Cloudflare Access

Overview

Cloudflare Access is a zero trust access service for teams protecting self-hosted apps, SaaS tools, and infrastructure. It is best suited to organizations that want per-resource access controls and already use, or are prepared to configure, Cloudflare’s domain and device ecosystem. Its free tier lowers the barrier for small deployments, but public self-hosted app publishing has a domain requirement.

Key features

Access built around specific resources

Access checks identity, device posture, and request context, then applies policies at the resource level rather than granting broad network access. Applications deny access by default, so users must match an Allow policy to connect. That is a useful security posture for teams replacing or supplementing a legacy VPN with access to selected applications; it also means administrators must define the policies users need.

Identity connections support SAML- and OIDC-compliant providers, including enterprise SSO, social identity providers, and Cloudflare as an identity provider. Contractors, partners, and people on unmanaged devices can connect through a browser using social identity or a one-time PIN, avoiding a requirement to install a client for those access cases.

Applications, infrastructure, and administration

Access covers infrastructure targets such as SSH and RDP as well as applications. Supported protocols include HTTP, HTTPS, TCP, SSH, RDP, SMB, and VNC. The hybrid deployment supports AWS, Azure, and GCP, alongside features such as application-aware routing, firewall policy management, network monitoring, cloud on-ramps, and SIEM log export. Session recording is not supported, which may be a drawback for teams that need that capability.

Administrators can centralize and scale policy management with APIs and Terraform. Cloudflare also names Fleet, Hexnode, Intune, Jamf, JumpCloud, and Kandji as partners for deploying its One Client and configuring devices remotely. Stable One Client releases are available for Windows, macOS, Linux, iOS, and Android. Cloudflare’s Trust Hub cites ISO 27001, ISO 27701, PCI DSS, and SOC 2 Type II compliance credentials.

A key setup constraint applies to publishing a self-hosted public application: it requires an active Cloudflare domain configured with full or partial CNAME setup. That is a meaningful prerequisite for organizations that do not already manage a domain through Cloudflare.

Pricing

Cloudflare Access uses freemium pricing, with a free plan and paid plans from $7/user/mo (annual). The Free Plan costs nothing, is billed forever, and is limited to under 50 users. It is a practical starting point for small teams and proofs of concept, but the user cap makes it unsuitable once deployment grows beyond that range.

Pay-as-you-go costs $7 a month, billed paid annually, for over 50 users. It is the step up for larger deployments that need to move beyond the free cap. The Contract Plan has custom pricing and maximum support, making it the option for organizations that want a contractual arrangement and higher support rather than a published per-user price. Cloudflare One also has a free plan for proof of concept; the Cloudflare One offering is available for free trial.

Platforms

Access supports Android, iOS, Linux, macOS, web, Windows, and API use. Its coverage suits mixed device environments and teams managing access programmatically.

Who it's for

Cloudflare Access is a strong fit for organizations that need identity- and device-aware access to a mix of applications and infrastructure, especially teams already using Cloudflare domains or planning to manage policies through APIs and Terraform. Small deployments can begin below the 50-user threshold without a subscription. It is less suitable for teams unwilling to meet the domain setup requirement for public self-hosted apps, or those that need session recording.

Pros and cons

• Granular, deny-by-default access: Policies apply per resource and users must match an Allow rule, supporting tighter control than broad network access.
• Broad access coverage: Browser access for unmanaged users, client support across major desktop and mobile platforms, and SSH/RDP infrastructure access cover varied use cases.
• Low-cost entry point: The free plan is billed forever for under 50 users, while annual paid pricing starts at $7/user/mo.
• Domain prerequisite: Public self-hosted app publishing requires an active Cloudflare domain with full or partial CNAME setup.
• No session recording: Teams that require recorded sessions will need to look elsewhere.

Alternatives

For a broader network-management need, compare the SD-WAN Software, Cloud Network Management Software, Cloud Access Security Broker Software, SaaS Security Posture Management Software, Zero Trust Network Access Software, and Business VPN Software categories.

D-Link Nuclias Cloud SD-WAN Gateway (DBG-2000) is worth considering when a gateway-focused SD-WAN product is a better fit; it has a free plan and annual gateway licenses starting at $111.99 a year for one year.

flexiWAN suits buyers evaluating a flexible SD-WAN offering with a free tier for 1–5 flexiEdge instances and a free trial. Arista NG Firewall is another freemium option, with a free plan for basic security and connectivity features with limited capabilities.

Versa Zero Trust Network Access is a paid alternative with no free plan and an Essential tier covering 10 applications. Cato Client is paid, offers a free trial, and is purchased through Cato or a reseller. Fortinet Secure SD-WAN offers basic SD-WAN functionality on FortiGate models without an additional charge.

AccessOne is another paid access option. Aryaka SD-WAN is a paid choice for buyers looking for secure SD-WAN, global connectivity, multicloud, WAN optimization, and secure remote access.

Verdict

Choose Cloudflare Access if your organization wants resource-level, identity-aware controls across applications and infrastructure, with a free path for smaller teams and automation support as policies scale. Its strongest reasons to look elsewhere are the Cloudflare domain setup required for public self-hosted apps and the absence of session recording.