Cloudflare Zero Trust review

Cloudflare Zero Trust is a cloud platform for controlling access to users, devices, applications, and data. Its homepage lists zero trust network access (ZTNA), a secure web gateway (SWG), and digital experience monitoring (DEX). Identity-aware access controls connect approved users to applications and can help organizations replace VPN access. The platform also includes a secure web gateway for protecting web traffic.

Pricing gives smaller teams a way to start without a per-user charge: the Free plan covers up to 50 users. Pay-as-you-go costs $7 per user per month, with no user limit. Contract pricing is annual per user, but the amount is not published. In practice, the right tier depends on how many people need access, how long you need logs, and whether you need the broader SASE and workspace-security features in the contract plan.

The most appealing part is the low entry cost. According to the pricing page, the Free plan includes up to 50 users, DEX for teams under 50, and up to 24 hours of log retention. That gives smaller organizations and proof-of-concept projects room to try access controls before committing to a paid plan.

• Pay-as-you-go is $7 per user per month, has no user limit, and includes up to 30 days of log retention.
• The contract plan includes up to six months of log retention, Logpush to a SIEM or cloud storage, and unlimited CASB and DLP.
• Support steps up by plan: the Free tier lists community forums and Discord, pay-as-you-go lists chat and ticket support, and Contract adds phone support.

The product may also suit teams with specific access problems rather than a full enterprise rollout. In one Reddit thread, a WordPress user suggested putting the admin area behind Cloudflare Zero Trust so only verified users can reach it. That is an example of a possible use, not proof that setup is effortless or right for every site.

Free is useful, but its limits are real: it covers up to 50 users and keeps logs for only 24 hours. If you need longer retention, the $7-per-user monthly plan extends that to 30 days; the contract plan goes up to six months. Contract pricing is not published, so organizations cannot compare its full cost from the listed prices alone. Professional services are available to Contract customers, but their price is also not published.

Setup is another potential cost. A commenter on r/Wordpress who had put WordPress and cPanel servers behind Cloudflare Zero Trust described configuration quirks, tunnel failures after some package updates, and slowness over QUIC that required adjustment. That is one user's report, not a universal outcome, but it is a reminder that this is not simply a security plugin you install and forget. The free plan also lists community forums and Discord rather than chat or ticket support, which may matter if you need a faster path to troubleshooting.

Cloudflare Zero Trust has a free plan for up to 50 users, with up to 24 hours of log retention and community forums and Discord support. The first 50 employees are included at no cost; the pricing page lists the next tier, Pay-as-you-go, at $7 per user per month. That plan has no user limit, up to 30 days of log retention, and chat and ticket support. Moving from free to paid adds a per-user bill, but the published pricing does not specify how charges work when a team grows beyond 50 users.

Contract pricing is annual per user, but the amount is not published, so there’s no way to compare its total cost with Pay-as-you-go from the listed prices. Contract includes up to six months of log retention, Logpush to a SIEM or cloud storage, and phone, chat, and ticket support. Professional services are available to Contract customers; their price is also not published. Check the annual commitment and get a quote before budgeting.

Switching means setting up identity-aware access to applications and configuring access controls; Cloudflare says these can help retire VPNs. The published material does not detail migration tooling or estimate the work, so treat setup effort as something to scope before committing, especially if your team is unwilling to manage access configuration.

Log retention is a practical exit concern: the free plan keeps logs for up to 24 hours, Pay-as-you-go for up to 30 days, and Contract for up to six months. Contract includes Logpush to a SIEM or cloud storage; the published details do not list an equivalent export feature on the lower tiers. Confirm what data you need to retain or move before switching plans or leaving. The published material includes no Reddit posts, so we can’t substantiate what tends to make users leave or report Reddit complaints. Contract pricing is also unpublished, which can make comparing an exit or replacement cost harder.