How Did Cloudflare Grow? From a Free Plan to $2.17B Revenue

Cloudflare made $2.17 billion in revenue in 2025 ($2,167.9 million, up 30% from 2024), according to its annual results released on February 10, 2026. Growth has sped up since then: revenue for the second quarter of 2026 was $696.1 million, up 36% year over year, and the company guided to $2.864 to $2.870 billion for the full year 2026.

That is a long way from September 2010, when Cloudflare launched at TechCrunch Disrupt with five data centers, 1,000 beta websites and a basic plan that cost nothing.

The free plan is the key to the whole story. Most companies treat a free tier as a marketing expense. Cloudflare built its network so that free traffic made the paid product better and cheaper to run. Then it spent fifteen years selling more and more products to the people already routing traffic through it.

Cloudflare by the numbers

Two notes on these numbers. Cloudflare stopped reporting its total paying customer count in 2026, saying the metric had "become significantly less important" to how it runs the business, so 332,000 is the last official figure. And this article doesn't quote a market capitalization, because it changes every trading day. Check a live quote for that.

Revenue by year

Source: Cloudflare's annual reports filed with the SEC. Growth rates are calculated from the reported figures.

The shape is worth noticing. Growth held near 50% every year from 2019 through 2022, slowed to about 30% as the company passed $1 billion, and then turned back up in late 2025 and 2026.

Cloudflare's growth timeline

• 2004: Matthew Prince and Lee Holloway start Project Honey Pot, which tracks how spammers harvest email addresses.
• 2009: Prince, Holloway and Michelle Zatlyn found Cloudflare while Prince and Zatlyn are at Harvard Business School.
• September 27, 2010: Cloudflare launches at TechCrunch Disrupt with a free basic service and a paid Pro plan.
• September 25, 2017: Unmetered Mitigation ends extra charges for DDoS attacks on every plan, including Free.
• September 29, 2017: Cloudflare Workers is announced, letting developers run code on Cloudflare's network.
• April 1, 2018: The 1.1.1.1 consumer DNS resolver launches.
• September 27, 2018: Cloudflare Registrar launches, selling domains at wholesale cost with no markup.
• December 31, 2018: Over 67,000 paying customers.
• September 13, 2019: IPO on the New York Stock Exchange at $15 a share.
• January 7, 2020: Cloudflare for Teams launches alongside the acquisition of S2 Systems.
• September 28, 2021: R2 object storage is announced with zero egress fees.
• September 27, 2023: Workers AI brings GPU inference to the network.
• July 1, 2025: Cloudflare blocks AI crawlers by default and introduces pay per crawl.
• November 17, 2025: Cloudflare agrees to acquire Replicate.
• January 16, 2026: The team behind the Astro web framework joins Cloudflare.
• May 7, 2026: Record Q1 revenue of $639.8 million, alongside a cut of about 20% of the workforce.
• June 4, 2026: Cloudflare acquires VoidZero, the company behind Vite.
• August 6, 2026: Q2 revenue of $696.1 million, up 36%.

A honeypot, a phone call and a classmate

Cloudflare's roots go back to 2004, when Prince and Holloway built Project Honey Pot, a way to track how spammers found email addresses on the web. It was a side project that collected a lot of data about bad traffic.

Five years later Prince was doing an MBA at Harvard Business School. He told the BBC in 2016 that he got an unexpected call from the US Department of Homeland Security asking about the attack data Honey Pot had gathered. He mentioned it to classmate Michelle Zatlyn. Her response, as Prince tells it: "if they'll pay for it, other people will pay for it."

The three founders first called the idea "Project WebWall." Prince wrote in 2010 that the goal was to build "a firewall in the cloud." A friend suggested the name Cloudflare, the domain was available, and they took it.

That origin explains the design. Cloudflare started as a security product that needed to see as much traffic as possible, and everything else, including the CDN, followed.

Launching free at TechCrunch Disrupt

Cloudflare launched on September 27, 2010, as a finalist at TechCrunch Disrupt. TechCrunch's write-up called it "a CDN for the masses." Setup took about five minutes: you changed your DNS to point at Cloudflare, and your site got faster and harder to attack.

The basic service was free. A Pro plan added SSL and extra performance features. Before launch, the service had been tested on 1,000 websites serving 6 million unique visitors, running on five data centers across three continents.

In 2010, CDNs were sold to big companies through sales teams, and small sites mostly went without. Cloudflare went after the sites everyone else ignored.

Why the free plan was the business model

People who first see Cloudflare's free tier often assume it's a loss leader. The company's own filings describe something closer to a raw material.

Cloudflare's 2025 annual report lists what free customers provide. They "create scale, serve as efficient brand marketing, and help us attract developers, customers, and potential employees." They expose Cloudflare to new threats early. Their traffic makes Cloudflare more valuable to internet service providers, which improves "the breadth and economic terms of our interconnections, bandwidth costs, and co-location expenses." The filing even calls the free base a "virtual quality assurance" function that tests products before paying customers get them.

The architecture makes this cheap. Cloudflare built a network where "every service" runs "on every server in every city." That means it can serve its highest-paying customers from the best locations and serve free users from wherever it has spare capacity. In their 2019 IPO letter, Prince and Zatlyn said this let Cloudflare reach 77% gross margins, similar to hardware vendors, while running a subscription business.

They also explained why the CDN is free at all. "We've given CDN away for free since Cloudflare launched in 2010," they wrote, "not because we were trying to disrupt the CDN space, but because the much more valuable products we provide our customers need a highly optimized global caching network."

Self-serve first, the sales team later

Cloudflare's first real revenue engine was self-serve. Anyone could sign up on the website, pick a Pro or Business plan per domain and start paying by card, with no sales call and no professional services.

The company still describes this as a structural advantage. Its 2026 quarterly filing says the pay-as-you-go offering "has allowed us to acquire a large portion of our paying customers very rapidly and at significantly lower customer acquisition costs than our other product offerings."

The enterprise sales team came later and sold into accounts where Cloudflare was often already running. By the time of the IPO in 2019, about 10% of the Fortune 1,000 were paying customers. Prince and Zatlyn described the strategy as entering "a market in some small way" and then using "that toehold to expand."

Refusing to charge more during an attack

In September 2017, during the company's seventh birthday week, Prince announced Unmetered Mitigation. Cloudflare would no longer charge more, or drop customers, because of the size of a DDoS attack, on any plan.

His framing was blunt. Other vendors sent small businesses huge bills after an attack. "That feels barely a step above extortion," he wrote. Internally, Cloudflare had a name for kicking a customer off the network when an attack grew too large for everyone else's safety: FINTing, short for Fail INTernal. The network had grown big enough, with over 15 terabits per second of mitigation capacity, that it no longer needed to.

It was a pricing decision that doubled as marketing, and it put pressure on rivals whose business depended on surge pricing.

Birthday Week turned launches into news

That 2017 announcement is an example of a habit that has shaped Cloudflare's marketing ever since. Every September, around the anniversary of the 2010 launch, it ships a batch of products over a single week and writes about each one on its blog.

Look at the dates. Unmetered Mitigation and Workers came in the last week of September 2017. Registrar followed on September 27, 2018, with a promise to charge only the wholesale price for domains, which worked out to $8.03 a year for a .com at the time. R2 object storage, pitched as storage "minus the egress fees," was announced on September 28, 2021. Workers AI launched on September 27, 2023.

Several of these launches do the same thing: they take a fee that the rest of the industry charges and remove it. Surge pricing for attacks, registrar markups and cloud egress fees each got a free or at-cost alternative. That gives Cloudflare a story every time, and it draws in new users who later buy something else.

The blog is part of the machine. Cloudflare's 10-K says it drives "organic awareness and adoption" through the free offering and engages "with developers across blogs, social media, and other channels." Its engineering posts also cover outages, attacks and internet traffic trends in detail, which gives developers a reason to read even when nothing is launching.

Consumer products as a brand channel

On April 1, 2018, Cloudflare launched 1.1.1.1, a free DNS resolver for consumers, followed later by the WARP app. Neither is a big revenue line. Cloudflare excludes 1.1.1.1 and WARP users from its paying customer count and says they represent "an insignificant amount of our revenue."

The company is open about why it runs them anyway. Its 10-K says consumer products "provide an effective and differentiated marketing channel to expand the awareness of our brand." The likely logic: someone who installs WARP on a phone will never buy a firewall, but they may work somewhere that does.

Workers became the second act

The most important product decision after the free plan was Workers, announced on September 29, 2017. It let developers write JavaScript that runs on Cloudflare's servers around the world, rather than on a single origin server.

Workers started as a productized version of the serverless system Cloudflare built for itself. By the 2019 IPO, the founders said it was "adopted by more than 20 percent of our new customers."

Workers also changed who Cloudflare competes with. The 2025 annual report says Cloudflare is "increasingly competing with public cloud vendors for storage and compute workloads." Storage (R2), databases, queues and AI inference followed, all built on the same network. Developer products opened what the company calls "an entirely new market for us: storage and compute."

Moving upmarket without losing the base

Cloudflare's customer counts show how the business matured. Paying customers grew from over 67,000 at the end of 2018 to over 140,000 at the end of 2021, about 238,000 at the end of 2024 and about 332,000 at the end of 2025.

The more telling number is large customers, those paying over $100,000 a year. That count rose from 2,756 at the end of 2023 to 3,497 a year later, 4,298 at the end of 2025 and 4,698 by mid-2026. Dollar-based net retention, which measures how much existing customers expand, climbed from 111% at the end of 2024 to 120% in the second quarter of 2026.

The deals are getting bigger too. In the fourth quarter of 2025, Prince said Cloudflare closed "our largest annual contract value deal ever," averaging $42.5 million a year, and that new annual contract value grew nearly 50%, the fastest rate since 2021.

The 2019 IPO

Cloudflare filed to go public in August 2019 and started trading on September 13, 2019, under the ticker NET. It priced 35 million shares at $15, for about $491 million in net proceeds, according to the prospectus.

At that point Cloudflare had over 74,000 paying customers (as of June 30, 2019) and said more than 20 million internet properties used its network. Its 2019 revenue came to $287.0 million.

The IPO letter also revealed something the company hadn't talked about much. There were three founders, not two. Lee Holloway, who architected the platform and led the early engineering team, had stepped down in 2016 because of frontotemporal dementia. The IPO's code name, "Project Holloway," honored him.

Selling to the office, not just the website

For its first decade, Cloudflare mostly protected websites and apps. In January 2020 it went after a new buyer: the IT team protecting employees.

Cloudflare for Teams launched on January 7, 2020, together with the acquisition of S2 Systems, a browser isolation startup. The pitch was to replace hardware VPNs and firewalls in the office with services on Cloudflare's network, the same "band-aid boxes" argument from the IPO filing, applied to corporate networks. The product line is now sold as Cloudflare Zero Trust. The timing turned out well: remote work spiked a few months later, and revenue grew 50% in 2020 and 52% in 2021. Cloudflare doesn't break out Zero Trust revenue, so how much of that growth came from Teams is unclear.

Buying developer mindshare

Cloudflare's IPO letter said its "bias is toward internal development." Recently, it has bought its way into the tools developers already use.

In November 2025 it agreed to acquire Replicate, whose catalog of over 50,000 production-ready AI models would become available to Workers AI users. In January 2026 the full-time team behind Astro, a popular open-source web framework, joined Cloudflare, with Astro staying MIT-licensed. In June 2026 it acquired VoidZero, the company behind the Vite build tool, which Cloudflare said sees over 130 million weekly downloads. The Cloudflare Vite plugin alone had reached 13.9 million weekly downloads.

The pattern is clear enough. Frameworks and build tools decide where code gets deployed. If the default path from a developer's laptop, or an AI coding agent's output, runs through Cloudflare tooling, more of that code ends up on Workers. Cloudflare's own framing, in its Q4 2025 results, was that "more agents drive more code to Cloudflare Workers."

Picking a fight with AI crawlers

On July 1, 2025, which Cloudflare called "Content Independence Day," it changed the default for new customers to block AI crawlers unless they pay. It also introduced pay per crawl, a way for sites to charge AI companies for access.

Prince's argument was that the old deal with search engines had broken. He wrote that with OpenAI, it was "750 times more difficult to get traffic than it was with the Google of old," and with Anthropic "30,000 times more difficult." Because Cloudflare sits in front of a large share of the web, it could change the default for millions of sites at once.

It is also a growth move. It gives publishers a reason to join and positions Cloudflare as the toll booth between AI companies and content.

If AI answers are the new front door

The shift Prince described affects every company that relies on being found, not just publishers. Buyers increasingly ask ChatGPT or read a Google AI Overview before they ever click a link. Okara's GEO Agent tracks up to 15 of your buyers' prompts in those two places and shows which competitors get cited instead of you, and the SEO Agent finds the keyword and content gaps behind the result.

Cutting 20% while revenue accelerated

On May 7, 2026, Cloudflare reported record quarterly revenue of $639.8 million, up 34%, and in the same announcement said it would cut about 1,100 jobs, roughly 20% of the workforce. It was the first mass layoff in the company's history, according to TechCrunch.

Prince said the cuts reflected the company's move to "an agentic AI-first operating model," not performance or cost pressure. On the earnings call he said Cloudflare's internal AI usage had risen more than 600% in three months and that he expected Cloudflare to have more employees in 2027 than at any point in 2026. Salespeople carrying revenue quotas were excluded from the cuts. The company estimated restructuring charges of up to $165 million.

Whether that bet pays off is still open. The next quarter's numbers were strong: revenue rose 36% to $696.1 million, and Prince reported "record growth in total paying customers, large customers, and developers." Profitability is still uneven, though. GAAP operating loss for the second quarter was $205.7 million, most of it from the restructuring, while non-GAAP operating income was $96.1 million.

What founders can learn from Cloudflare

The free plan worked because it was wired into the cost structure. Free users made Cloudflare's network bigger, which made bandwidth cheaper, which made the free plan cheaper to offer. If your free tier only costs you money, it's a marketing budget. If it lowers your costs or improves the paid product, it can carry the business for a decade.

Removing a hated fee is a strong launch. Unmetered Mitigation, at-cost domains and zero egress each targeted a charge that customers resented and competitors depended on. Each one earned attention and users that Cloudflare later sold other products to.

Cloudflare also shows the value of a second act planned early. Workers shipped in 2017, two years before the IPO, and it's the reason Cloudflare now competes with the public clouds rather than only with CDN and security vendors. The founders wrote in 2019 that companies that "only build a better mousetrap" eventually face the question "what's their second, third, and fourth act?" They had an answer ready before anyone asked.

Last, a fixed calendar helps. Birthday Week gives Cloudflare a reason to ship, and the press a reason to pay attention, every September.

Frequently asked questions

What is Cloudflare's revenue?

Cloudflare reported revenue of $2,167.9 million (about $2.17 billion) for fiscal year 2025, up 29.8% from $1,669.6 million in 2024. In the second quarter of 2026, revenue was $696.1 million, up 36% year over year, and the company guided to $2.864 to $2.870 billion for full-year 2026.

How did Cloudflare grow so fast?

Cloudflare grew by offering a free plan that anyone could set up in minutes, then selling paid security, performance and developer products to the sites already on its network. Free users gave it scale, threat data and better bandwidth deals. It added self-serve paid plans, then enterprise sales, then new product lines such as Workers (2017), Zero Trust (2020) and R2 storage (2021).

How many customers does Cloudflare have?

Cloudflare had about 332,000 paying customers as of December 31, 2025, according to its annual report. It stopped reporting that total in 2026. As of the second quarter of 2026, it had 4,698 customers paying more than $100,000 a year, up from 3,712 a year earlier.

How many employees does Cloudflare have?

Cloudflare had 5,156 full-time employees on December 31, 2025. It had about 5,500 before announcing, on May 7, 2026, that it would cut about 1,100 roles, or roughly 20% of its workforce.

Who founded Cloudflare and when?

Matthew Prince, Michelle Zatlyn and Lee Holloway founded Cloudflare in 2009. Prince and Zatlyn met at Harvard Business School, and Prince and Holloway had earlier worked together on Project Honey Pot. The service launched publicly on September 27, 2010.

When did Cloudflare go public?

Cloudflare began trading on the New York Stock Exchange on September 13, 2019, under the ticker NET. It priced 35 million shares at $15 each. It had over 74,000 paying customers at the time and reported $287.0 million in revenue for 2019.

Is Cloudflare profitable?

Not on a GAAP basis. In the second quarter of 2026, Cloudflare reported a GAAP operating loss of $205.7 million, driven largely by restructuring charges, and non-GAAP operating income of $96.1 million. Free cash flow for that quarter was $56.4 million.

Sources

• Cloudflare fourth quarter and fiscal year 2025 financial results, Cloudflare via SEC
• Cloudflare second quarter 2026 financial results, Cloudflare via SEC
• Cloudflare 2025 annual report (Form 10-K), SEC
• Cloudflare Q2 2026 quarterly report (Form 10-Q), SEC
• Cloudflare 2024 annual report (Form 10-K), SEC
• Cloudflare 2021 annual report (Form 10-K), SEC
• Cloudflare IPO prospectus and founders' letter, SEC
• The firm that protects both banks and the Eurovision Song Contest, BBC News
• What's in a name?, Cloudflare Blog
• CloudFlare wants to be a CDN for the masses, TechCrunch
• Unmetered Mitigation: DDoS protection without limits, Cloudflare Blog
• Introducing Cloudflare Workers, Cloudflare Blog
• Announcing 1.1.1.1, Cloudflare Blog
• Introducing Cloudflare Registrar, Cloudflare Blog
• Cloudflare acquires S2 Systems, announces Cloudflare for Teams, TechCrunch
• Announcing Cloudflare R2 Storage, Cloudflare Blog
• Workers AI: serverless GPU-powered inference, Cloudflare Blog
• Content Independence Day: no AI crawl without compensation, Cloudflare Blog
• Introducing pay per crawl, Cloudflare Blog
• Cloudflare to acquire Replicate, Cloudflare
• Astro joins Cloudflare, Cloudflare Blog
• Cloudflare acquires VoidZero, Cloudflare
• Cloudflare says AI made 1,100 jobs obsolete, even as revenue hit a record high, TechCrunch