Cloudflare Zero Trust Review 2026: Free for 50 Users, $7 Seats and the Limits That Bite
Cloudflare Zero Trust is free for 50 users and about $7 a seat after that. We review Access, Tunnel, Gateway and the add-ons, and the 24-hour logs, seat blocking and Enterprise-only DLP that come with the price.
Cloudflare Zero Trust is the business security platform Cloudflare sells under the Cloudflare One name: identity-aware access to private apps, a secure web gateway, an endpoint client, browser isolation, CASB and DLP, all running on the same network that fronts a large share of the web. Its headline is hard to match - the published pricing is free for up to 50 users and about $7 per user per month after that.
The catch is in what the free tier keeps and what it leaves out. Logs on the free plan last 24 hours, support is the community forum, DLP is an Enterprise add-on, Browser Isolation is a paid add-on, and when the seats in a subscription run out, new users are simply blocked at login. This review weighs the generous entry price against those limits, using Cloudflare's own documentation as the source for every figure.
This is a review of the business Zero Trust platform, not the free consumer 1.1.1.1 + WARP app, which is a different product.
What Cloudflare Zero Trust actually is
Cloudflare describes Cloudflare One as its single-vendor SASE platform. The Zero Trust part - what Cloudflare calls workspace security services - is the piece most small and mid-sized teams buy, and it is built from several components that share one dashboard and one policy engine.
- Access - authenticates users before they reach an application, onboards third-party users and logs every request.
- Cloudflare Tunnel - outbound-only connections from your servers to Cloudflare through the lightweight cloudflared daemon, so no inbound ports need to be open.
- Cloudflare Mesh - post-quantum encrypted mesh networking between nodes, without a central concentrator.
- Secure Web Gateway - inspects and filters DNS, network, HTTP and egress traffic.
- Cloudflare One Client - the device agent, formerly called WARP. The iOS app is listed as Cloudflare One Agent.
- Browser Isolation, CASB, DLP, Email security and DEX (Digital Experience Monitoring) as further layers, several of them paid add-ons.
Everything runs on Cloudflare's global network. Cloudflare's own pages quote slightly different numbers - 335+ cities on the Zero Trust page, 330+ and 348 on the network page - across 100+ countries. Whichever figure you take, it means a nearby point of presence for almost any remote worker.
Pricing: $0 for 50 users, then about $7 a seat
Cloudflare offers three tiers. The figures below are Cloudflare's long-standing published pricing; the pricing page renders prices in the browser, so confirm the current rate in the dashboard before you commit.
- Zero Trust Free - $0, up to 50 users. Cloudflare's own wording pitches it at teams under 50 users or enterprise proof-of-concept tests.
- Zero Trust Pay-as-you-go - about $7 per user per month, with no user cap. Cloudflare's 2022 pricing material describes the rate as paid annually. The docs also call this tier Zero Trust Standard.
- Zero Trust Enterprise (contract) - custom pricing, higher account limits, longer log retention and phone support.
The first 50 seats do not stay free
Community reports say that once an account moves from Free to Pay-as-you-go, every seat becomes billable - not just the users above 50. A team of 60 should budget for 60 paid seats, not 10.
Several pieces are priced separately and none of those prices are public: Browser Isolation, DLP, Email security and the wider SASE packaging (Cloudflare WAN and Firewall) all route through sales. Log Explorer, which stores Zero Trust logs in an R2 bucket inside Cloudflare, is reported at $1 per GB ingested with the first 10 GB free.
Cloudflare says you can change or cancel at any time. A downgrade during a billing cycle takes effect in the next cycle; an upgrade is billed the moment you select it. We found no refund policy, no free trial of the paid tiers and no minimum seat count - the free plan itself is the trial.
What the free plan leaves out
Most of the platform is available on Free, and many account limits are identical across plans: 500 Access applications, 50 identity providers, 500 Gateway policies of each type, 1,000 tunnels. The differences that matter are elsewhere.
- Logs - Free keeps Access, DNS, Network and HTTP logs for 24 hours. Pay-as-you-go keeps them 30 days; Enterprise keeps Access and DNS logs 180 days and Network/HTTP logs 30 days. Admin logs last 18 months on every plan.
- Support - community forums and Discord only. Paid plans add chat and ticket support; contracts add phone support.
- CASB - Free users can configure up to two CASB integrations, and viewing the details of a finding instance needs Enterprise.
- DLP - an Enterprise add-on. Free and Pay-as-you-go accounts can use only the Financial Information and Social Security, Insurance, Tax, and Identifier Numbers predefined profiles.
- Browser Isolation - not on Free; an add-on to Pay-as-you-go and Enterprise.
- DEX tests - 10 on Free, 30 on Standard, 50 on Enterprise. List entries are 1,000 on Standard against 5,000 on Enterprise.
The 24-hour log window is the limit most teams hit first. It is enough to debug a broken policy the same day, but not to investigate an incident reported on a Monday. If audit trails matter, budget for Pay-as-you-go from the start.
Access and Tunnel: replacing the VPN
Access is the strongest part of the product. You publish a self-hosted or SaaS application, attach policies based on identity, group, device posture or location, and users reach it through a login page or an App Launcher portal - with or without the Cloudflare One Client installed, for browser-based apps.
Identity support is broad. Cloudflare lists AD FS, AWS SAML, AWS Cognito, Centrify, Citrix ADC, Microsoft Entra ID, Okta, OneLogin, PingFederate, PingOne, JumpCloud, Keycloak, Google Workspace, GitHub, generic SAML and OIDC and more, plus one-time PINs sent to approved email addresses. Multiple identity providers can run at the same time, which helps when contractors sign in with a different directory than staff.
Cloudflare Tunnel does the network side. The cloudflared daemon on your server or in your cluster makes outbound connections to Cloudflare, so the app has no public IP or open port to scan. An account can hold 1,000 tunnels, with up to 25 active cloudflared replicas per tunnel for redundancy. Machines and scripts can authenticate with service tokens - up to 50 - which do not consume seats.
Gateway, Browser Isolation, CASB and DLP
The Secure Web Gateway filters DNS on its own or, with the Cloudflare One Client on the device, full network and HTTP traffic including TLS inspection. Policies are written in a rule builder that combines traffic selectors, identity and device posture, with up to 500 policies of each type and 250 DNS locations.
Browser Isolation runs website code in Cloudflare's cloud and streams the result to the user, which is useful for risky links or for letting contractors view an app without downloading data. It is an add-on to the paid plans with no published price.
CASB scans connected SaaS tools for misconfigurations and exposed data, and now includes integrations for AI assistants such as ChatGPT, Claude and Gemini. DLP inspects traffic for sensitive data, but beyond two predefined profiles it requires the Enterprise add-on. Email security is a separate purchase, which Cloudflare lets you trial with a Retro Scan of existing mail.
How seats are counted, and what happens when they run out
A seat is consumed by an active user, and a user becomes active through any authentication event - logging in to an Access application or enrolling a device in the Cloudflare One Client. One user takes one seat no matter how many applications they open.
Full means blocked
Once every seat in the subscription is in use, additional users who try to log in are blocked. There is no overage billing and no grace period described in the docs, so a new hire on the free plan's 51st seat simply cannot get in.
Inactive users are not removed by default, so a free account can fill up with people who left months ago. Turn on seat expiration, which removes users after between one month and one year of inactivity; inactive users do not count toward billing.
Reliability, compliance and analyst standing
Putting authentication on one provider's network means that provider's outages become yours. On 18 November 2025 a database permissions change produced an oversized Bot Management feature file and took down large parts of Cloudflare from 11:20 UTC. Cloudflare reports that Access authentication failures were widespread from the start of the incident until the rollback at 13:05 UTC, though existing Access sessions kept working. All systems were back to normal by 17:06 UTC.
On compliance, Cloudflare announced FedRAMP High authorization on 10 August 2026; check whether the specific Zero Trust products you need fall inside its scope. Cloudflare is certified against ISO 27001:2022, ISO 27018 and ISO 27701, and the Data Localization Suite can restrict data storage to a specific region.
Analysts rate it as promising rather than leading. Cloudflare was named a Visionary - not a Leader - in both the 2026 Gartner Magic Quadrant for SASE Platforms and the 2026 Magic Quadrant for Security Service Edge. SDxCentral reported that Gartner flagged concern over a narrow view of sovereignty; Netskope leads the SASE quadrant.
Cloudflare Zero Trust vs Twingate and Perimeter 81
- Cloudflare Zero Trust - free for 50 users, about $7 per user per month after that, plus a gateway, CASB and isolation on the same platform. Short logs and community-only support on Free.
- Twingate - free for 5 users with $5 seats, focused narrowly on private-network access and simpler to explain to non-technical staff. See our Twingate review for its fine print.
- Perimeter 81 - now Check Point SASE, with pricing no longer public. See our Perimeter 81 review for what changed.
For a team under 50 that mainly needs to retire a VPN, Cloudflare's free tier gives more than Twingate's for nothing. Above 50 users the gap narrows, because every seat becomes billable and the most useful add-ons are priced through sales.
Verdict: who it suits, and who it does not
Cloudflare Zero Trust is the easiest way for a small team to get identity-aware access, DNS filtering and outbound-only tunnels without paying anything. Access and Tunnel are mature, identity provider support is wide, and the account limits are generous even on Free.
It suits less well if you need long log retention without paying, real support on the free tier, DLP or isolation at a published price, or a vendor that Gartner ranks as a Leader. And because seats block rather than bill when they run out, someone has to own seat expiration from day one.
Frequently asked questions
Is Cloudflare Zero Trust really free?
Yes, for up to 50 users. The free plan includes Access, Tunnel, Gateway and the Cloudflare One Client, but keeps logs for only 24 hours, offers community support only and excludes Browser Isolation and most of DLP.
How much does Cloudflare Zero Trust cost above 50 users?
About $7 per user per month on Pay-as-you-go, described in Cloudflare's 2022 material as billed annually. Community reports say all seats become billable once you upgrade, so confirm the rate in the dashboard.
What happens when a team grows past its seat limit?
New users are blocked at login. Once every seat is consumed, additional users who try to authenticate cannot get in until you add seats or free some up, for example with seat expiration.
How long does Cloudflare Zero Trust keep logs?
24 hours on Free, 30 days on Pay-as-you-go, and on Enterprise 180 days for Access and DNS logs and 30 days for Network and HTTP logs. Admin logs are kept 18 months on every plan.
Can I cancel or get a refund?
You can change or cancel at any time; downgrades take effect at the next billing cycle and upgrades are billed immediately. We found no published refund policy and no free trial of paid tiers beyond the free plan itself.
Which devices and identity providers does it support?
The Cloudflare One Client runs on Windows, macOS, Linux, iOS, Android and ChromeOS through the Android app, with Linux packages for RHEL/AlmaLinux, Debian, Fedora and Ubuntu. Identity providers include Microsoft Entra ID, Okta, Google Workspace, GitHub, OneLogin, PingOne, JumpCloud, generic SAML and OIDC, and one-time PINs.
Is this the same as the free WARP VPN app?
No. The consumer 1.1.1.1 + WARP app is a separate product. The business agent was renamed the Cloudflare One Client (formerly WARP) and enrolls devices into your organization's Zero Trust policies.
Key takeaways
- Free for up to 50 users, then about $7 per user per month on Pay-as-you-go; confirm the current rate in the dashboard.
- Upgrading makes every seat billable, and full subscriptions block new users at login rather than billing overage.
- The free plan keeps logs for 24 hours and offers community support only.
- DLP is an Enterprise add-on and Browser Isolation a paid add-on, with no public prices.
- Access and Tunnel are the strongest parts; Gartner ranks Cloudflare a Visionary, not a Leader, in 2026 SASE and SSE.
- An 18 November 2025 outage blocked new Access logins for nearly two hours, though existing sessions survived.
More in Virtual Private Network
Browse Virtual Private Network