A large company that wanted its website fast and safe from attack bought an expensive hardware appliance and signed a contract with a content delivery network (CDN), a company that stores copies of a site on servers near its visitors CF2. Akamai, the largest, served customers such as Facebook and Microsoft CFA-1. Most owners of small and mid-sized sites could not take that route. The equipment cost too much, and on shared hosting they had no physical access to the server to install it CF2. Nor could they pay a team to run it CF6. When a denial-of-service attack, a flood of junk traffic, knocked such a site offline, its owner had to scramble for a fix CF6.
Cloudflare
Cloudflare put a firewall in the cloud behind a DNS change, gave it free to sites too small for Akamai, and sold the same network up-market while the free traffic cut its costs and sharpened its defenses.
How Cloudflare won
- 1 · 2004–10Cloud firewall switched on by a DNS changeTwo nameservers routed a site through Cloudflare: no hardware, no code, no new host, a design drawn from the founders' Project Honey Pot.Drop-In Adoption
- 2 · 2010–12Free, self-serve plan spread through hostsCore service free from launch, no sales-sized plan until June 2012, and 100+ hosting companies offering it by August 2011.Freemium Model
- 3 · 2012–26Every server runs every service, sold up-marketOne network added products at low cost; customers paying $100K+ a year grew from 95 in 2016 to 4,298 in 2025.Novel Architecture
- 4 · 2010–26Counter-positioning: free traffic lowers cost and trains defensesFree sites that Akamai's per-traffic pricing could not match cut Cloudflare's costs and fed its protection.Counter-positioning
Versus Akamai: Akamai sold metered delivery to large enterprises and earned more as their traffic grew. Cloudflare gave its network away to the sites Akamai did not pursue, sold the same network's services up-market, and collected free traffic that Akamai's pricing gave it no reason to carry.
Arena: Market Conditions Before Cloudflare
How each step happened
Step 1 of 4 · 2004–10
Cloud firewall switched on by a DNS change
Cloudflare's innovation was a firewall in the cloud, switched on with a DNS change. A site owner listed two Cloudflare nameservers with the domain registrar, and visitors' traffic then passed through Cloudflare's network before reaching the existing host CF2. There was no hardware or code to change and no host to leave, and setup typically took under five minutes CF1. Akamai sold delivery to large enterprises that also bought their own security equipment; the DNS switch reached owners with no server to put a box in and no budget for a contract CF2 CFA-1.
The design came from the founders' own work. Matthew Prince and Lee Holloway had run Project Honey Pot since about 2004, asking members to donate part of their DNS records to build spam traps, and more than 100,000 people signed up CF2 CF13. At launch Prince wrote that, "knowing all that about DNS, we set out to build a system that used DNS to supercharge websites" CF2. Honey Pot members became the first users in a June 2010 private beta and found their sites loading about 30% faster because Cloudflare cached files and removed junk traffic CF3 CF4. Protection an owner might never think to buy came with a speed gain noticed every day.
No security specialist was needed. Co-founder Michelle Zatlyn said the team had built something "anyone with a website can use, regardless of technical ability" CF1; when an attack knocked 4chan offline, its founder switched its DNS servers to Cloudflare and the attack stopped, with no reliability team of his own CF6.
Rivals Enterprises paired a hardware appliance with a CDN contract CF2. By 2014 Akamai had $1.6 billion in yearly revenue and customers such as Facebook and Microsoft, and Cloudflare had started with sites too small to interest it CFA-1.
Drop-In AdoptionFounder Domain ExpertiseDemocratize the Expert Task
Step 2 of 4 · 2010–12
Free, self-serve plan spread through hosts
Cloudflare priced the service for the customer it had found. The core service was free, and extras such as SSL encryption and advanced security cost from $20 a month CF1. Owners signed themselves up, and for 21 months there was no plan sized for a sales contract, until Business and Enterprise plans with service-level agreements arrived in June 2012 CFA-9. By 2014 about 2 million sites used it, most free and 4–5% paying CFA-1.
Hosting companies became the distribution channel. A host could offer Cloudflare inside its existing customer relationship, joining cost nothing, and less load reached its own servers CF5. More than 100 hosts enrolled in the pilot before the program opened to all in August 2011; A2 Hosting's chief executive described CDN service "through the click of a button" CF5. Because the service was free, a host could switch it on for customers without selling them anything.
Rivals Akamai billed by traffic delivered and sold through a direct sales force and more than 100 channel partners, such as AT&T and IBM, to enterprises such as Apple and eBay CFA-2.
Step 3 of 4 · 2012–26
Every server runs every service, sold up-market
One network for every product
The architecture that carried Cloudflare up-market was designed to serve free sites cheaply. Every server in every city runs every Cloudflare service on commodity hardware, and paying customers get the best locations while free sites use spare capacity CF10 CF12. There was no separate network per product, so each new service landed on machines already in place, and in the first half of 2019 the gross margin was 77%, the level of leading hardware vendors CF12.
Buyers got one purchase for several problems. Discord moved to Cloudflare in August 2015 for delivery and attack protection together, replacing servers its engineers had run, and reported lower hardware and cloud bills CF9. Workers (2017) let customers run their own code on the same servers, and more than 20% of new customers adopted it by 2019 CF11 CF12. The shared design also spreads failures: in late 2025 configuration changes carried outages across services, and containing them became the top engineering priority CF18.
Selling larger accounts
Cloudflare built inside and field sales teams to win and widen larger accounts; by 2018 most revenue came from Enterprise plan customers they had signed CF10. Ericsson shows the path: a few engineers began using Access, Cloudflare's service for logging in to internal applications, in September 2018; hundreds followed, and Ericsson signed an Enterprise plan that December CF10. Customers paying more than $100,000 a year rose from 95 in 2016 to 313 in 2018 CF10 and 4,298 by the end of 2025, when they supplied 73% of fourth-quarter revenue CF17. Net retention was 120%: existing customers spent a fifth more than a year before CF17.
Rivals Akamai bought its attack protection, paying $370 million for Prolexic (announced December 2013), and runs Prolexic's scrubbing centers apart from its Kona Site Defender product, priced per data-center location CFA-3 CFA-4. It added computing by buying Linode in 2022 CF15. Akamai led among the 1,000 most-visited sites in June 2020; by September 2026 Cloudflare served 62.3% of them to Akamai's 20.4% CFA-6 CFA-5.
Novel ArchitectureScope economiesLand and ExpandProduct-Led SalesMulti-Product
Step 4 of 4 · 2010–26
Counter-positioning: free traffic lowers cost and trains defenses
This step runs back to 2010 because the free plan, in place since launch, kept paying off as the network grew. A firewall owner did not pay more when attacks rose, so Cloudflare sold flat subscriptions instead of usage billing, and it has given away content delivery and DNS since 2010 because its paid security products needed a fast caching network CF12. Akamai earned its revenue on traffic delivered, billed by use CFA-2; a free tier would have given away the thing it sold. Asked at the 2010 launch what would stop larger rivals from copying him, Prince said that "the big incumbents have an Innovator's Dilemma trying to come down and deal with a company like ours" CF14. Ben Thompson later observed that the response never came CF14.
The free traffic lowered Cloudflare's costs. The free tier ran on idle capacity, and its scale made Cloudflare a welcome partner for internet service providers (ISPs), which let it place equipment inside their data centers and cut its bandwidth and colocation costs CF10. That is what let the network in step 3 add products at low marginal cost.
The same traffic trained the defenses. By 2011 Cloudflare watched for visitors who triggered missing-page errors across many sites, a sign of an attacker scanning for weak points, and fed each newly seen attack back into protection for every site CF7. Prince said in 2014 that he welcomed free users because the system learns from all the traffic it sees CFA-1, and that year Cloudflare added free automatic encryption for its 2 million free sites CF8.
By September 2026 Cloudflare fronted 26.2% of all websites to Akamai's 0.7% CFA-5. The lead goes back to the DNS switch and free plan of steps 1 and 2: every free site added traffic that lowered cost and improved protection, traffic Akamai never collected.
Rivals Akamai's traffic came from paying customers billed by use; in 2015 it reported that renewals with large customers often came at lower unit prices and that large media customers were building their own delivery CFA-2. It holds 2.1% of reverse-proxy sites to Cloudflare's 85.2% CFA-5.
Key dates
- 2004Project Honey Pot starts on donated DNS records CF2 CF13
- 2010-06Private beta opens to Honey Pot members CF3
- 2010-09Launch: free core service, set up by a DNS change CF1
- 2011-04Attacks seen on one site protect the others CF7
- 2011-08Hosting partner program opens after 100+ hosts join the pilot CF5
- 2012-06Business and Enterprise plans with service-level agreements CFA-9
- 2013-12Akamai agrees to buy Prolexic for attack protection CFA-3
- 20142 million sites Mostly on the free plan; 4–5% pay CFA-1
- 2014-09Free automatic encryption for every site CF8
- 2015-08Discord buys delivery and attack protection together CF9
- 2017-09Workers runs customer code on the same servers CF11
- 2018$192.7M revenue Full year; 313 customers above $100,000 a year CF10
- 2018-12Ericsson turns an Access trial into an Enterprise plan CF10
- 2019-08IPO filing: every server runs every service CF10 CF12
- 2020-06Akamai leads among the 1,000 most-visited sites CFA-6
- 2022-03Akamai completes its purchase of Linode CF15
- 2025$2,167.9M revenue Full year, +29.8% year over year CF16
- 2025-11Configuration changes spread outages across services CF18
- 2026-0926.2% of all websites Akamai 0.7%; reverse-proxy share 85.2% to 2.1% CFA-5
Sources
Oldest first.
- CF4 Taking Cloudflare to the next level. Primary source
- CF2 Introducing Igor, Alex, Phil, Isla, and Vera. Primary source
- CF1 Cloudflare launches at TechCrunch Disrupt. Primary source
- CF7 Smarter Web Security, With Your Help. Primary source
- CF5 Cloudflare launches Certified Hosting Provider Program. Primary source
- CFA-9 Cloudflare Launches Business and Enterprise Services. Company press release
- CFA-3 Akamai to Buy DDoS Protection firm Prolexic for $370 Million. Trade press with executive quotes
- CF6 CloudFlare. Investor analysis
- CFA-1 The Company Keeping Your Favorite (And Least Favorite) Websites Online. Trade press with founder quotes
- CF8 Introducing Universal SSL. Primary source
- CFA-2 Akamai Technologies Form 10-K for fiscal 2015. Company filing
- CF11 Code Everywhere: Why We Built Cloudflare Workers. Primary source
- CF10 Cloudflare Form S-1. Primary source
- CF12 A Letter from Matthew Prince and Michelle Zatlyn. Primary source
- CFA-6 Market share of reverse proxy service providers among the top 1000 sites. Market measurement
- CFA-8 Cloudflare on the Edge. Strategic analysis
- CF14 Cloudflare’s Disruption. Strategic analysis
- CF15 Akamai completes acquisition of Linode. Primary source
- CFA-4 Akamai to boost network-layer DDoS protection with new scrubbing centers. Trade press
- CF13 An interview with Matthew Prince about Internet history and pay-per-crawl. Founder interview
- CF18 Code Orange: Fail Small, our resilience plan following recent incidents. Primary source
- CF16 Fourth quarter and fiscal year 2025 financial results. Primary source
- CF17 Q4 2025 earnings call, corrected transcript. Earnings transcript
- CFA-5 Cloudflare vs. Fastly vs. Akamai usage statistics, September 2026. Market measurement
- R9 It's never been easier to migrate thanks to Cloudflare's new Migration Hub. Challenger migration documentation
- CFA-7 How Cloudflare CEO Prince Turned Company Into Internet's 'Swiss Army Knife'. Trade press with founder quotes
- CF9 Discord customer case study. Primary source
- CF3 Our Story. Primary source