The free plan covers 50 users, but two limits decide your real cost: the 50-seat cliff and a per-seat DNS query cap most buyers never see.
By Veracity Media Network · Published 2026-07-18
Cloudflare Zero Trust has a real free plan, not a trial. It covers up to 50 users at no cost, with no credit card, and it stays free indefinitely. For a small team replacing a VPN, that is a production-usable tier.
Two limits decide whether the free plan actually works for you, and whether the paid plan costs what you expect:
Neither of these is on the main pricing page. Both are below.
The free plan is not a stripped demo. It carries the core Secure Service Edge (SSE) feature set.
| Included on Free | Limit |
|---|---|
| Users (seats) | Up to 50 |
| Zero Trust Network Access (ZTNA) | Full |
| Secure Web Gateway (DNS + HTTP filtering) | Full |
| Digital Experience Monitoring | Included |
| WARP device client | Included |
| CASB (SaaS scanning) | 2 read-only API integrations |
| Data Loss Prevention | Limited predefined profiles only |
| Log retention | 24 hours |
| Physical locations | Up to 3 |
| Support | Community forums and Discord only |
| Uptime SLA | None |
Cloudflare Zero Trust's free plan covers up to 50 users at no cost and includes ZTNA, Secure Web Gateway, CASB with two read-only API integrations, and Data Loss Prevention with limited predefined profiles, with 24-hour log retention and community-only support. [1]
The practical gaps on Free are log retention (24 hours is too short for most incident review), the 3-location cap, and no support channel beyond the community. None of those block a small team from running it in production.
The paid Pay-as-you-go plan is described as $7 per user per month with no cap on seats. That description is incomplete. Cloudflare Gateway carries a usage limit that does not appear on the pricing page.
Under Cloudflare's Service-Specific Terms, Gateway DNS carries an average limit of 150,000 DNS queries per seat per month. If a customer's average monthly queries exceed the per-seat figure, Cloudflare reserves the right to require the purchase of additional seats. [2]
150000 Gateway DNS queries per seat per month
The cap averages about 5,000 DNS queries per seat per day. For a normal single-user workstation this is rarely reached. It becomes a real constraint when seats are shared, when a DNS forwarder on a LAN routes many devices through one seat, or when background traffic from a small number of enrolled devices is heavy. In those cases the effective cost rises above the $7 list price, because Cloudflare can require you to add seats to cover query volume rather than headcount.
No seat cap is not the same as no usage cap
The seat count on the $7 plan is uncapped. Gateway DNS usage is not. If your average DNS volume runs above 150,000 queries per seat per month, the plan can require more seats than you have people. Size on query volume, not just headcount, if you run shared devices or DNS forwarders.
This is the single most important number for anyone comparing Cloudflare's $7 to a competitor's per-user price. A per-user price with a per-seat usage ceiling is a different economic shape from a flat per-user price, and it is the detail most third-party pricing pages omit.
The most common question about the free plan, by search volume, is what happens at user 51. The answer depends on understanding what a "user" is.
A seat is consumed when a user's identity performs an authentication event. For Access, that is a login to an application or the App Launcher. For Gateway, that is a WARP device enrollment. The limit is on authenticated users, not devices: one person can enroll several devices and connect them at once while consuming a single seat.
A Cloudflare Zero Trust seat is consumed when a user is added through any authentication event, and the user continues to occupy that seat until removed. Cloudflare can automatically expire users who have not logged in or triggered a device enrollment within a configurable window of two months to one year, which frees their seats. [3]
What this means in practice:
Users are seats, not devices
A team of 45 people running 120 devices is still 45 seats and fits the free plan. A shared kiosk login used by 60 different people can consume far more seats than expected. Count authenticating identities, not headcount and not devices.
The free plan runs out of room along four axes, not just the user count. Each maps to a specific paid feature.
| You hit this limit | On Free | Fix requires |
|---|---|---|
| More than 50 authenticating users | Hard cap | Pay-as-you-go ($7/user/mo, billed annually) |
| Need more than 24h of logs | 24 hours | Pay-as-you-go (30 days) or Contract (6 months + Logpush) |
| Need an uptime SLA | None | Pay-as-you-go (100% uptime SLA) |
| Need email security, full DLP, RBI, or SASE network services | Not available | Contract plan (each is an add-on) |
The paid tiers, verified July 2026:
The Pay-as-you-go plan is $7 per user per month billed annually with a 100% uptime SLA and 30-day log retention; the Contract plan is custom-priced per user and adds email security, full DLP, Remote Browser Isolation, and SASE network services as add-ons. [4]
The effective-cost trap on the paid side is that the $7 headline covers core ZTNA and Secure Web Gateway only. A team that needs email security or full DLP is on the Contract plan, where add-ons push the real per-user figure well above $7. Cloudflare does not charge for bandwidth, app connectors, or threat volume on any plan, so the costs to watch are the DNS cap, Log Explorer storage, and Contract add-ons, not traffic.
For a same-tier reference point without leaving the pricing question:
The full audit, current pricing table, and Compliance Transparency Index score for the tool live on the Cloudflare Zero Trust review page.
What we verified and when. All plan features, user limits, and prices were verified against Cloudflare's own plans page and product documentation on 2026-07-18. The 150,000-queries-per-seat DNS cap is verified against Cloudflare's Service-Specific Terms (Gateway section) on the same date. Seat-consumption and auto-expiry behavior is verified against Cloudflare's Zero Trust seat-management documentation on the same date.
Sources. Primary sources are Cloudflare's own pricing page, Service-Specific Terms, and developer documentation (Tier 2, official vendor documentation). The demand context for this piece comes from the Veracity Media Network's own Google Search Console data for the ZeroMetric property (Tier 1, our own data): 342 pricing-related Cloudflare Zero Trust queries drew 18,606 impressions and 3 clicks over the 90 days ending 2026-07-16, with the "free 50 users" question accounting for the majority of that volume.
What this piece does not verify. We did not independently audit Cloudflare's enforcement of the DNS cap or measure how frequently it is applied in practice; we report the limit as stated in Cloudflare's terms. Competitor prices for Zscaler, Palo Alto Prisma Access, and Tailscale are drawn from public sources and vendor pages and are directional, not quotes for a specific configuration.
Freshness commitment. Free-tier terms change. This piece carries a verification date and is scheduled for quarterly re-verification against Cloudflare's live pricing page and terms. If you are reading it more than three months after the updated date above, confirm the numbers against Cloudflare directly before relying on them.
Affiliate disclosure. Cloudflare does not operate a public affiliate program, and this piece contains no affiliate links. The Veracity Media Network earns nothing from Cloudflare regardless of what you choose.