Overview

Cloudflare, Inc. is a United States technology company headquartered in San Francisco that operates a large distributed network between internet users and the servers hosting online services. Its platform combines content delivery, authoritative and recursive DNS, reverse-proxy services, distributed denial-of-service mitigation, web application security, bot management, zero-trust access, network connectivity, developer infrastructure, and domain registration. The company’s basic architectural role is to receive and inspect traffic at the network edge before forwarding legitimate requests to a customer’s origin, allowing customers to improve availability and performance while filtering malicious or unwanted activity. Cloudflare was founded in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn. Its origins were connected to Project Honey Pot, an earlier effort to identify abusive internet activity. The founders initially pursued the idea of a cloud-hosted firewall and traffic-management layer; the Cloudflare name was chosen because it conveyed the concept of a firewall delivered through the cloud. The company attracted venture financing and developed a freemium model that helped it reach a broad base of websites, organizations, developers, and online communities. During the 2010s, Cloudflare expanded from CDN and DDoS protection into DNS, application security, analytics, and developer services. It introduced high-profile public services such as the 1.1.1.1 DNS resolver and later WARP, a consumer connectivity and privacy product. Cloudflare Workers, launched in 2017, extended the company’s role from traffic intermediary to edge-computing provider by allowing developers to execute code close to users without managing conventional server infrastructure. Pages, Workers KV, D1, and related tools broadened that developer platform. Cloudflare became a public company on the New York Stock Exchange in September 2019 under the symbol NET. Its later strategy increasingly emphasized a unified edge platform spanning application delivery, cybersecurity, enterprise networking, and software development. The company launched or expanded products such as Access, Gateway, Turnstile, Cloudflare for Teams, Cloudflare One, Area 1 email security, Workers AI, Firewall for AI, and Cloudforce One. It has also acquired specialist businesses in web security, networking, developer tooling, and artificial intelligence. The company has become prominent in debates about intermediary responsibility and content neutrality. Cloudflare has generally argued that infrastructure providers should not act as broad arbiters of lawful speech, while acknowledging that it may terminate service in exceptional circumstances involving direct links to violence or other serious abuse. It removed service from sites including The Daily Stormer, 8chan, and Kiwi Farms after controversies and public pressure. Cloudflare has also faced criticism and litigation over whether infrastructure providers should bear responsibility when customers use its network to distribute allegedly infringing material. Cloudflare’s public-interest programs include Project Galileo, which provides free protection to vulnerable organizations such as journalists, activists, humanitarian groups, and human-rights organizations, and the Athenian Project, which extends protection to electoral and political infrastructure. The company also provides services for the .gov domain under a government contract and has participated in education and campaign-security initiatives. Its present business spans consumer services, small and large enterprises, public-sector institutions, developers, and internet platforms across global markets. The company became prominent in debates over intermediary liability and content neutrality. Cloudflare generally argued that infrastructure providers should not become broad arbiters of lawful speech, while acknowledging that it might terminate service in exceptional cases tied directly to violence or other serious abuse. Following controversy and public pressure, it terminated service to sites including The Daily Stormer, 8chan, and Kiwi Farms. Cloudflare has also faced criticism and litigation over whether infrastructure providers should be liable when customers use their networks to distribute allegedly infringing material.

History

Cloudflare was founded on July 26, 2009, by Matthew Prince, Lee Holloway, and Michelle Zatlyn. Prince and Holloway had previously worked on Project Honey Pot, which gathered information about malicious internet activity. That experience helped shape Cloudflare’s initial concept: a cloud-based layer that could identify hostile traffic, protect websites, and improve delivery without requiring each customer to operate specialized security hardware. The company’s early service combined reverse-proxy networking, caching, DNS, analytics, and DDoS defense. This model placed Cloudflare between visitors and customer origins. Legitimate requests could be routed through the company’s global network, while suspicious traffic could be challenged, rate-limited, or blocked. A free entry tier made the service accessible to smaller websites, while paid plans added more controls and support. Cloudflare’s role grew as websites increasingly faced automated abuse, traffic surges, application attacks, and geographically distributed audiences. Cloudflare gained particular attention through its DDoS mitigation work. In 2011 it provided protection to LulzSec, which generated debate about whether infrastructure companies should serve controversial customers. In 2013, while defending the Spamhaus Project, Cloudflare reported an attack exceeding 300 gigabits per second, then regarded as one of the largest publicly disclosed attacks. The company later reported attacks of roughly 400 and 500 gigabits per second, followed by increasingly large incidents measured in terabits per second. These events helped establish Cloudflare as a visible participant in the internet-security industry. The company broadened its portfolio through acquisitions and product development. StopTheHacker and CryptoSeal added security and privacy capabilities, while Neumob, S2 Systems, Linc, Zaraz, Vectrix, Area 1 Security, Nefeli Networks, BastionZero, and Kivera contributed technologies in mobile optimization, application delivery, email security, networking, and zero-trust access. In parallel, Cloudflare introduced 1.1.1.1, a public DNS resolver, and WARP, a consumer-facing connectivity service. Cloudflare Workers, introduced in 2017, was a major strategic turning point. It enabled developers to run JavaScript and other supported workloads on Cloudflare’s edge locations, reducing dependence on centralized application servers. The company subsequently added storage, scheduling, database, static-site deployment, and developer-tooling capabilities. Workers became the center of a broader application platform rather than merely an extension of CDN delivery. Cloudflare went public in 2019. In 2020, co-founder Michelle Zatlyn became president, and the company intensified its enterprise-security strategy. Cloudflare for Teams combined secure DNS, web gateways, and identity-aware access controls; this direction later became part of Cloudflare One and the company’s SASE offering. Turnstile was developed as a less intrusive alternative to traditional visual CAPTCHAs, while Area 1 added protection against phishing email. Public-interest and civic-security work has remained part of the company’s identity. Project Galileo supplies no-cost protection to organizations exposed because of their public-interest work, and the Athenian Project extends similar assistance to election-related infrastructure. Cloudflare has also supported political campaigns, schools, government domains, and humanitarian organizations. From 2023 onward, Cloudflare invested heavily in artificial-intelligence infrastructure. Workers AI allowed customers to use machine-learning models through the edge network. The company introduced tools for detecting and controlling AI crawlers, AI Labyrinth for misleading unauthorized scrapers with generated material, AutoRAG for querying website content, and Firewall for AI for protecting model-enabled applications. Acquisitions such as Replicate and Human Native further connected the company to model deployment and AI-data markets. The company also continued expanding its developer ecosystem through planned or completed acquisitions involving Astro and VoidZero, while emphasizing open-source projects and edge-based application development. Cloudflare’s history is also marked by disputes over content moderation and intermediary liability. It has defended a general content-neutrality approach but has withdrawn services from selected sites associated with hate speech, extremist activity, or violence. The company has faced copyright-related criticism and litigation involving customers accused of infringement. Its continuing challenge is to reconcile an infrastructure-provider identity with pressure from governments, rights holders, security researchers, and civil-society groups to take responsibility for how its network is used.

2025
Cloudforce One launches
[1]Cloudflareen.wikipedia.org
Cloudflare introduced a threat-events platform using intelligence derived from activity observed across its network.
2024
Firewall for AI announced
[1]Cloudflareen.wikipedia.org
Cloudflare announced controls intended to protect applications that incorporate large language models.
2023
Workers AI launches
[1]Cloudflareen.wikipedia.org
Cloudflare introduced a framework for running AI inference through its edge infrastructure.
2022
Area 1 Security acquisition
[1]Cloudflareen.wikipedia.org
Cloudflare acquired Area 1 Security to strengthen phishing and email-security capabilities.
2020
Cloudflare One strategy expands
[1]Cloudflareen.wikipedia.org
The company introduced Cloudflare for Teams and expanded its secure-access and SASE strategy.
2019
Initial public offering
[1]Cloudflareen.wikipedia.org
Cloudflare listed on the New York Stock Exchange under the symbol NET.
2018
1.1.1.1 public DNS launches
[1]Cloudflareen.wikipedia.org
Cloudflare introduced a public recursive DNS resolver marketed around speed and privacy.
2017
Workers launches
[1]Cloudflareen.wikipedia.org
Cloudflare introduced its edge-computing platform for deploying code close to users.
2014
Project Galileo launches
[1]Cloudflareen.wikipedia.org
Cloudflare began offering free protection to vulnerable public-interest organizations, including journalists, activists, and human-rights groups.
2013
Spamhaus DDoS incident
[1]Cloudflareen.wikipedia.org
Cloudflare reported mitigating an attack against Spamhaus that exceeded 300 gigabits per second.
2011
LulzSec protection controversy
[1]Cloudflareen.wikipedia.org
Cloudflare’s DDoS protection for LulzSec brought early public attention to the policy questions surrounding neutral infrastructure providers.
2009
Cloudflare is founded
[1]Cloudflareen.wikipedia.org
Matthew Prince, Michelle Zatlyn, and Lee Holloway founded Cloudflare around a cloud-based firewall and internet traffic-management concept.

Products and positioning

A global edge platform positioned around making the internet faster, safer, more reliable, and more programmable.

Content delivery and edge networking · 2009
Cloudflare CDN
Cloudflare’s CDN caches and serves web content from a distributed edge network, reducing latency and helping websites absorb traffic spikes. Its reverse-proxy architecture also gives customers a common control point for traffic inspection, TLS termination, routing, caching, and security policies.
Cybersecurity · 2009
DDoS Protection
Cloudflare provides network- and application-layer defenses against distributed denial-of-service attacks. The service uses the company’s globally distributed capacity to absorb, filter, rate-limit, and block attack traffic before it reaches a customer’s origin infrastructure.
Edge computing · 2017
Cloudflare Workers
Workers is a serverless edge-computing environment that lets developers deploy application logic near end users. It has expanded with storage, scheduled execution, databases, AI inference, and other tools intended to support full applications on Cloudflare’s network.
DNS and consumer connectivity · 2018
1.1.1.1
1.1.1.1 is Cloudflare’s public recursive DNS resolver. It is designed to provide fast name resolution and privacy-oriented handling of DNS queries, and is associated with the company’s broader consumer connectivity offerings.
Enterprise security and SASE · 2020
Cloudflare One
Cloudflare One brings together identity-aware access, secure web gateways, network connectivity, DNS filtering, browser isolation, email security, and related controls. It is positioned as a cloud-delivered alternative to conventional perimeter-based enterprise security architectures.
Fraud prevention · 2022
Turnstile
Turnstile is a CAPTCHA alternative that evaluates browser and interaction signals to distinguish people from automated abuse without generally requiring users to solve visual puzzles. It is designed for websites and applications that need low-friction visitor verification.
Artificial-intelligence infrastructure · 2023
Workers AI
Workers AI provides access to machine-learning inference through Cloudflare’s edge infrastructure, allowing developers to integrate supported models into applications without directly operating GPU servers. It forms part of the company’s broader AI application and developer platform.
Public-interest cybersecurity · 2014
Project Galileo
Project Galileo supplies no-cost security and performance services to organizations such as independent media outlets, activists, humanitarian groups, and human-rights organizations that may be targeted because of their work.

Controversies

2025
Copyright liability litigation
Cloudflare faced litigation concerning alleged copyright infringement by websites using its services, including a reported loss in a case brought by Japanese publishers. The dispute challenged the limits of intermediary protection for infrastructure providers.
Source
2022
Kiwi Farms termination
Cloudflare terminated service to Kiwi Farms following sustained allegations that the forum facilitated targeted harassment and threats. The case renewed discussion of Cloudflare’s exceptional-termination standards.
Source
2020
Cloudflare family DNS filter blocked some LGBT and sex education sites
Cloudflare's initial adult-content filter for 1.1.1.1 for Families prevented users from visiting certain LGBT and sex education sites. CEO Matthew Prince called it a mistake and said the company was working to remedy it.
Source
2020
Deniece Waidhofer sues Cloudflare and other defendants over alleged piracy
Model Deniece Waidhofer filed a lawsuit alleging that Thothub, Cloudflare, and other defendants were involved in copyright infringement and a RICO conspiracy related to the distribution of her content. The article reports allegations, not a court determination.
Source
2019
8chan termination
Cloudflare stopped providing service to 8chan after the site was linked in public debate to extremist content and mass-shooting manifestos.
Source
2019
Takeshobo sues Cloudflare in Japan
Takeshobo filed a civil action against Cloudflare at the Tokyo District Court, alleging copyright infringement. Takeshobo said it took legal action after requests to remove content offered by a Cloudflare customer were ignored.
Source
2017
The Daily Stormer termination
Cloudflare terminated service to The Daily Stormer after the white-nationalist website published material connected to violence and harassment. The decision intensified debate over whether Cloudflare should act as a content moderator.
Source
2011
LulzSec service controversy
Cloudflare drew criticism after providing DDoS protection to LulzSec, a hacking group. The episode became an early example of the tension between Cloudflare’s infrastructure-neutrality position and demands that providers deny service to abusive customers.
Source

Marketing campaigns

2023Project Cybersafe Schools
United States
Cloudflare began a school-security initiative supported by an Amazon Web Services grant program, making no-cost cybersecurity services available to eligible public-school districts. It expanded Cloudflare’s education-sector public-interest activity.
Outcome. Expanded Cloudflare’s education-sector public-interest activity.
Source
2020Cloudflare for Campaigns
United States
Cloudflare offered political campaigns access to security tools, later expanding the initiative to include secure email capabilities. It became part of the company’s civic and election-security work.
Outcome. Became part of the company’s civic and election-security work.
Source
2017Athenian Project
United States
Cloudflare extended free security support to election-related infrastructure and political campaigns, focusing on protecting democratic institutions from cyberattacks. It expanded into election and campaign protection.
Outcome. Expanded into election and campaign protection.
Source
2014Project Galileo
Worldwide
Cloudflare provides free CDN, DDoS protection, and related services to vulnerable public-interest organizations. The program is intended to help groups remain available during politically motivated attacks and other hostile activity. It continued as a long-running public-interest program with thousands of participating organizations.
Outcome. Continued as a long-running public-interest program with thousands of participating organizations.
Source

Brand decisions

2025
Build controls for AI crawlers and model accessStrategy
Background
Website owners increasingly sought control over automated AI scraping and the commercial use of their content.
Action taken
Cloudflare introduced AI Labyrinth, AI crawler controls, AutoRAG, and plans for mechanisms allowing website operators to manage or monetize model access.
Aftermath
The company increasingly positioned its network as an intermediary between publishers and AI developers.
Source
2023
Expand into edge AI with Workers AIProduct launch
Background
Demand for application-embedded AI created an opportunity to use Cloudflare’s distributed infrastructure for model inference.
Action taken
Cloudflare launched Workers AI with access to supported models and GPU-backed inference through its network.
Aftermath
AI became a major component of Cloudflare’s developer-platform and infrastructure roadmap.
Source
2020
Develop a unified SASE and zero-trust platformStrategy
Background
Traditional corporate network perimeters were giving way to identity-based, cloud-delivered security models.
Action taken
Cloudflare combined Gateway, Access, DNS filtering, and related tools under Cloudflare for Teams and later Cloudflare One.
Aftermath
The strategy positioned Cloudflare as an enterprise networking and security provider as well as a CDN company.
Source
2019
List on the New York Stock ExchangeOther
Background
Cloudflare required public-market capital and visibility to support expansion of its global infrastructure and product portfolio.
Action taken
The company completed its initial public offering under the ticker NET.
Aftermath
Cloudflare became a publicly traded company and continued expanding across enterprise security, networking, and developer services.
Source
2017
Launch Cloudflare WorkersProduct launch
Background
Cloudflare sought to move beyond traffic delivery and offer developers programmable services on its global network.
Action taken
The company introduced a serverless edge-computing platform for running code close to users.
Aftermath
Workers became a central part of Cloudflare’s developer and application-platform strategy.
Source

Recent events

2026
Cloudflare acquires Human Native[1]Cloudflareen.wikipedia.org
M&A
The company acquired an AI data marketplace that facilitates transactions between content creators and AI developers.
2026
Cloudflare announces workforce restructuring[1]Cloudflareen.wikipedia.org
Leadership change · Other
The company announced a substantial workforce reduction attributed to changing work patterns and rapid adoption of artificial-intelligence tools.
2025
Cloudflare reports major DDoS attacks exceeding 11 terabits per second[1]Cloudflareen.wikipedia.org
Other
Cloudflare said it mitigated exceptionally large volumetric attacks, including an attack reported at 11.5 terabits per second.
2025
Cloudflare agrees to acquire Replicate[1]Cloudflareen.wikipedia.org
M&A
Cloudflare announced an agreement to acquire Replicate, a platform for running and deploying machine-learning models through an API.
2024
Cloudflare launches Firewall for AI[1]Cloudflareen.wikipedia.org
Product launch · Other
Cloudflare introduced a security product intended to protect applications using large language models from abuse and attacks.
2023
Cloudflare reports record-scale HTTP DDoS mitigation[1]Cloudflareen.wikipedia.org
Other
The company reported blocking a DDoS campaign reaching approximately 71 million requests per second.
2020
Cloudflare launches Cloudflare One and Teams security services[1]Cloudflareen.wikipedia.org
Product launch
Cloudflare expanded into enterprise zero-trust networking through Gateway, Access, and its broader SASE platform.
2019
Cloudflare files for initial public offering[1]Cloudflareen.wikipedia.org
Other
Cloudflare submitted its registration statement for a New York Stock Exchange listing under the ticker NET.
2019
Cloudflare begins public trading[1]Cloudflareen.wikipedia.org
Other
The company opened for trading on the New York Stock Exchange in September 2019.