This article'slead sectionmay be too short to adequatelysummarize the key points. Please consider expanding the lead toprovide an accessible overview of all important aspects of the article.(September 2025)
Cloudflare was founded on July 26, 2009 byMatthew Prince, Lee Holloway, andMichelle Zatlyn.[2][8][9] Prince and Holloway had previously collaborated onProject Honey Pot, a product of Unspam Technologies that served as some inspiration for the basis of Cloudflare.[10] From 2009, the company was venture-capital funded.[11] On August 15, 2019, Cloudflare submitted itsS-1 filing for aninitial public offering on theNew York Stock Exchange under the stock ticker NET.[12] It opened for public trading on September 13, 2019, at $15 per share.[13]
In 2020, Cloudflare co-founder and COOMichelle Zatlyn was named president.[14]
Cloudflare has acquired web-services and security companies, including StopTheHacker (February 2014),[15] CryptoSeal (June 2014),[16] Eager Platform Co. (December 2016),[17] Neumob (November 2017),[18] S2 Systems (January 2020),[19] Linc (December 2020),[20] Zaraz (December 2021),[21] Vectrix (February 2022),[22]Area 1 Security (February 2022),[23] Nefeli Networks (March 2024), BastionZero (May 2024),[24] and Kivera (October 2024).[25]
Lava Lamps in the Cloudflare office
Since at least 2017, Cloudflare has been using a wall oflava lamps in their San Francisco headquarters as asource of randomness for encryption keys, alongsidedouble pendulums in its London offices and aGeiger counter in its Singapore offices.[26] The lava lamp installation implements theLavarand method, where a camera transforms the unpredictable shapes of the "lava" blobs into a digital image.[27][26]
In Q4 2022,[update] Cloudflare provided paid services to 162,086 customers.[28]
In October 2024, Cloudflare won a lawsuit againstpatent troll Sable Networks, which saw Sable pay Cloudflare $225,000, grant them aroyalty-free license to its entire patent portfolio, and to dedicate its patents to the public by abandoning their patent rights.[29]
In 2023, Cloudflare launched "Workers AI", a framework allowing for use ofNvidiaGPU's within Cloudflare's network.[35]
In 2024, Cloudflare launched a tool that prevents bots from scraping websites. To build automatic bot detector models, the company analyzed "AI" bots and crawler traffic.[36]The company also launched an "AI" assistant to generate charts based on queries by leveraging "Workers AI".[37]Cloudflare announced plans in September 2024 to launch a marketplace where website owners can sell "AI" model providers access to scrape their site’s content.[38]Cloudflare also launched AI Audit, which provides analytics on "AI" models scraping their sites (along with the ability to block them altogether).[39]
In March 2025, Cloudflare announced a new feature called "AI Labyrinth", which combats unauthorized "AI" data scraping by serving fake "AI"-generated content to LLM bots.[40][41]
Cloudflare provides free and paidDDoS mitigation services that protect customers from distributeddenial of service (DDoS) attacks. Cloudflare received media attention in June 2011 for providing DDoS mitigation for the website ofLulzSec, ablack hat hacking group.[42]
In March 2013,The Spamhaus Project was targeted by a DDoS attack that Cloudflare reported exceeded 300gigabits per second (Gbit/s).[43][44] Patrick Gilmore, ofAkamai, stated that at the time it was "the largest publicly announced DDoS attack in the history of the Internet". While trying to defend Spamhaus against the DDoS attacks, Cloudflare ended up being attacked as well; Google and other companies eventually came to Spamhaus' defense and helped it to absorb the unprecedented amount of attack traffic.[45]
In 2014, Cloudflare began providing free DDoS mitigation for artists, activists, journalists, and human rights groups under the name "Project Galileo".[46] In 2017, they extended the service to electoral infrastructure and political campaigns under the name "Athenian Project".[47][48] By 2025, more than 2,900 users and organizations were participating in Project Galileo, including 31 US states.[49][50][51]
In February 2014, Cloudflare claimed to have mitigated anNTP reflection attack against an unnamed European customer, which they stated peaked at 400 Gbit/s.[52][53] In November 2014, it reported a 500 Gbit/s DDoS attack in Hong Kong.[54] In July 2021, the company claimed to have absorbed a DDoS attack three times larger than any they'd previously recorded, which their corporate blog implied was over 1.2 Tbit/s in total.[55] In February 2023, Cloudflare reported blocking a 71 million request-per-second DDoS attack which "the company says was the largest HTTP DDoS attack on record".[56]
Cloudflare blocked the largest publicly recorded DDoS attack in August 2025, with volumetric attacks peaking at 11.5terabits per second.[57]
In 2017, Cloudflare launched Cloudflare Workers, aserverless computing platform for creating new applications, augmenting existing ones, without configuring or maintaining infrastructure. It has expanded to include Workers KV, a low-latencykey-value data store; Cron Triggers, for schedulingCron jobs; and additional tooling for developers to deploy and scale their code across the globe.[58]
In 2020, Cloudflare released aJAMstack platform for developers to deploy websites on Cloudflare's Edge infrastructure, under the name "Pages".[59]
In 2022, Cloudflare announced an EdgeSQL database, D1, which is built onSQLite.[60]
In August 2023, Cloudflare andIBM announced a partnership providing bot management capabilities to protect IBM Cloud customers from malicious bots and automated threats.[61]The same month, Cloudflare was hired bySpaceX to boost the performance ofStarlink.[62] In September, the company launched Cloudflare Fonts as a competitor toGoogle Fonts.[63]
In April 2020, Cloudflare announced it was moving away from usingreCAPTCHA in favor ofhCaptcha.[64] In September 2022, Cloudflare began to test Turnstile – an alternative toCAPTCHA. The product, instead of presenting a visual CAPTCHA for the user to solve, automatizes the verification process by conducting JavaScript-based checks inside the browser to determine whether the user is a real person or an automated entity. The algorithm reportedly uses machine learning to optimize the process.[65] Turnstile isGDPR-compliant, offering a more private alternative to Google'sreCAPTCHA, which has been scrutinized for its data collection.[66]
Through a contract with theCybersecurity and Infrastructure Security Agency, Cloudflare provides registry and authoritative DNS services to the .govtop-level domain.[67] Cloudflare also launched Cloudflare for Campaigns in 2020, to offer free cybersecurity tools to political campaigns.[68]Those tools expanded to include secure email systems in 2025.[69]
In November 2020, Cloudflare announced Cloudflare for Teams, consisting of a DNS resolver and web gateway called "Gateway", and azero-trust authentication service called "Access".[70]
Cloudflare released anOblivious HTTP relay service in 2022, called Privacy Gateway.[71]
Cloudflare announced a partnership withPhonePe in January 2023 to secure its mobile payment system.[72] In February, Cloudflare launched Wildebeest to allowMastodon users to set up and run their own instances on Cloudflare's infrastructure.[73]
In August 2023, Cloudflare started the Project Cybersafe Schools program as part of a $20 million grant program fromAmazon Web Services, making 70 percent of public school districts in the United States eligible for no-cost cybersecurity services.[74]
In March 2024, they announced Firewall for AI to defend applications runninglarge language models (LLMs).[75]In September, Cloudflare announced Ephemeral IDs, which identifies fraudulent activity by linking behavior to a client through a short-lived, generated ID, rather than the traditional means of using an IP address.[76] The same month, the company also announced all ISP and equipment manufacturers could use their DNS resolvers for free.[77]
Cloudflare introduced the Cloudforce One threat events platform in March 2025, offering real-time insights into cyberattacks using data gathered from Cloudflare's network.[78][79]
Cloudflare's overarchingSASE platform debuted in October 2020.[80]
Cloudflare announced the acquisition ofArea 1 Security in February 2022, a company who developed a product designed to combat phishing email attacks.[81]
Cloudflare acquired Nefeli Networks in March 2024, a cloud networking company, co-founded by computer scientistSylvia Ratnasamy.[82]
In January 2021, the company began providing its "Waiting Room" digital queue product for free for COVID-19 vaccination scheduling under the title "Project Fair Shot".[87] Project Fair Shot later won aWebby People's Choice Award in 2022 for Event Management under the Apps & Software category.[88]
Cloudflare released the Speed Brain and Instant Purge features in September 2024, to significantly reduce page load latency by prefetching content, and invalidating cached content in under 150ms.[90]
In 2024, Cloudflare announced plans to launch a new payment method, calledStripe Link, which went into beta in the fall.[91]
Since 2010, Cloudflare has collaborated with theNational Center for Missing & Exploited Children to provide data, files, and supplemental investigation from abuse reports observed on their network.[92]Cloudflare designed a new NCMEC reporting system in 2024,[93] updating it in 2025 by integrating Cloudflare Workflows and making the CSAM scanning tool accessible globally.[94]
On June 1, 2012, the hacker groupUGNazi compromised some of Cloudflare CEO Matthew Prince's accounts and redirected visitors of the website4chan to a Twitter account belonging to UGNazi. They allegedly usedsocial engineering to trick AT&T support staff into giving them access to Prince's voicemail, then exploited a vulnerability in Cloudflare's use of Google's two-factor authentication system. Once in control of Prince's email account, UGNazi was able to redirect the 4chan domain through Cloudflare's database.[95][96]
From September 2016 until February 2017, a major Cloudflare bug nicknamedCloudbleed[97] leaked sensitive data, including passwords and authentication tokens, from customer websites by sending extra data in response to web requests.[98]
Cloudflare has established a content neutrality policy and opposes the policing of its customers onfree speech grounds unless said customers break the law.[99][100] The company has faced criticism for not banning hate speech websites and websites allegedly connected to terrorism groups,[101] but Cloudflare has maintained that no law enforcement agency has asked the company to discontinue these services and it closely monitors its obligations under U.S. laws.[102]
In 2022, a research paper byStanford University found that Cloudflare was a prominent CDN provider among several other providers that are disproportionately responsible for serving misinformation websites.[103][104] Cloudflare has come under pressure on multiple occasions due to its services being utilized to accessfar-right content.[105][106][107][108]
Cloudflare provided DNS routing and DDoS protection for thewhite supremacist andneo-Nazi websiteThe Daily Stormer. In 2017, after previously refusing to take any action against the website,[108] Cloudflarestopped providing its services toThe Daily Stormer after an announcement on the website asserted that Cloudflare executives were privately supporting its ideology.[109][110]
In a statement toBusiness Insider, Cloudflare CEO Matthew Prince said that he was repulsed byThe Daily Stormer's content while expressing regret at the fact that his decision to suspend services had taken the website offline: "The ability of somebody to single-handedly choose to knock content offline doesn’t align with core ideas of due process or justice. Whether that’s a national government launching attacks or an individual launching attacks."[111]
As a self-described "free speech absolutist", Prince claimed he did not want to repeat the decision, and sought out protections for the company should they be faced with a similar situation in the future.[108] Prince further addressed the dangers of large companies deciding what is allowed to stay online, a concern shared by a number of civil liberties groups and privacy experts.[112][113][114] TheElectronic Frontier Foundation, a US digital rights group, said that services such as Cloudflare should not be deciding what speech is acceptable and that illegal content should be handled through the legal system.[109]
In 2019, Cloudflare was criticized for providing services to the far-right[115] discussion and imageboard8chan. The message board has been linked to mass shootings in the United States and theChristchurch mosque shootings in New Zealand.[115][116][117] In addition, a number of news organizations includingThe Washington Post andThe Daily Dot have reported on the existence ofchild pornography andchild sexual abuse discussion boards.[118][119][120] A Cloudflare representative said that the platform "does not host the referenced websites, cannot block websites, and is not in the business of hiding companies that host illegal content".[121] Cloudflare did not terminate service to8chan until public and legal pressure mounted in the wake of the2019 El Paso shooting, in which the associated manifesto was published to 8chan.[122][123][124] In an interview withThe Guardian immediately after the shooting, CEO Matthew Prince defended Cloudflare's support of 8chan, saying that he had a "moral obligation" to keep 8chan online.[125]
On August 5, 2019, Cloudflare terminated service to 8chan,[126] causing the website to move to thedark web.[127] Cloudflare explained that 8chan "have proven themselves to be lawless and that lawlessness has caused multiple tragic deaths. Even if 8chan may not have violated the letter of the law in refusing to moderate their hate-filled community, they have created an environment that revels in violating its spirit."[128] Prince derided the El Paso shooting as "abhorrent in every possible way", removing 8chan from the Internet was "the right thing to do".[129][125]
In 2022, a campaign was launched bytransgender activistClara Sorrenti, who has previously been targeted by the forum, to pressure Cloudflare into terminating service for Kiwi Farms.[142][143] Cloudflare responded by issuing a statement on its abuse policies and saying it didn't want to set precedent for speech on the internet with its "extraordinary" decision.[144]
The company also released a blog post[145] and likened their services to that of a public utility, emphasizing that they do not believe in shutting down security services based on content they find objectionable. They acknowledged that while it might be more popular to remove sites that the Cloudflare team finds offensive, they stood by their decision not to do so.[146][147] The company also defended their decision by saying that they donated all earnings from anti-LGBTIQ+ sites to an organization that advocated for LGBTIQ+ rights.[148] The blog post mentioned Cloudflare's terms of use agreement, which allows them to terminate service due to "content that discloses sensitive personal information, [and] incites or exploits violence against people" but, according toThe Guardian, the statement did not address how Kiwi Farms users' doxxing behavior did not violate these terms.[148]
On September 3, 2022, Cloudflare blocked Kiwi Farms, citing urgent escalating rhetoric against targets of Kiwi Farms, stating that there is an "unprecedented emergency and immediate threat to human life". According toThe Washington Post, there was a "surge in credible violent threats stemming from the site" and CEO Matthew Prince said that Cloudflare believes "there is an imminent danger, and the pace at which law enforcement is able to respond to those threats we don't think is fast enough to keep up".[149][150][151]
Cloudflare said the move was "related to our attempts to understandFOSTA, which is a very bad law and [sets] a very dangerous precedent". Assembly Four said that "Given Cloudflare's previous stances of privacy and freedom, as well as fighting alongside theEFF, we had hoped they would take a stand against FOSTA/SESTA".[153]
In September 2019, Cloudflare reported in theirForm S-1 filing that their technology was "used by, or for the benefit of, certain individuals or entities" that were blacklisted due to United States economic and trade sanctions regulations",[161] including "entities identified in OFAC’s counter-terrorism and counter-narcotics trafficking sanctions programs, or affiliated with governments currently subject to comprehensive U.S. sanctions".[162]
Cloudflare has been cited in reports byThe Spamhaus Project, an internationalspam tracking organization, for the high numbers of cybercriminal botnet operations hosted by Cloudflare.[163][164][165] An October 2015 report found that Cloudflare provisioned 40% of theSSL certificates used bytyposquattingphishing sites, which use deceptive domain names resembling those of banks and payment processors to compromise Internet users' banking and other transactions.[166] Cloudflare has been criticized for having aconflict of interest by providing DDoS protection to both the operators and victims of "stresser" services.[167][168]
In 2018, Cloudflare was identified by the European Union's Counterfeit and Piracy Watch List as a "notorious market" which engages in, facilitates, or benefits from counterfeiting and piracy. The report noted that Cloudflare hides and anonymizes the operators of 40% of the world's pirate sites, and 62% of the 500 largest such sites, and "does not follow due diligence when opening accounts for websites to prevent illegal sites from using its services".[169][170]
In 2020, an Italian court ruled Cloudflare had to block current and future domain names and IP addresses of the pirate IPTV service "IPTV THE BEST" for infringing on LegaSerie A intellectual property.[171] At the time, Cloudflare was already blocking 22 domain names in Italy.[172] German courts have similarly found that "Cloudflare and its anonymization services attract structurally copyright infringing websites."[173]
Following the December 2024 court ruling,[174] the SpanishLaLiga requested that telephone operators block Cloudflare's IP address ranges in February 2025. Cloudflare hosted websites that illegally broadcast soccer matches. As a result, the pirate platform DuckVision was shut down before the derby between Real Madrid and Atlético Madrid. The platform had 200,000 users and was backed by Cloudflare.[175] The blocks affected major legitimate websites, including X,Vimeo,Steam,GitHub, and theRoyal Spanish Academy.[176]
AfterRussia invaded Ukraine in late February 2022,Ukrainian Vice Prime Minister, Minister of Digital TransformationMykhailo Fedorov[177] and others[178] called on Cloudflare to stop providing its services in theRussian market amidst reports that Russia-linked websites spreading disinformation were using the company's content delivery network services.[179] Cloudflare CEO Matthew Prince responded that the company decided to remain providing services to Russian people to counter Russia's attempts to raise a 'digital iron curtain'.[180][181] Prince shared that "Indiscriminately terminating service would do little to harm the Russian government but would both limit [Russian citizens'] access to information outside the country and make significantly more vulnerable those who have used us to shield themselves as they have criticized the government."[182] The company later said it had minimal sales and commercial activity in Russia and had "terminated any customers we have identified as tied to sanctioned entities".[183]
Cloudflare's Project Galileo, launched in 2014, offersDDoS protection toNGOs for free. In 2022, they extended free protection toUkrainian government and telecoms.[184][185]
US$1.669 billion (2024)
−US$155 million (2024)
