access control

Cloudflare Zero Trust

Cloudflare Zero Trust replaces a VPN with identity-aware access. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Cloudflare Access sits in front of an application and checks identity before the request reaches it. The application does not need to be exposed to the internet; a lightweight connector on the internal network makes the outbound connection instead.

The result is that a private application is reachable by an authenticated user from anywhere, with per-application policy, without a VPN concentrator and without opening an inbound port.

How pricing works once you are inside

Per user, per month, with a free tier covering a small team. The paid tiers add device posture checks, logging retention and the gateway features for DNS and network filtering.

The user-based model is favourable for infrastructure — servers do not count — and the free tier is genuinely usable, which is unusual in this category.

Where it breaks down

Protocol coverage. HTTP applications are the first-class case; SSH and database access are supported through the same connector and are less seamless. An environment full of legacy protocols will need work.

The dependency on Cloudflare is total. If the account is suspended or the service is unreachable, access stops. Organisations plan for that with a documented fallback path.

What switching costs

Moderate. The applications and policies are configuration rather than code, but they are Cloudflare's configuration and do not export.

Sources

Cloudflare public documentation and Zero Trust pricing page, read October 2026.