CDN Tiers, Measured
Cloudflare free vs pro — what the paid tier actually changes for an ordinary site
The free tier is one of the best zero-cost tools in hosting, which makes the upgrade question genuinely hard. Here is what Pro changes that you can measure, and what it doesn't touch at all.
The short answer
Most sites should run the free tier and spend nothing: it proxies your traffic through the same global anycast network as every paid plan, caches static assets, terminates TLS, serves HTTP/3 and absorbs volumetric DDoS without metering. Pro earns its keep in two specific cases — you want the managed WAF rulesets in front of a CMS, or your pages are image-heavy and benefit from automatic WebP/AVIF conversion via Polish.
What neither tier changes by default is your HTML. Cloudflare passes page HTML through to your origin uncached unless you explicitly configure otherwise, so your time to first byte on dynamic pages is still your host's number. A CDN tier is a complement to origin speed, not a substitute for it.
By the HostingFast team · Reviewed 25 August 2026
Same
Anycast network underneath both tiers
0
HTML pages cached by default, on either tier
WAF
Managed rulesets — the Pro headline
Origin
Still sets TTFB on every uncached page
Cloudflare's free tier is unusual in this industry: the network is the same one enterprises use, the locations are the same, and the core mechanics — proxying, static caching, TLS, HTTP/3 — are all present. The paid tiers segment on features, not on speed of the pipe.
That makes 'should I pay?' a question about your specific site rather than about the network. This page itemises what Pro adds, what stays identical, and the quietly important default — uncached HTML — that decides how much any CDN tier can do for your Core Web Vitals.
What the free tier already does well
Static assets — images, CSS, JavaScript, fonts — are cached at the edge and served from the location nearest each visitor, which is most of a page's bytes handled. TLS is terminated at the edge with modern ciphers, HTTP/3 is available with a toggle, and volumetric DDoS absorption is unmetered on every tier.
For a text-and-code site on a fast origin, that list covers nearly everything a CDN can contribute. The free tier is not a trial; it is the product, minus specific features.
What Pro genuinely adds
The managed WAF is the substantive one: rulesets maintained against known CMS and framework exploits, applied at the edge before requests reach your origin. For a WordPress site with a public login and an ecosystem of plugins, that is a real reduction in surface, and it arrives without you writing rules.
The performance additions are image-centric: Polish converts images to WebP or AVIF on the fly and strips metadata; Mirage adapts image delivery to slow connections. Pro also brings Automatic Platform Optimization for WordPress, which caches HTML at the edge with awareness of logged-in users — the one Pro feature that directly attacks TTFB. Add richer analytics, and that is the honest inventory.
The default nobody notices: your HTML is not cached
Out of the box, both tiers treat HTML as dynamic and fetch it from your origin on every request. The visitor gets your stylesheet from a nearby edge node and your actual page from wherever your server lives, at whatever speed it answers. A slow origin behind Cloudflare is still a slow site — the waterfall simply starts with a well-dressed wait.
Edge-caching HTML is possible — via cache rules with sensible bypasses, or APO on WordPress — and transformative when it fits your site. But it must be configured deliberately, with logged-in and cart traffic excluded, and it remains the exception. For most sites the origin's TTFB stays the number that matters, whichever tier you pay for.
Deciding with a measurement instead of a feeling
Test from where your audience is, not from your own desk: run the same page through a testing tool from your visitors' region on the free tier, then trial Pro and re-run. Watch the cf-cache-status header — HIT on assets is the CDN working; DYNAMIC on HTML is the caveat above in the wild.
If TTFB barely moves between tiers, the bottleneck is your origin, and the money is better spent on hosting where the request is actually built. If images dominate your LCP element, Polish may move a number you care about. Let the waterfall choose.
A CDN in front deserves an origin that keeps up
Whichever tier you choose, every uncached request — HTML pages above all — travels to your origin and waits for it to think. Our platform answers with LiteSpeed serving cached pages from memory and NVMe under everything else, which is what makes the edge look good.
The two layers stack cleanly: Cloudflare shortens the trip for static assets while LiteSpeed's server cache eliminates PHP work at the origin. Sites running both see the edge handle the bytes and the origin handle the thinking, each doing the job it is placed for.
- LiteSpeed cache answering HTML before PHP wakes, so DYNAMIC doesn't mean slow
- NVMe under every uncached request the CDN passes through
- Free SSL at the origin, so end-to-end encryption is the default
- London platform — short trips for UK audiences even before the edge helps
Why HostingFast
Standard on every plan
Spend where the waterfall says
The free tier plus a fast origin outperforms a paid tier over a slow one. Measure first; the browser's network panel is impartial.
Compatible by default
Our stack sits behind Cloudflare cleanly — free or paid — with SSL modes and HTTP/3 working end to end.
Origin TTFB handled
Server-level caching keeps the number Cloudflare cannot fix — dynamic page generation — measured in milliseconds, not seconds.
Quick Start
From order to online
- 1
Baseline on the free tier
Proxy on, static caching working, HTTP/3 enabled. Record TTFB and LCP from your audience's region — this is the number Pro must beat.
- 2
Read your own waterfall
Image-heavy LCP points at Polish; a public CMS login points at the WAF; a slow DYNAMIC HTML fetch points at your origin, not at Cloudflare.
- 3
Trial Pro and re-measure the same pages
Same tool, same region, same URLs. Keep the tier if the numbers justify it; keep the free tier with a clear conscience if they don't.
Built In
Loaded onto every plan
- Proxy status actually on — grey-cloud DNS records get none of either tier's benefits
- cf-cache-status HIT confirmed on static assets before judging anything else
- HTML strategy decided consciously: origin-served, cache rules, or APO with bypasses
- SSL mode set to Full (strict) so edge security is not undone by a loose origin hop
- TTFB measured from the audience's region on both tiers before paying
- Origin cache verified separately — the CDN cannot fix what the server generates slowly
Frequently Asked
What people ask us most often
Does the free tier actually make my site faster?
For static assets, yes and measurably — they serve from an edge node near the visitor instead of your origin. For your HTML, no, not by default: page requests pass through to your server uncached, so time to first byte on dynamic pages is unchanged. That split explains most disappointment with CDN before/after tests.
What does the Pro WAF add over the free tier's protections?
The free tier absorbs volumetric DDoS and lets you write a handful of custom rules. Pro adds the managed rulesets — signatures for known CMS, plugin and framework exploits, maintained by Cloudflare and applied at the edge. For WordPress specifically, it is edge-level filtering of the attack traffic your login and xmlrpc endpoints see daily.
Is APO worth it for a WordPress site?
It is the one Pro-tier feature aimed squarely at TTFB: HTML cached at the edge with logged-in and commented visitors bypassed automatically. Sites with a distant, international audience gain the most. If your audience is concentrated near a fast origin — UK visitors on a London platform, say — the gain is smaller, because the origin was already close.
Does Cloudflare replace my host's server cache?
No — they cover different requests. Edge caching shortens the journey for whatever the edge holds; the server cache eliminates PHP work for everything that reaches the origin, including all HTML unless you have configured edge HTML caching. Run both: they compose rather than compete.
If my hosting is already fast, do I need Pro at all?
Often not for speed — a quick origin with server-level caching leaves Pro's performance features little to add unless images dominate your pages. The managed WAF is then the honest reason to upgrade, and it is a security decision rather than a performance one.
Keep reading
Secure hosting
What the origin should be doing about security before the edge is asked.
Fast origin hosting
LiteSpeed and NVMe behind the CDN — the half of the waterfall Cloudflare can't fix.
HTTP/2 vs HTTP/3
The transport both Cloudflare tiers offer, and where QUIC actually pays.
Hosting guides
More measured walkthroughs of the stack between visitor and database.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Give the edge an origin worth fronting
Whichever Cloudflare tier you run, uncached requests end at your host. Ours answers them with LiteSpeed and NVMe — migrate free and measure the difference.
View Secure hosting plans