Free Cloudflare for small businesses: what it includes and how it protects your website

One Monday, your website wakes up down. Your hosting provider explains that it received an attack with thousands of fake visits per second and had to suspend the site to protect other customers. Meanwhile, your ads keep running and sending people to a page that does not load.

That scenario is not exclusive to big companies. And the first line of defense for a small business can cost nothing: Cloudflare's free plan. This is what it includes.

What is Cloudflare?

It is a global network that sits in front of your website to protect it and speed it up. Visits go through Cloudflare first, which filters malicious traffic and serves content from locations close to the visitor. This very site runs on Cloudflare.

What does Cloudflare's free plan include?

According to Cloudflare, its free plan offers SSL, CDN, DDoS protection and more, at no cost. In detail:

Feature	What it does for your business
Universal SSL	Encrypts the connection (the browser padlock) without buying a certificate
Unmetered DDoS protection	Absorbs massive traffic attacks without charging you for them
Managed WAF rules	Blocks attacks on known and serious vulnerabilities
CDN	Serves your website from locations close to the visitor
DNS	Manages your domain quickly and reliably

Two details worth highlighting:

• No DDoS charges per attack: according to Cloudflare's documentation, DDoS mitigation is unmetered on all plans, and the company committed to never charging for attack traffic.
• WAF for everyone: Cloudflare announced a set of free managed rules for all plans, against high-profile vulnerabilities such as Shellshock or Log4J.

What does the free plan not cover?

Cloudflare protects the door, not what is inside the house.

• It does not make backups of your site.
• It does not update your WordPress or your plugins.
• It does not fix a site that has already been hacked from the inside.

Common mistake: believing that with Cloudflare you no longer need to maintain the site. An outdated WordPress is still vulnerable from the inside. We lived it: that is why we migrated to a static site, as we tell in migrating from WordPress to Cloudflare Pages.

How do I get started with Cloudflare?

1. Create the account and add your domain.
2. Review the DNS records Cloudflare detects: they must stay identical to the current ones, especially the email records.
3. Change the nameservers at your domain registrar.
4. Turn on SSL in Full mode if your hosting has a certificate.
5. Add your own rules if you get recurring attacks, such as blocking paths that do not exist on your site.

Watch out: when you move the DNS, an email record left out means your company stops receiving email. Compare them one by one before changing the nameservers. If you also want your emails to stay out of spam, check SPF, DKIM and DMARC.

Does Cloudflare also make my website faster?

Yes, and that sells too. By serving content from locations close to the visitor, it improves load times, which are part of the metrics Google measures. We explain why it matters in website speed and Core Web Vitals.

In short

Cloudflare's free plan gives a small business SSL, unmetered DDoS protection, managed firewall rules, CDN and DNS, at no cost. It is the security and speed foundation every website should have, although it does not replace backups or maintenance. That way, on the Monday of the attack your website stays up. We set it up in our hosting and domains service.