Cloudflare

Cloudflare, Inc. is a United States technology company headquartered in San Francisco that operates a large distributed network between internet users and the servers hosting online services. Its platform combines content delivery, authoritative and recursive DNS, reverse-proxy services, distributed denial-of-service mitigation, web application security, bot management, zero-trust access, network connectivity, developer infrastructure, and domain registration. The company’s basic architectural role is to receive and inspect traffic at the network edge before forwarding legitimate requests to a customer’s origin, allowing customers to improve availability and performance while filtering malicious or unwanted activity. Cloudflare was founded in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn. Its origins were connected to Project Honey Pot, an earlier effort to identify abusive internet activity. The founders initially pursued the idea of a cloud-hosted firewall and traffic-management layer; the Cloudflare name was chosen because it conveyed the concept of a firewall delivered through the cloud. The company attracted venture financing and developed a freemium model that helped it reach a broad base of websites, organizations, developers, and online communities. During the 2010s, Cloudflare expanded from CDN and DDoS protection into DNS, application security, analytics, and developer services. It introduced high-profile public services such as the 1.1.1.1 DNS resolver and later WARP, a consumer connectivity and privacy product. Cloudflare Workers, launched in 2017, extended the company’s role from traffic intermediary to edge-computing provider by allowing developers to execute code close to users without managing conventional server infrastructure. Pages, Workers KV, D1, and related tools broadened that developer platform. Cloudflare became a public company on the New York Stock Exchange in September 2019 under the symbol NET. Its later strategy increasingly emphasized a unified edge platform spanning application delivery, cybersecurity, enterprise networking, and software development. The company launched or expanded products such as Access, Gateway, Turnstile, Cloudflare for Teams, Cloudflare One, Area 1 email security, Workers AI, Firewall for AI, and Cloudforce One. It has also acquired specialist businesses in web security, networking, developer tooling, and artificial intelligence. The company has become prominent in debates about intermediary responsibility and content neutrality. Cloudflare has generally argued that infrastructure providers should not act as broad arbiters of lawful speech, while acknowledging that it may terminate service in exceptional circumstances involving direct links to violence or other serious abuse. It removed service from sites including The Daily Stormer, 8chan, and Kiwi Farms after controversies and public pressure. Cloudflare has also faced criticism and litigation over whether infrastructure providers should bear responsibility when customers use its network to distribute allegedly infringing material. Cloudflare’s public-interest programs include Project Galileo, which provides free protection to vulnerable organizations such as journalists, activists, humanitarian groups, and human-rights organizations, and the Athenian Project, which extends protection to electoral and political infrastructure. The company also provides services for the .gov domain under a government contract and has participated in education and campaign-security initiatives. Its present business spans consumer services, small and large enterprises, public-sector institutions, developers, and internet platforms across global markets.

Cloudflare was founded on July 26, 2009, by Matthew Prince, Lee Holloway, and Michelle Zatlyn. Prince and Holloway had previously worked on Project Honey Pot, which gathered information about malicious internet activity. That experience helped shape Cloudflare’s initial concept: a cloud-based layer that could identify hostile traffic, protect websites, and improve delivery without requiring each customer to operate specialized security hardware. The company’s early service combined reverse-proxy networking, caching, DNS, analytics, and DDoS defense. This model placed Cloudflare between visitors and customer origins. Legitimate requests could be routed through the company’s global network, while suspicious traffic could be challenged, rate-limited, or blocked. A free entry tier made the service accessible to smaller websites, while paid plans added more controls and support. Cloudflare’s role grew as websites increasingly faced automated abuse, traffic surges, application attacks, and geographically distributed audiences. Cloudflare gained particular attention through its DDoS mitigation work. In 2011 it provided protection to LulzSec, which generated debate about whether infrastructure companies should serve controversial customers. In 2013, while defending the Spamhaus Project, Cloudflare reported an attack exceeding 300 gigabits per second, then regarded as one of the largest publicly disclosed attacks. The company later reported attacks of roughly 400 and 500 gigabits per second, followed by increasingly large incidents measured in terabits per second. These events helped establish Cloudflare as a visible participant in the internet-security industry. The company broadened its portfolio through acquisitions and product development. StopTheHacker and CryptoSeal added security and privacy capabilities, while Neumob, S2 Systems, Linc, Zaraz, Vectrix, Area 1 Security, Nefeli Networks, BastionZero, and Kivera contributed technologies in mobile optimization, application delivery, email security, networking, and zero-trust access. In parallel, Cloudflare introduced 1.1.1.1, a public DNS resolver, and WARP, a consumer-facing connectivity service. Cloudflare Workers, introduced in 2017, was a major strategic turning point. It enabled developers to run JavaScript and other supported workloads on Cloudflare’s edge locations, reducing dependence on centralized application servers. The company subsequently added storage, scheduling, database, static-site deployment, and developer-tooling capabilities. Workers became the center of a broader application platform rather than merely an extension of CDN delivery. Cloudflare went public in 2019. In 2020, co-founder Michelle Zatlyn became president, and the company intensified its enterprise-security strategy. Cloudflare for Teams combined secure DNS, web gateways, and identity-aware access controls; this direction later became part of Cloudflare One and the company’s SASE offering. Turnstile was developed as a less intrusive alternative to traditional visual CAPTCHAs, while Area 1 added protection against phishing email. Public-interest and civic-security work has remained part of the company’s identity. Project Galileo supplies no-cost protection to organizations exposed because of their public-interest work, and the Athenian Project extends similar assistance to election-related infrastructure. Cloudflare has also supported political campaigns, schools, government domains, and humanitarian organizations. From 2023 onward, Cloudflare invested heavily in artificial-intelligence infrastructure. Workers AI allowed customers to use machine-learning models through the edge network. The company introduced tools for detecting and controlling AI crawlers, AI Labyrinth for misleading unauthorized scrapers with generated material, AutoRAG for querying website content, and Firewall for AI for protecting model-enabled applications. Acquisitions such as Replicate and Human Native further connected the company to model deployment and AI-data markets. The company also continued expanding its developer ecosystem through planned or completed acquisitions involving Astro and VoidZero, while emphasizing open-source projects and edge-based application development. Cloudflare’s history is also marked by disputes over content moderation and intermediary liability. It has defended a general content-neutrality approach but has withdrawn services from selected sites associated with hate speech, extremist activity, or violence. The company has faced copyright-related criticism and litigation involving customers accused of infringement. Its continuing challenge is to reconcile an infrastructure-provider identity with pressure from governments, rights holders, security researchers, and civil-society groups to take responsibility for how its network is used.

1. 2025Cloudforce One launches

   Cloudflare introduced a threat-events platform using intelligence derived from activity observed across its network.

   Source
2. 2024Firewall for AI announced

   Cloudflare announced controls intended to protect applications that incorporate large language models.

   Source
3. 2023Workers AI launches

   Cloudflare introduced a framework for running AI inference through its edge infrastructure.

   Source
4. 2022Area 1 Security acquisition

   Cloudflare acquired Area 1 Security to strengthen phishing and email-security capabilities.

   Source
5. 2020Cloudflare One strategy expands

   The company introduced Cloudflare for Teams and expanded its secure-access and SASE strategy.

   Source
6. 2019Initial public offering

   Cloudflare listed on the New York Stock Exchange under the symbol NET.

   Source
7. 20181.1.1.1 public DNS launches

   Cloudflare introduced a public recursive DNS resolver marketed around speed and privacy.

   Source
8. 2017Workers launches

   Cloudflare introduced its edge-computing platform for deploying code close to users.

   Source
9. 2014Project Galileo launches

   Cloudflare began offering free protection to vulnerable public-interest organizations, including journalists, activists, and human-rights groups.

   Source
10. 2013Spamhaus DDoS incident

    Cloudflare reported mitigating an attack against Spamhaus that exceeded 300 gigabits per second.

    Source
11. 2011LulzSec protection controversy

    Cloudflare’s DDoS protection for LulzSec brought early public attention to the policy questions surrounding neutral infrastructure providers.

    Source
12. 2009Cloudflare is founded

    Matthew Prince, Michelle Zatlyn, and Lee Holloway founded Cloudflare around a cloud-based firewall and internet traffic-management concept.

    Source

A global edge platform positioned around making the internet faster, safer, more reliable, and more programmable.

• Cloudflare CDNContent delivery and edge networking2009

  Cloudflare’s CDN caches and serves web content from a distributed edge network, reducing latency and helping websites absorb traffic spikes. Its reverse-proxy architecture also gives customers a common control point for traffic inspection, TLS termination, routing, caching, and security policies.

• DDoS ProtectionCybersecurity2009

  Cloudflare provides network- and application-layer defenses against distributed denial-of-service attacks. The service uses the company’s globally distributed capacity to absorb, filter, rate-limit, and block attack traffic before it reaches a customer’s origin infrastructure.

• Cloudflare WorkersEdge computing2017

  Workers is a serverless edge-computing environment that lets developers deploy application logic near end users. It has expanded with storage, scheduled execution, databases, AI inference, and other tools intended to support full applications on Cloudflare’s network.

• 1.1.1.1DNS and consumer connectivity2018

  1.1.1.1 is Cloudflare’s public recursive DNS resolver. It is designed to provide fast name resolution and privacy-oriented handling of DNS queries, and is associated with the company’s broader consumer connectivity offerings.

• Cloudflare OneEnterprise security and SASE2020

  Cloudflare One brings together identity-aware access, secure web gateways, network connectivity, DNS filtering, browser isolation, email security, and related controls. It is positioned as a cloud-delivered alternative to conventional perimeter-based enterprise security architectures.

• TurnstileFraud prevention2022

  Turnstile is a CAPTCHA alternative that evaluates browser and interaction signals to distinguish people from automated abuse without generally requiring users to solve visual puzzles. It is designed for websites and applications that need low-friction visitor verification.

• Workers AIArtificial-intelligence infrastructure2023

  Workers AI provides access to machine-learning inference through Cloudflare’s edge infrastructure, allowing developers to integrate supported models into applications without directly operating GPU servers. It forms part of the company’s broader AI application and developer platform.

• Project GalileoPublic-interest cybersecurity2014

  Project Galileo supplies no-cost security and performance services to organizations such as independent media outlets, activists, humanitarian groups, and human-rights organizations that may be targeted because of their work.

• 2023Project Cybersafe Schools

  United States

  Cloudflare began a school-security initiative supported by an Amazon Web Services grant program, making no-cost cybersecurity services available to eligible public-school districts.

  Outcome. Expanded Cloudflare’s education-sector public-interest activity.

  Source
• 2020Cloudflare for Campaigns

  United States

  Cloudflare offered political campaigns access to security tools, later expanding the initiative to include secure email capabilities.

  Outcome. Became part of the company’s civic and election-security work.

  Source
• 2017Athenian Project

  United States

  Cloudflare extended free security support to election-related infrastructure and political campaigns, focusing on protecting democratic institutions from cyberattacks.

  Outcome. Expanded into election and campaign protection.

  Source
• 2014Project Galileo

  Worldwide

  Cloudflare provides free CDN, DDoS protection, and related services to vulnerable public-interest organizations. The program is intended to help groups remain available during politically motivated attacks and other hostile activity.

  Outcome. Continued as a long-running public-interest program with thousands of participating organizations.

  Source

• 2025Build controls for AI crawlers and model accessStrategy

  Website owners increasingly sought control over automated AI scraping and the commercial use of their content.

  What changed. Cloudflare introduced AI Labyrinth, AI crawler controls, AutoRAG, and plans for mechanisms allowing website operators to manage or monetize model access.

  Aftermath. The company increasingly positioned its network as an intermediary between publishers and AI developers.

  Source
• 2023Expand into edge AI with Workers AIProduct launch

  Demand for application-embedded AI created an opportunity to use Cloudflare’s distributed infrastructure for model inference.

  What changed. Cloudflare launched Workers AI with access to supported models and GPU-backed inference through its network.

  Aftermath. AI became a major component of Cloudflare’s developer-platform and infrastructure roadmap.

  Source
• 2020Develop a unified SASE and zero-trust platformStrategy

  Traditional corporate network perimeters were giving way to identity-based, cloud-delivered security models.

  What changed. Cloudflare combined Gateway, Access, DNS filtering, and related tools under Cloudflare for Teams and later Cloudflare One.

  Aftermath. The strategy positioned Cloudflare as an enterprise networking and security provider as well as a CDN company.

  Source
• 2019List on the New York Stock ExchangeOther

  Cloudflare required public-market capital and visibility to support expansion of its global infrastructure and product portfolio.

  What changed. The company completed its initial public offering under the ticker NET.

  Aftermath. Cloudflare became a publicly traded company and continued expanding across enterprise security, networking, and developer services.

  Source
• 2017Launch Cloudflare WorkersProduct launch

  Cloudflare sought to move beyond traffic delivery and offer developers programmable services on its global network.

  What changed. The company introduced a serverless edge-computing platform for running code close to users.

  Aftermath. Workers became a central part of Cloudflare’s developer and application-platform strategy.

  Source

• 2025Copyright liability litigationControversy

  Cloudflare faced litigation concerning alleged copyright infringement by websites using its services, including a reported loss in a case brought by Japanese publishers. The dispute challenged the limits of intermediary protection for infrastructure providers.

  Source
• 2022Kiwi Farms terminationControversy

  Cloudflare terminated service to Kiwi Farms following sustained allegations that the forum facilitated targeted harassment and threats. The case renewed discussion of Cloudflare’s exceptional-termination standards.

  Source
• 20198chan terminationControversy

  Cloudflare stopped providing service to 8chan after the site was linked in public debate to extremist content and mass-shooting manifestos.

  Source
• 2017The Daily Stormer terminationControversy

  Cloudflare terminated service to The Daily Stormer after the white-nationalist website published material connected to violence and harassment. The decision intensified debate over whether Cloudflare should act as a content moderator.

  Source
• 2011LulzSec service controversyControversy

  Cloudflare drew criticism after providing DDoS protection to LulzSec, a hacking group. The episode became an early example of the tension between Cloudflare’s infrastructure-neutrality position and demands that providers deny service to abusive customers.

  Source

• 2026Cloudflare acquires Human Native

  The company acquired an AI data marketplace that facilitates transactions between content creators and AI developers.

  M&A
  Source
• 2026Cloudflare announces workforce restructuring

  The company announced a substantial workforce reduction attributed to changing work patterns and rapid adoption of artificial-intelligence tools.

  Leadership changeOther
  Source
• 2025Cloudflare reports major DDoS attacks exceeding 11 terabits per second

  Cloudflare said it mitigated exceptionally large volumetric attacks, including an attack reported at 11.5 terabits per second.

  Other
  Source
• 2025Cloudflare agrees to acquire Replicate

  Cloudflare announced an agreement to acquire Replicate, a platform for running and deploying machine-learning models through an API.

  M&A
  Source
• 2024Cloudflare launches Firewall for AI

  Cloudflare introduced a security product intended to protect applications using large language models from abuse and attacks.

  Product launchOther
  Source
• 2023Cloudflare reports record-scale HTTP DDoS mitigation

  The company reported blocking a DDoS campaign reaching approximately 71 million requests per second.

  Other
  Source
• 2020Cloudflare launches Cloudflare One and Teams security services

  Cloudflare expanded into enterprise zero-trust networking through Gateway, Access, and its broader SASE platform.

  Product launch
  Source
• 2019Cloudflare files for initial public offering

  Cloudflare submitted its registration statement for a New York Stock Exchange listing under the ticker NET.

  Other
  Source
• 2019Cloudflare begins public trading

  The company opened for trading on the New York Stock Exchange in September 2019.

  Other
  Source

1. Cloudflare
2. Cloudflare corporate website