Cloudflare is often jokingly called the “cyber bodhisattva.” The reason is simple: for personal websites and home labs, it offers quite a few genuinely sustainable free services. This article isn’t a full catalog of Cloudflare’s products — it’s just a rundown of which free services are still worth using right now, and what problem each one solves.
1. DNS and CDN
The most basic use case is pointing your domain’s name servers at the addresses Cloudflare provides. After that, A, AAAA, CNAME, MX, TXT, and other records can all be managed directly in Cloudflare.
What’s genuinely worth understanding is the orange cloud icon next to a DNS record:
- Orange cloud (proxied): requests go through Cloudflare first, then to your origin;
- Gray cloud (DNS only): Cloudflare only handles resolution, and users connect directly to your origin.
Only web traffic with the orange cloud enabled gets Cloudflare’s CDN, WAF, DDoS protection, and other capabilities. The orange cloud also hides your origin’s IP address — but if the same server is exposed through a different gray-cloud record, that effect disappears.
So not every record needs the orange cloud. www, blog, and api can generally have it on; mail, domain-verification records, and many non-HTTP services usually stay gray-cloud. If your home’s public IP changes, you can also do DDNS through the Cloudflare API.
1.1 CDN and mainland China
Once a site has the orange cloud on, it can use Cloudflare’s CDN directly. Static assets like images, CSS, JavaScript, and fonts get cached at Cloudflare’s edge, cutting down on origin trips and access latency.
An ordinary site usually doesn’t need overly complex caching rules — cache static assets as normal, and decide whether to cache HTML and API responses on a case-by-case basis.
Mainland China needs to be considered separately, though. Cloudflare’s regular global network is not the same as a mainland China CDN. When users in mainland China visit an ordinary Cloudflare site, the traffic generally still has to cross the border, so the experience is nothing like accessing it from Hong Kong, Japan, the US, or Europe.
Cloudflare does have a China Network, but it currently requires Enterprise, a separate China Network subscription, and the connected domain needs a valid ICP filing or license.
So if a site serves both mainland China and overseas users — especially an image-heavy site — the more realistic approach is usually: use Cloudflare/R2 for overseas traffic, and set up a separate domestic or Hong Kong-based CDN and object storage for mainland China.
Official docs: Cloudflare DNS / Cloudflare Cache / China Network
2. HTTPS and Website Security
Cloudflare Free includes Universal SSL. Once a site has the orange cloud on, Cloudflare can automatically issue and renew an edge certificate for the domain.
It’s also recommended to set up HTTPS on the origin, and set the SSL/TLS mode to Full (strict). The origin certificate can be from Let’s Encrypt or from Cloudflare Origin CA.
Beyond that, the free plan also includes two very practical security capabilities:
- DDoS Protection: prevents large-scale malicious traffic from taking down the origin directly;
- WAF: filters problematic web requests — the Free plan includes a basic managed ruleset.
A simple way to remember it: DDoS protects against traffic, WAF protects against requests.
2.1 Turnstile
Turnstile is Cloudflare’s bot-detection service, used to protect entry points like login, signup, comments, and forms.
Its biggest advantage: a site doesn’t need to be using Cloudflare’s CDN at all to adopt Turnstile on its own. The Free plan currently supports up to 20 widgets, with unlimited verification requests. For a personal site, it can basically be used as a free CAPTCHA service.
Official docs: Universal SSL / DDoS Protection / WAF / Turnstile
3. R2 and Images
R2 is Cloudflare’s S3-compatible object storage, and one of the most worthwhile free services to use.
As of September 2026, R2 Standard’s monthly free tier is:
| Item | Free tier |
|---|---|
| Storage | 10 GB-month |
| Class A operations | 1,000,000 |
| Class B operations | 10,000,000 |
| Public egress traffic | Free |
The biggest selling point is free public egress. This is very handy for blog images, attachments, and small download sites.
If a site needs thumbnails, cropping, or format conversion, it can be paired with Cloudflare Images. Images Free currently provides 5,000 unique transformations per month, and can process images stored directly in R2 or elsewhere.
One thing to note: the free part is the image transformation — storing images directly inside Cloudflare Images is a Paid plan feature. For a personal site, storing originals in R2 and using Images for resizing and format conversion is usually the better fit.
Official docs: R2 Pricing / Images Pricing
4. Tunnel and Access
Cloudflare Tunnel is a great fit for a home lab.
In the past, accessing a home Web service like Home Assistant or Grafana from the public internet usually required a public IP plus port forwarding. Tunnel flips this around: cloudflared runs on the machine at home and actively connects out to Cloudflare, so no inbound port needs to be opened, and the origin doesn’t need a public IP at all.
After creating a Tunnel in Cloudflare, run the command Cloudflare gives you on the server — for example, with Docker:
docker run cloudflare/cloudflared:latest \
tunnel --no-autoupdate run \
--token <TUNNEL_TOKEN>Then add a published application — for example, forwarding ha.example.com to http://192.168.1.10:8123 — and after that, the home Home Assistant instance can be reached directly through the domain.
If you don’t want that address open to everyone, add Cloudflare Access on top. Access authenticates identity first, and only people who pass the policy can get through to the application behind it.
An easy way to remember it: Tunnel is responsible for exposing a service; Access is responsible for deciding who gets in.
The Cloudflare Zero Trust Free plan currently supports up to 50 users, which is generally plenty for individual and family use. If the goal is direct access to the entire home network rather than publishing a handful of web applications, Tailscale or WireGuard is usually a better fit.
Official docs: Cloudflare Tunnel / Cloudflare Access
5. Workers and Other Free Tools
Workers can run code at Cloudflare’s edge, and are well suited to small functions that don’t justify deploying a whole separate server — things like URL redirects, API authentication, webhooks, accessing R2, or picking a different backend based on region.
As of September 2026, Workers Free’s main limits are:
- 100,000 requests/day;
- 10 ms of CPU time per request;
- 128 MB of memory.
This is generally enough for a personal site’s small endpoints and lightweight APIs.
In the past, many static sites were deployed directly to Cloudflare Pages. Pages is still available today, and the Free plan still allows 500 deploys per month, but Cloudflare has clearly recommended that new projects use Workers Static Assets instead, and new features are now mostly concentrated on Workers.
5.1 Workers AI
Workers AI lets you call Cloudflare-hosted AI models directly, without needing to provision your own GPU. The current free tier is 10,000 Neurons per day, suitable for personal demos, text classification, embeddings, and small-scale generation tasks.
Not every model is available on the Free plan, though — some resource-intensive models require a paid plan.
5.2 Email Routing
Email Routing lets you create addresses like [email protected] or [email protected] on your own domain, and automatically forward them to Gmail, Outlook, or another verified mailbox.
It isn’t a complete free email service: it mainly handles receiving and forwarding, not standalone IMAP/SMTP mailbox accounts. Currently, inbound mail through Email Routing is free with no limit, and each domain can have up to 200 routing rules.
If all you want is to receive email at your own domain, this feature is very convenient.
5.3 Free-tier overview
| Need | Free option |
|---|---|
| Domain resolution | Cloudflare DNS |
| Site proxying and CDN | Orange cloud + CDN |
| HTTPS | Universal SSL |
| DDoS protection | Standard DDoS Protection |
| Basic web protection | WAF Free Managed Ruleset |
| Bot detection | Turnstile: 20 widgets, unlimited verifications |
| Image and attachment storage | R2: 10 GB-month/month |
| Image resizing, cropping, and optimization | Images: 5,000 unique transformations/month |
| Publishing a home web service | Cloudflare Tunnel |
| Adding login to an internal service | Access: up to 50 users |
| Running lightweight backend logic | Workers: 100,000 requests/day |
| Static site deployment | Workers Static Assets |
| AI model inference | Workers AI: 10,000 Neurons/day |
| Receiving mail on a custom domain | Email Routing: free forwarding |
For an ordinary personal site, DNS + orange cloud + HTTPS is basically enough to get started at zero cost; add R2 + Images once there are a lot of images, add Tunnel + Access once there’s a home service that needs remote access, and add Workers once lightweight logic is needed.
Cloudflare’s free plan is genuinely strong, but “free” doesn’t mean unlimited. Especially for high-traffic, production workloads, and mainland China access, it’s still worth looking closely at the network path, plan, and billing rules on their own.
Official docs: Workers Limits / Workers AI / Email Routing