Cloudflare Zero Trust Pricing 2026: Free Plan, Pay-as-you-go and Contract

Cloudflare Zero Trust costs $0 for up to 50 users, $7 per user a month on Pay-as-you-go (billed monthly, no user cap) and an annual custom price per user on the Contract plan, read on Cloudflare's Zero Trust plans page on October 19, 2026. All three plans include ZTNA, the Secure Web Gateway and the device client.

That structure gives Cloudflare a free tier far larger than Tailscale's or Twingate's and a cheaper paid seat than Tailscale Standard, with a cliff in the middle. The 51st user does not add one paid seat; it moves the whole team onto a paid plan. The controls an auditor asks about, SIEM export and six months of logs, sit only on Contract, which has no public price.

Toolradar data: Toolradar, the software directory we run, evaluated 36 VPN tools for its VPN ranking as of October 19, 2026, and 58% of the VPN tools it tracks are free, freemium or open source. Cloudflare's directory records are Cloudflare and Cloudflare Tunnel, the connector that publishes private apps to Zero Trust.

A zero trust platform, for this buyer, replaces the VPN concentrator: every request to a private app or the open web is checked against identity, device posture and policy at the vendor's edge instead of trusting anyone already on the network. Our Cloudflare Zero Trust review judges the product; this page covers only what it costs.

Cloudflare Zero Trust plans at a glance

Plans, prices and limits were read on Cloudflare's plans page on October 19, 2026. Cloudflare positions Free for small teams and enterprise proof-of-concept tests, Pay-as-you-go for larger teams "solving narrow SSE use cases" that do not need enterprise support, and Contract for buyers building toward a full SASE or workspace security deployment. In practice, the plan you need is set by headcount first and by audit requirements second.

What every plan includes, even Free

The core access stack is not tiered. Free, Pay-as-you-go and Contract all list Zero Trust Network Access, the Secure Web Gateway, the device client for Windows, Mac, iOS, Android, Linux and ChromeOS, the tunnel connector, Digital Experience Monitoring and network flow monitoring. HTTP filtering with TLS 1.3 inspection, L4 firewall rules, antivirus scanning of uploads and downloads, browser-based SSH and VNC, SSH command logging, Terraform automation and identity provider logins (SAML, OIDC and social) are on all three.

For a small security team, that means the free plan is a production tool rather than a trial. A 30-person company can replace both a VPN appliance and a DNS filter on Free, and its only real constraint is the 24-hour log window.

The tiers split on five things: user count, log retention, support, the number of office locations for DNS policies (3 on Free, 50 on Pay-as-you-go, 250 on Contract) and the data protection controls. CASB on Free and Pay-as-you-go is capped at 2 read-only API integrations with top-level findings only; Contract unlocks unlimited out-of-band integrations and detailed findings as an add-on. DLP is "limited predefined profiles" below Contract and full-featured, as an add-on, on Contract.

The 50-user cliff

Pay-as-you-go lists its per-user price with no free allowance, so the 51st user turns a $0 bill into $357 a month. That is 51 seats at $7, or $4,284 a year by our multiplication. A company growing through 50 people therefore faces a step change, not a gradual one, and should budget the jump a quarter before it lands.

The cliff is driven by how Cloudflare counts seats. Its seat management documentation says a user consumes a seat on an authentication event: an Access login to the App Launcher or an application, or a Gateway connection from any of that user's devices. A user occupies one seat however many apps they reach. Removing a user frees the seat, and an automatic seat expiration can release users who have been inactive for a period between one month and one year.

Seat hygiene is the cheapest lever on this bill. A contractor who logged in once in March still holds a seat until someone removes them or expiration catches them. Set expiration to the shortest window your offboarding process tolerates. The same documentation says that once the purchased seats are consumed, additional users who try to log in are blocked, so a paid team that hires fast needs to raise its seat count before day one, not after the help-desk ticket.

What Cloudflare Zero Trust costs at 75, 150 and 300 users

Our multiplication of the Pay-as-you-go list price per user, before tax and add-ons. Contract is excluded because Cloudflare publishes no per-user figure for it.

At 300 users, Pay-as-you-go is still a list-price product, and that is its limit. A 300-person company almost always needs the Contract features: SIEM export, six months of DNS logs, mTLS for IoT devices, a PAC file for browsers that cannot run the client, or more than 50 office locations. At that point the $25,200 is a ceiling to negotiate against, not a forecast.

Cyberpresso's daily brief tracks the remote-access flaws and vendor price changes that move these numbers; the signup is at the end of this page.

Add-ons and charges outside the seat

Log Explorer has the only published add-on price. On Free and Pay-as-you-go it is free for the first 10 GB, then $1 per GB a month; Contract customers get custom pricing. A team storing 40 GB a month pays $30 a month on top of its seats by our arithmetic, which is small next to a SIEM's ingest fee but adds up for a large estate.

Remote Browser Isolation is an add-on with no public price. It is unavailable on Free and listed as an add-on on Pay-as-you-go and Contract, including the controls over copy, paste, upload, download and printing inside isolated pages. Ask for the RBI quote before you commit, because isolation is the add-on that turns the gateway into a browser-security control, and its cost is the unknown in any Pay-as-you-go budget.

Contract-only items carry the compliance weight. Logpush to a SIEM (Splunk, Datadog, Sumo Logic) and to cloud storage, PII redaction in logs, mTLS authentication, proxy endpoints for PAC files, dedicated egress IPs (an add-on), email security against phishing and business email compromise (an add-on) and the Magic WAN and firewall services for a full SASE deployment are not on Pay-as-you-go at any price.

The SLA is a paid-plan benefit. Cloudflare lists a 100% uptime service level agreement on Pay-as-you-go and Contract, and none on Free. For a team whose every app now sits behind Cloudflare Access, that line matters more than the seat price: an outage of the access layer is an outage of the company.

Cloudflare Zero Trust against Tailscale and Twingate

Prices read on each vendor's own pricing page on October 19, 2026. Tailscale prints its rates per user per month; Cloudflare's Pay-as-you-go rate is billed monthly.

Cloudflare's free tier covers 50 users against Tailscale's 6, and its paid seat is $1 cheaper than Tailscale Standard. At 150 users that gap is $150 a month, or $1,800 a year. The comparison that matters for a security team is Premium, because Tailscale puts log streaming and network flow logs there; Cloudflare puts its equivalent, Logpush, on an unpriced Contract. Neither vendor sells SIEM export on the cheap seat.

Tailscale wins for server-heavy, people-light networks. Its mesh design connects machines directly, and our Tailscale pricing breakdown shows the $1 charge per tagged resource beyond 50. Cloudflare routes traffic through its edge and adds a Secure Web Gateway with DNS and HTTP filtering, so a buyer who also wants web filtering gets it inside the same seat. The Twingate review and the Twingate vs Tailscale comparison cover the third option, and NordLayer vs Tailscale covers a business VPN with a gateway model.

Is Cloudflare Zero Trust worth the price?

Inside the free cap, it is the default answer. The free plan includes ZTNA, a web gateway with TLS inspection and antivirus, and SSH session logging, at a headcount where Tailscale's and Twingate's free plans have already run out. The honest weakness is the 24-hour log window and community-only support: if an incident is noticed on Monday morning, Friday's logs are gone.

Between 50 and roughly 200 users, Pay-as-you-go is cheap but thin. It fixes retention (30 days) and support (chat and ticket), and its seat undercuts the paid seats compared above. It does not export logs, so a team with a SIEM or a SOC 2 auditor is buying a gateway it cannot fully evidence.

Past that, the real product is Contract, and its price is a negotiation. Bring the Pay-as-you-go total for your headcount as the anchor and price RBI, DLP and email security in the same quote. For the wider field, read best zero trust platforms, Tailscale alternatives and best VPN for small business; for the identity provider Cloudflare Access logs in through, see Okta pricing and Duo pricing.

FAQ

How much does Cloudflare Zero Trust cost in 2026?

Cloudflare Zero Trust is free for up to 50 users, $7 per user a month on Pay-as-you-go billed monthly with no user limit, and an annual custom price per user on Contract, according to Cloudflare's plans page on October 19, 2026. ZTNA, the Secure Web Gateway and the device client are on all three plans.

Is Cloudflare Zero Trust really free?

Yes, for teams of up to 50 users, with no time limit. The Free plan includes ZTNA, DNS and HTTP filtering, the device client and tunnels, but keeps logs for up to 24 hours, offers community support only, has no uptime SLA and caps DNS policies at 3 office locations.

What happens when a team passes 50 users?

The team moves to Pay-as-you-go, which bills every user at the per-seat rate with no free allowance listed. A 51-person team therefore pays $357 a month, or $4,284 a year, by our multiplication. Removing inactive users and setting seat expiration keeps the count, and the bill, down.

How does Cloudflare count a Zero Trust seat?

A user takes a seat when they authenticate through Access or when one of their devices connects through Gateway, and they hold one seat however many apps they use. Removing the user frees the seat, and automatic expiration can release users inactive for one month to one year.

Which features need the Contract plan?

Logpush to a SIEM or cloud storage, six months of DNS log retention, PII redaction, mTLS authentication, PAC file proxy endpoints, phone support and up to 250 office locations are Contract-only. Dedicated egress IPs, email security, full DLP and unlimited CASB integrations are Contract add-ons.

Is Cloudflare Zero Trust cheaper than Tailscale?

Yes at list price. Cloudflare's Pay-as-you-go seat costs $1 a month less than Tailscale Standard's $8 and well under Premium's $18, so 150 users cost $1,050 a month on Cloudflare and $1,200 on Tailscale Standard.

Sources and method

We read Cloudflare's Zero Trust plans page and its seat management documentation on October 19, 2026, along with the pricing pages of Tailscale and Twingate the same day. Monthly and yearly totals multiply the published per-user price by the headcount and by 12; taxes, add-ons and Contract quotes are excluded. This page reports published prices only and does not rank vendors. Prices change, so re-check the plans page before a renewal.

Cite this: Cyberpresso, "Cloudflare Zero Trust Pricing 2026: Free Plan, Pay-as-you-go and Contract", October 2026.

Cyberpresso sends a daily brief on the vulnerabilities and vendor changes a security team has to act on. Subscribe here.

Some offers on this page may be paid placements or contain affiliate links.