Cloudflare made the middle matter.

A website owner asked for a bouncer. Cloudflare discovered it could also shorten the queue. In its 2010 private beta, the company was trying to keep malicious traffic away from websites. Investors worried that putting another service between a visitor and a server would slow everything down. Then users reported the opposite: their sites were loading, on average, 30% faster, according to Cloudflare's account of those tests. The extra stop had become a shortcut.

That surprise explains more about Cloudflare than its expanding product menu does. The company keeps finding things it can do because it already stands between two other things. First came websites and visitors. Then employees and company applications. Now developers and computing infrastructure, publishers and AI crawlers. The middle has become a business address.

01 The spam trap that grew teeth

The starting point was Project Honey Pot, built in 2004 by Matthew Prince and Lee Holloway to track how spammers harvested email addresses. Its community supplied an unusually useful complaint: knowing who the troublemakers were did not stop them arriving. Users wanted prevention. While studying at Harvard Business School, Prince met Michelle Zatlyn, who saw the opening. The three founded Cloudflare in 2009 and launched publicly at TechCrunch Disrupt in September 2010.

Their insight was practical. A service sitting in the traffic path could filter attacks while caching copies of static content. Fewer junk requests reached the original server; useful files could arrive from somewhere closer. Security and speed could share the machinery. The lesson for a founder is wonderfully specific: listen for the task customers keep asking you to finish.

02 A traffic stop with a workshop attached

For a website, Cloudflare can supply DNS, a content delivery network, DDoS protection, a web application firewall, and bot controls. These solve different problems: finding the site, fetching its files, absorbing hostile traffic, and checking requests before they reach the application. The expertise is in making these jobs operate together across a distributed network.

Workers, introduced in 2017, lets developers execute code on that network. R2 stores objects such as images and application files. Cloudflare One takes the same service approach into corporate connectivity: Access controls entry to applications; Gateway filters Internet traffic. The market spans application security, networking, and developer infrastructure. Akamai and Fastly overlap in delivery and security; Zscaler and Palo Alto Networks overlap in workforce security. Cloudflare's pitch is consolidation across these jobs.

Shopify makes that pitch tangible. Its Cloudflare customer story describes securing six million domains, provisioning certificates, and using Workers for storefront customization and its own marketing infrastructure. The attraction is administrative as much as technical: give merchants secure connections without making each merchant assemble a networking department.

“Cloudflare helps us find a simple way to achieve something very complex that we can scale and maintain.”

Duncan Davidson, Shopify VP of Developer Productivity

03 Free gets you in. Usage pays the rent.

Cloudflare combines free services, subscriptions, negotiated enterprise contracts, and metered developer products. Website Pro costs $20 a month with annual billing, or $25 month to month. Workers Paid has a $5 monthly minimum, with additional charges beyond included usage. R2 standard storage lists $0.015 per gigabyte-month, plus operation charges, with no Internet egress fee. Those are separate products and bills, not one all-inclusive subscription.

The scale is visible in the accounts. Revenue reached $2.168 billion in 2025. Second-quarter 2026 revenue was $696.1 million, up 36% from a year earlier; the GAAP operating loss was $205.7 million. Growth and profitability deserve separate sentences. Before its 2019 flotation, Cloudflare attracted investors including Venrock, NEA, Fidelity, and Franklin Templeton. Building the middle required substantial outside money.

04 The day the bouncer blocked the door

On November 18, 2025, a database permissions change caused duplicate entries in a configuration file used by Bot Management. The file grew beyond a software limit. A system meant to judge incoming traffic began disrupting it. Cloudflare initially suspected a large DDoS attack; investigation instead identified an internal failure. Core traffic was largely normal by 14:30 UTC, with all systems restored by 17:06.

Its December response, “Code Orange: Fail Small,” prioritized containing mistakes, including safer configuration handling and gradual deployment. Publishing detailed incident accounts fits its stated cultural value of transparency. The useful engineering lesson is sharper than “test more”: treat internally generated configuration as something that can be wrong, and make a broken component lose less of the system.

For customers, consolidation carries a corresponding obligation. Check which services share dependencies. Rehearse recovery. A Workers application must also fit documented runtime limits; a workload needing different memory or execution characteristics may need another architecture. A free plan carries different support and service commitments from a contract. The purchase decision starts with the consequences of interruption.

05 Who gets through when the visitor is a machine?

The next argument at the door concerns AI. Cloudflare introduced Pay Per Crawl in July 2025, offering publishers a way to charge participating crawlers. In September 2026 it announced Pay Per Use in beta: AI companies report content use, while Cloudflare handles billing and payouts. That distinction matters. A payment mechanism still needs buyers, reporting, and content they want.

October brought Basin, a generally available data platform built on Apache Iceberg and R2. The product range keeps widening, but the original question remains useful. Can an intermediary remove more work than it adds? Start with one measurable problem, compare the bill and performance, and test the escape route. Cloudflare's early customers found a faster website behind the shield. Today's customer has to establish the same bargain, one workload at a time.