's Pro plan. The program also has a clock. Enterprise domains return to the free plan at graduation unless they move to a paid plan, and we will update this page when that date arrives.

Why tell you all this? Because a security claim you cannot check is worth nothing, and the security business is full of them. Everything in this section can be checked against Cloudflare's own program terms, and we hold the rest of this site to the same standard, down to a content-integrity hash you can verify yourself.