Cloudflare
| Company type | Public |
|---|---|
| Industry | Information and communications technology (ICT) |
| Founded | July 26, 2009 |
| Founder | Matthew Prince, Lee Holloway, Michelle Zatlyn |
| Headquarters | San Francisco, California , United States |
Area served | Worldwide |
Key people | Matthew Prince (CEO and co-chair), Michelle Zatlyn (co-chair and president), John Graham-Cumming (CTO) |
| Products | Content delivery networks, cybersecurity solutions, DDoS protection, wide area networking, reverse proxy technology, domain registration (ICANN accredited), Cloudflare Workers, WARP VPN, Cloudflare One SASE platform |
Number of employees | 4,263 (2024) |
| Website | www |
Cloudflare, Inc. is a U.S.-based technology firm that specializes in services such as content delivery networks, cybersecurity solutions, DDoS protection, wide area networking, reverse proxy technology, and domain registration accredited by ICANN. Its headquarters are located in San Francisco, California. As of 2025, Cloudflare secures about 19.3% of websites worldwide through its web protection offerings.
The company’s suite of products features the well-known 1.1.1.1 service alongside a variety of solutions designed for both enterprise clients and individual users. Listed publicly on the New York Stock Exchange under the symbol NET, Cloudflare is also included in the Russell 1000 index. By 2024, it employed 4,263 staff members and reported revenues totaling $1.669 billion.
Cloudflare’s operational model centers on delivering scalable internet infrastructure combined with security services aimed at improving online speeds and defending against cyberattacks. Its expansion strategy includes acquiring companies such as Area 1 Security to broaden its service range and increase market penetration. Although it recorded operational losses in 2024, the company continues to demonstrate robust growth in assets and equity, underscoring its commitment to technological advancement and international expansion.
Leadership at Cloudflare features co-chairs and the CEO, supported by CTO John Graham-Cumming, who collectively steer the firm’s strategic direction and innovation efforts within the ICT sector.
History
Established on July 26, 2009, Cloudflare was founded by Matthew Prince, Lee Holloway, and Michelle Zatlyn. Prior to Cloudflare, Prince and Holloway worked together on Project Honey Pot, which laid the groundwork for the company’s foundational concept. From its early days, Cloudflare secured venture capital funding. On August 15, 2019, it submitted paperwork for an initial public offering on the New York Stock Exchange under the ticker NET, with shares launching at $15 each on September 13, 2019.
In 2020, Michelle Zatlyn advanced from COO to president, marking a significant step in executive leadership.
Cloudflare has grown its footprint by acquiring multiple companies specializing in web services and cybersecurity: StopTheHacker (2014), CryptoSeal (2014), Eager Platform Co. (2016), Neumob (2017), S2 Systems (2020), Linc (2020), Zaraz (2021), Vectrix (2022), Area 1 Security (2022), Nefeli Networks (2024), BastionZero (2024), and Kivera (2024). These strategic purchases have strengthened its product lineup and competitive positioning in cloud security and performance sectors.
Since 2017, Cloudflare’s headquarters have utilized an inventive encryption technique involving lava lamps as a hardware-based random number generator for cryptographic keys—an unusual yet effective component of its secure technology infrastructure supporting global operations.
By the end of Q4 2022, Cloudflare counted 162,086 paying customers, reflecting notable expansion and influence within cybersecurity and cloud computing markets.
Products
Cloudflare delivers an array of network and security solutions catering to both individual users and businesses. Its technology employs edge computing, reverse proxy configurations, data center interconnections, and a global content delivery network to ensure efficient content distribution. Supported protocols include TCP, UDP, QUIC alongside application layer protocols such as DNS over HTTPS, SMTP, and HTTP/2 with Server Push capabilities. In 2023 alone, Cloudflare handled an average of 45 million HTTP requests every second.
By 2024, the company upgraded its server infrastructure with AMD EPYC 9684X processors to significantly boost performance levels. Additionally, Cloudflare provides detailed analytics during major service disruptions like Verizon’s outage in October 2024.
Artificial intelligence
In 2023, Cloudflare unveiled "Workers AI," which integrates Nvidia GPUs across its network of nearly 300 data centers. The following year, the company rolled out solutions to counteract AI-powered bot scraping by scrutinizing bot and crawler behaviors to create automated detection algorithms. Additionally, an AI assistant capable of producing charts through "Workers AI" was introduced.
By September 2024, Cloudflare launched a marketplace enabling website operators to monetize access granted to AI model providers for content scraping purposes, alongside releasing AI Audit—a tool designed to analyze and block AI scrapers. In March 2025, the firm debuted "AI Labyrinth," a feature that defends against unauthorized AI data harvesting by delivering misleading AI-generated content specifically to large language model bots.
DDoS mitigation
Cloudflare provides both complimentary and premium DDoS mitigation solutions aimed at shielding clients from distributed denial-of-service attacks. The company first attracted significant media coverage in June 2011 after defending the website of LulzSec, a notorious black hat hacking collective, from such attacks.
In March 2013, Cloudflare disclosed its role in protecting The Spamhaus Project during a DDoS assault surpassing 300 Gbit/s, which at that time was the largest publicly reported attack of its kind. During this incident, Cloudflare itself became a target, with major technology firms like Google assisting Spamhaus in managing the traffic surge.
The year 2014 saw the launch of "Project Galileo," offering free DDoS protection services to artists, activists, journalists, and human rights groups. This initiative broadened in 2017 with the introduction of the "Athenian Project," extending coverage to electoral infrastructure and political campaigns. By 2025, more than 2,900 organizations—including 31 US states—had joined Project Galileo.
Cloudflare has successfully mitigated several record-setting attacks: a 400 Gbit/s NTP reflection attack in Europe (2014), a 500 Gbit/s attack in Hong Kong (2014), and a massive 1.2 Tbit/s assault in 2021. In February 2023, it defended against the largest recorded HTTP DDoS attack, peaking at 71 million requests per second. Most recently, in October 2024, Cloudflare blocked the greatest publicly documented volumetric DDoS attack with a peak volume of 5.6 terabits per second.
These prominent defenses highlight Cloudflare’s strong position and leadership within the global cybersecurity landscape for DDoS protection services.
Edge computing
Cloudflare introduced Cloudflare Workers in 2017, a serverless computing platform that allows developers to build applications without managing underlying infrastructure. This platform later expanded to include Workers KV, a low-latency key-value storage system; Cron Triggers for scheduling tasks; and various developer tools supporting worldwide deployment and scalability.
In 2020, Cloudflare launched "Pages," a JAMstack platform designed for deploying websites on its Edge network. Two years later, in 2022, it announced D1—an Edge SQL database based on SQLite technology.
August 2023 marked Cloudflare’s collaboration with IBM to deliver bot management solutions safeguarding IBM Cloud clients. During the same month, SpaceX engaged Cloudflare to improve Starlink’s performance, while Cloudflare also introduced Cloudflare Fonts as a competitor to Google Fonts.
Internet security
In April 2020, Cloudflare transitioned from using reCAPTCHA to hCaptcha, prioritizing user privacy. By September 2022, the company initiated trials for Turnstile, a machine learning-driven CAPTCHA alternative compliant with GDPR, designed to automate user verification.
Under a $7.2 million agreement with the Cybersecurity and Infrastructure Security Agency (CISA), Cloudflare manages registry and authoritative DNS functions for the .gov domain. Its Cloudflare for Campaigns initiative provides complimentary cybersecurity resources to political campaigns, later broadening in 2025 to include protection for email infrastructures.
November 2020 marked the debut of Cloudflare for Teams, which incorporates a DNS resolver and zero-trust authentication to secure enterprise networks without compromising speed or efficiency.
In January 2023, Cloudflare collaborated with PhonePe to enhance mobile payment security. The following month, it launched Wildebeest, a platform that allows Mastodon users to host their instances on Cloudflare’s infrastructure.
August 2023 introduced Project Cybersafe Schools, supported by a $20 million grant from AWS, delivering free cybersecurity services to approximately 70% of public school districts across the United States.
March 2024 saw the release of Firewall for AI, a solution aimed at safeguarding applications utilizing large language models (LLMs). In September of the same year, Cloudflare rolled out Ephemeral IDs to improve fraud detection by associating user behavior through temporary identifiers instead of IP addresses. Additionally, it made its DNS resolvers freely accessible to ISPs and hardware manufacturers.
In March 2025, Cloudflare unveiled Cloudforce One, a threat events platform that offers real-time visibility into cyberattacks by leveraging data from its worldwide network.
SASE
Cloudflare One, the company’s premier Secure Access Service Edge (SASE) platform, was launched in October 2020. The acquisition of Area 1 Security in February 2022 strengthened its capabilities in anti-phishing email protection. In March 2024, Cloudflare further expanded its cloud networking suite by acquiring Nefeli Networks, co-founded by computer scientist Sylvia Ratnasamy.
VPN
Cloudflare introduced its VPN service WARP in 2019, built upon an open-source WireGuard protocol implemented in Rust. This service aligns with Cloudflare’s commitment to advancing privacy-centric network solutions.
Other services
In January 2021, Cloudflare provided its "Waiting Room" digital queuing system free of charge for COVID-19 vaccine appointment scheduling under the "Project Fair Shot" initiative, which earned the Webby People’s Choice Award for Event Management in 2022.
By March 2023, Cloudflare pledged to offer post-quantum cryptography at no cost to cloud platforms and internet applications, bolstering its leadership in security innovation.
September 2024 witnessed the introduction of Speed Brain and Instant Purge features aimed at minimizing page load delays through content prefetching and cache invalidation within 150 milliseconds, enhancing both user experience and operational performance.
Moreover, during 2024, Cloudflare began beta testing integration with Stripe Link as a new payment method option, indicating strategic growth into payment processing services.
Unauthorized Access
On June 1, 2012, the hacker collective UGNazi infiltrated the accounts of Cloudflare's CEO, Matthew Prince, redirecting traffic from 4chan to UGNazi's Twitter page. The group employed social engineering tactics to gain access to Prince's voicemail through AT&T customer support and exploited a flaw in Cloudflare's Google-based two-factor authentication system. This breach enabled them to take control of Prince’s email and manipulate 4chan’s domain settings within Cloudflare's infrastructure.
Data Exposure from 2016 to 2017
Between September 2016 and February 2017, a significant vulnerability known as Cloudbleed caused Cloudflare to inadvertently leak confidential information—such as passwords and authentication tokens—from client websites by including unintended data in web responses.
Controversies
Cloudflare upholds a policy of content neutrality, resisting censorship of its clients on free speech principles unless legal statutes are violated. The company has encountered criticism for not banning hate speech or websites associated with terrorist organizations but maintains that no law enforcement agency has formally requested service termination and that it complies fully with U.S. legal requirements.
In 2022, research conducted by Stanford identified Cloudflare as a leading CDN provider disproportionately servicing websites spreading misinformation. Furthermore, the company has been scrutinized for enabling access to far-right content through its services.
The Daily Stormer
Cloudflare once provided DNS routing and protection against DDoS attacks to the white supremacist and neo-Nazi platform, The Daily Stormer. In 2017, the company discontinued its services after the site alleged that senior Cloudflare executives secretly endorsed their ideology.
Prior to this decision, Cloudflare had refrained from taking action against the website. Founder and CEO Matthew Prince acknowledged the site's content as "vile" but hesitated to make unilateral decisions about its removal, emphasizing concerns about due process and fairness in content moderation. Identifying as a "free speech absolutist," Prince sought to implement safeguards protecting the company from similar challenges in the future.
Prince also warned about the dangers of large corporations wielding excessive control over online content—a concern shared by civil liberties organizations and privacy advocates. The Electronic Frontier Foundation argued that companies like Cloudflare should not be arbiters of acceptable speech, advocating instead for legal systems to address unlawful acts such as incitement or defamation.
Mass Shootings and 8chan
In 2019, Cloudflare faced backlash for continuing to provide services to the far-right message board 8chan, which was linked to multiple mass shootings in the United States and the Christchurch mosque shootings in New Zealand. Investigations also revealed that the platform hosted discussions involving child exploitation material.
A spokesperson for Cloudflare clarified that the company "does not host the referenced websites, cannot block websites, and is not in the business of hiding companies that host illegal content." Nevertheless, Cloudflare terminated its support for 8chan only after mounting public outcry and legal pressure following the 2019 El Paso shooting, where the perpetrator’s manifesto was published on 8chan. Initially, CEO Matthew Prince defended keeping 8chan operational, citing a "moral obligation."
On August 5, 2019, Cloudflare officially withdrew its services from 8chan, which subsequently relocated its forums to the dark web. The company stated that 8chan had "demonstrated itself as lawless," being connected to several tragic incidents. Prince described the El Paso attack as "abhorrent" and affirmed that removing support for 8chan was "the right thing to do."
Kiwi Farms
Cloudflare served as a reverse proxy and provided DDoS protection for Kiwi Farms, a far-right online forum notorious for harassment, doxxing, and transphobic material. The platform has been associated with several suicides linked to harassment victims and accused of orchestrating swatting incidents against vulnerable people. While Cloudflare was not the site's primary host, its services played a vital role in shielding Kiwi Farms from denial-of-service attacks and enhancing content delivery performance.
In 2022, transgender advocate Clara Sorrenti, who had previously been targeted by the forum, spearheaded a campaign urging Cloudflare to discontinue support for Kiwi Farms. Initially, Cloudflare defended its position by comparing its offerings to a public utility and underscoring its dedication to free expression despite the site's offensive nature. The company also noted that all revenue generated from platforms opposing LGBTIQ+ rights is donated to organizations championing those rights. Although their terms of service permit termination when content reveals sensitive personal data or incites violence, Cloudflare faced backlash for not adequately addressing how Kiwi Farms’ doxxing activities breached these policies.
On September 3, 2022, Cloudflare terminated services for Kiwi Farms, citing an "unprecedented emergency and immediate threat to human life" due to escalating violent threats originating from the forum. CEO Matthew Prince emphasized concerns about law enforcement's capacity to respond promptly. This move represented a notable change in Cloudflare’s leadership strategy and its approach toward managing controversial clients worldwide.
Switter
Switter was a social networking platform designed specifically for the sex worker community, developed by Assembly Four in Australia using Mastodon's open-source framework. In April 2018, Cloudflare withdrew its services from Switter shortly after the enactment of FOSTA/SESTA, legislation criminalizing websites that facilitate sex trafficking. This law diminished legal protections for internet infrastructure providers and drew criticism for its adverse effects on free speech and the livelihoods of sex workers.
Cloudflare characterized its decision as stemming from an evolving understanding of FOSTA, describing it as "a very bad law" that established a troubling precedent. Assembly Four expressed disappointment, highlighting Cloudflare's previous advocacy for privacy and freedom alongside the Electronic Frontier Foundation (EFF) and had hoped for opposition to FOSTA/SESTA. This incident illustrates the difficulties platforms serving marginalized groups face amid changing regulatory environments.
Terrorism
In 2015, testimony before the United States House Committee on Foreign Affairs revealed that two of the top three online chat forums and nearly forty additional websites associated with the Islamic State of Iraq and the Levant (ISIL) were utilizing Cloudflare's services.
By 2018, The Huffington Post reported that Cloudflare supported at least seven terrorist organizations designated by the United States Department of State, including Al-Shabaab, the Taliban, the Popular Front for the Liberation of Palestine, al-Quds Brigades, the Kurdistan Workers' Party (PKK), al-Aqsa Martyrs' Brigades, and Hamas. Doug Kramer, Cloudflare’s general counsel, stated that the company collaborates with government agencies to fulfill legal requirements but declined to discuss specific instances.
In September 2019, Cloudflare revealed in their Form S-1 filing that their technology had been employed "by, or for the benefit of," entities blacklisted under U.S. economic and trade sanctions programs, including those enforced by OFAC targeting counter-terrorism, counter-narcotics efforts, or governments subject to comprehensive U.S. sanctions.
Crime
The Spamhaus Project has identified Cloudflare as a significant host for numerous cybercriminal botnet activities. According to a report from October 2015, Cloudflare was responsible for issuing 40% of the SSL certificates utilized by typosquatting phishing websites that targeted financial institutions and payment services. The company has drawn criticism for offering DDoS protection to both the perpetrators and victims of "stresser" platforms, which raised concerns about potential conflicts of interest.
In 2018, the European Union's Counterfeit and Piracy Watch List designated Cloudflare as a facilitator of "notorious market" activities related to counterfeiting and piracy. The report highlighted that Cloudflare masks the identities of operators behind 40% of worldwide pirate websites and 62% of the top 500 such sites. It also condemned Cloudflare for insufficient due diligence in preventing illicit sites from leveraging its infrastructure.
An Italian court ruling in 2020 mandated Cloudflare to block certain domain names and IP addresses connected to the pirate IPTV service "IPTV THE BEST," which infringed on Lega Serie A intellectual property rights; at that point, Cloudflare was already restricting access to 22 domain names within Italy. Similarly, German courts held Cloudflare responsible for facilitating copyright violations by anonymizing infringing websites.
Following a court decision in December 2024, Spain’s football league LaLiga requested telecom providers in February 2025 to block Cloudflare IP ranges after sites hosted by Cloudflare unlawfully streamed matches. This action resulted in the shutdown of DuckVision, a pirate platform with approximately 200,000 users supported by Cloudflare. The imposed blocks also impacted prominent platforms such as X, Vimeo, Steam, GitHub, and the Real Academia de la Lengua Española.
Response to the Russian invasion of Ukraine
In response to Russia's 2022 invasion of Ukraine, Ukrainian Vice Prime Minister and Minister of Digital Transformation Mykhailo Fedorov, among others, called on Cloudflare to halt its services in Russia due to the use of its content delivery network by Russian disinformation outlets. However, Cloudflare CEO Matthew Prince opted to maintain operations within Russia, aiming to prevent the creation of a "digital iron curtain" and ensure Russian citizens’ access to information. Prince stressed that discontinuing services would disproportionately harm ordinary users and activists rather than the Russian government itself. The company disclosed minimal revenue from Russia and terminated accounts associated with sanctioned organizations.
Cloudflare’s Project Galileo, initiated in 2014 to offer complimentary DDoS protection for NGOs, was extended in 2022 to provide free security services to Ukrainian government bodies and telecommunications providers, reinforcing its dedication to safeguarding essential infrastructure amid ongoing conflict.