Cloudflare Zero Trust is free for up to 50 users. What the free plan includes, what happens at user 51, the $7 plan and its DNS query limit.
By ZeroMetric · Published 2026-07-18 · Updated 2026-09-27
Cloudflare Zero Trust has a free plan for up to 50 users. It is not a trial, and it includes the main tools a small team needs to replace a VPN: secure access to internal apps and web filtering for its devices.
| Plan | Price | Users |
|---|---|---|
| Free | $0 | Up to 50 |
| Pay-as-you-go | $7 per user a month | No limit |
| Contract | Custom | No limit |
Cloudflare lists its Zero Trust Free plan at $0 for up to 50 users, the Pay-as-you-go plan at $7 per user per month with no user limit, and the Contract plan at a custom price per user. [1]
Cloudflare's own pages differ on billing. The Access product page says the $7 is paid annually, while the general plans page says its listed prices are for monthly billing. Check the terms shown at checkout.
Two details decide what you really pay:
Neither detail is on the pricing page. Both are explained below.
| Feature | On the free plan |
|---|---|
| Users | Up to 50 |
| Access (secure access to internal apps) | Included |
| Gateway (DNS and web filtering) | Included |
| WARP device client | Included |
| Digital Experience Monitoring | Up to 10 tests |
| CASB (scanning SaaS apps such as Google Workspace or Microsoft 365) | Up to 2 integrations |
| Data Loss Prevention | 2 predefined profiles |
| Log retention | 24 hours |
| Support | Community forums and Discord |
| Uptime SLA | None |
On the Free and Pay-as-you-go plans, Data Loss Prevention offers two predefined profiles: Financial Information, and Social Security, Insurance, Tax, and Identifier Numbers. [2]
On the Free plan, Cloudflare keeps Access, DNS, network and HTTP logs for 24 hours. [3]
Zero Trust Free accounts can run up to 10 Digital Experience Monitoring tests. [4]
Free users can configure up to two CASB integrations. [5]
The gaps that matter most for a business are the 24-hour log window, which is too short to look back at most incidents, and the lack of any support beyond the community. Neither stops a small team from running the free plan every day.
You will be asked for payment details when you set up the account, even on the free plan.
Onboarding asks you to select a subscription plan and enter payment details. If you choose the Zero Trust Free plan, this step is still needed but you will not be charged. [6]
The 50-user limit counts people who sign in, not devices.
A user takes a seat through any Cloudflare Access login, such as the App Launcher or an application, or when any of the user's devices connect to Cloudflare One. Each user occupies one seat regardless of how many applications they use. Once all seats in the subscription are taken, additional users who try to log in are blocked. Inactive users can be removed automatically after a period between one month and one year. [7]
In practice:
Count people who sign in
A shared login used by many people, or contractors who sign in once, can use up seats faster than your headcount suggests. Set the inactive-user removal period to match how often people really sign in.
The $7 plan has no limit on users. Cloudflare's Zero Trust terms do set a limit on Gateway DNS use, measured per seat.
Under Cloudflare's Zero Trust service terms, "Cloudflare Gateway DNS only is subject to an Average Monthly DNS Queries limit of 150,000 per Seat", the equivalent of 5,000 DNS queries per seat per day, assuming a 30-day month. If average monthly DNS queries exceed 150,000 per seat, Cloudflare reserves the right to require the purchase of additional seats. [8]
For one person on one computer, an average of 5,000 DNS queries a day is plenty. The limit matters when many devices send their DNS traffic through a few seats, for example an office network that forwards every device's lookups to Cloudflare, or servers and kiosks that make lots of lookups.
The terms include a worked example. A company with 1,000 seats is allowed 150 million queries a month. If it sends 200 million, it needs 1,334 seats.
1334 seats needed for 200 million Gateway DNS queries a month
Cloudflare's terms allow an average of 150,000 Gateway DNS queries per seat per month, which the terms express as 5,000 a day over a 30-day month. At 200 million queries a month, that is 200,000,000 ÷ 30 ÷ 5,000 = 1,333.3, rounded up to 1,334 seats. On the $7 Pay-as-you-go plan, the extra 334 seats would add $2,338 a month, taking the bill from $7,000 to $9,338 a month.
No user limit is not the same as no usage limit
If you plan to send a whole office network's DNS traffic through Gateway, estimate your monthly DNS queries and divide by 150,000. If that number is higher than your headcount, budget for the higher seat count.
| You need | Free plan | Plan that covers it |
|---|---|---|
| More than 50 users | Blocked at 50 | Pay-as-you-go |
| Logs for more than 24 hours | 24 hours | Pay-as-you-go (30 days) or Contract |
| An uptime SLA | None | Pay-as-you-go or Contract (100%) |
| Chat and ticket support | Community only | Pay-as-you-go or Contract |
| Remote Browser Isolation | Not included | Add-on on Pay-as-you-go or Contract |
| Dedicated egress IPs, full data loss prevention or SASE network services | Not included | Contract, as add-ons |
| Log export to your own storage or SIEM (Logpush) | Not included | Contract |
Pay-as-you-go costs $7 per user a month. It adds unlimited users, a 100% uptime SLA, 30 days of logs, and chat and ticket support. Remote Browser Isolation is an extra add-on, and longer searchable log storage (Log Explorer) is billed separately.
Cloudflare lists Log Explorer at $1 per GB ingested, with the first 10 GB free. [9]
Contract is priced per user through sales. It adds phone support and log export with Logpush, and it is the plan for add-ons such as dedicated egress IPs, full data loss prevention and network services for SASE. Contract plans keep DNS logs for 6 months and HTTP and network logs for 30 days.
Cloudflare's Access page lists the Pay-as-you-go plan at $7 per user per month, paid annually, with a 100% uptime SLA for paid plans. On Contract plans, DNS logs are stored for 6 months, and HTTP and network logs for 30 days. [10]
Remote Browser Isolation is available as an add-on to Zero Trust Pay-as-you-go and Enterprise plans. [11]
The $7 price covers the core product. A team that needs full data loss prevention or dedicated egress IPs is shopping for the Contract plan, and should expect a per-user price above $7. Isolation on Pay-as-you-go is also an extra cost.
Tailscale's Personal plan is free for up to 6 users with unlimited user devices and is suitable only for non-commercial use. The Standard plan costs $8 per user per month and Premium $18 per user per month. [12]
Of these four, Cloudflare is the only one with a free plan a business can keep using and a published per-user price after it, all without a sales call. Tailscale publishes its prices, but its free plan is for non-commercial use; businesses get a 14-day trial.
Is Cloudflare Zero Trust free? Yes, for up to 50 users, with no time limit.
Do I need a credit card? Cloudflare asks for payment details during setup, even on the free plan, but does not charge you.
What happens if I add a 51st user? That person is blocked from signing in until you move to a paid plan. You are not charged automatically.
How much is the paid plan? $7 per user a month, with no limit on users. Cloudflare's Access page says it is paid annually.
Does a user with three devices count three times? No. One person takes one seat, however many devices they use.
Sources. Cloudflare's plans page, Access product page, developer documentation and Zero Trust service terms, Tailscale's and Zscaler's pricing pages, and Palo Alto Networks' Prisma Access page. All checked on September 27, 2026.
Calculations. The DNS seat example follows the method in Cloudflare's terms. The dollar figures in it are our own, at the $7 list price.
What we did not check. We did not test how often Cloudflare enforces the DNS limit in practice. We report it as written in the terms.
Corrections in this edition.
Affiliate relationships. Cloudflare has no public affiliate program. We have no affiliate relationship with Cloudflare, Zscaler, Palo Alto Networks or Tailscale, and no vendor pays for placement.
Next check. By December 2026, or sooner if Cloudflare changes its plans.
ZeroMetric is part of the Veracity Media Network, six independent directories of business software covering AI, cybersecurity, finance, HR, logistics and energy. We research each product from its vendor's public documentation: who it is for, features, pricing, how it works and compliance.
If you work at a vendor named here and something is out of date, contact us. We check every correction against public sources before we change a listing.