What Cloudflare does and how its platform works
Cloudflare is a cloud connectivity company. Its global platform provides services for website delivery, security, reliability, networking, workforce access, and application development. A company can use one Cloudflare service without adopting the whole platform.
cloudflare.com is Cloudflare’s official website. It explains the products, documentation, support, company, and trust information. The website should not be confused with the platform itself or with a customer website that happens to use Cloudflare.
What Cloudflare is used for
Cloudflare works across several parts of Internet infrastructure. Calling it only a content delivery network, DNS provider, or DDoS service leaves out important parts of the platform.
A website or organization might use Cloudflare to:
- Publish authoritative DNS records
- Route public web traffic through a reverse proxy
- Cache eligible content closer to visitors
- Filter attacks and unwanted requests
- Balance traffic or improve network routing
- Control employee access to private applications
- Run application code and store data
- Protect larger networks and Internet connections
These are possible uses, not features automatically enabled for every customer. The owner chooses products and settings for each domain, application, user group, or network.
How the reverse proxy works
For a proxied website, a simplified request follows this path:
- A visitor requests a page.
- DNS returns an address associated with Cloudflare’s network.
- The browser connects to Cloudflare rather than directly to the origin server.
- Cloudflare applies the services configured for that traffic.
- Cloudflare contacts the origin when it needs a response that it cannot provide itself.
- The response returns to the visitor through Cloudflare.
This arrangement is called a reverse proxy because the proxy receives requests on behalf of the origin application. It lets Cloudflare perform work in the traffic path, such as terminating HTTPS, applying security rules, or serving cached content.
The model does not prove that every response was cached or inspected by every security product. It also does not prove that the origin is unreachable through another address. Those outcomes depend on the customer’s configuration.
Cloudflare uses shared IP addresses and Anycast routing. Anycast allows the same address range to be announced from many network locations so traffic can reach a nearby Cloudflare location. A Cloudflare address therefore identifies the public network path. It usually does not identify the customer’s origin host.
DNS-only and proxied records
Cloudflare can provide authoritative DNS without proxying a website’s traffic. This is one reason the phrase “uses Cloudflare” needs context.
| Setting | What happens | What it does not prove |
|---|---|---|
| DNS-only | Cloudflare answers DNS with the destination configured by the domain owner | Ordinary web traffic does not automatically pass through Cloudflare’s HTTP proxy |
| Proxied | DNS returns a Cloudflare address and supported traffic reaches Cloudflare first | Every response is not automatically cached and every optional product is not automatically active |
| Separate platform product | The customer uses that service according to its own architecture | The rest of Cloudflare’s catalogue is not necessarily in use |
A domain can mix these approaches. Its main website might be proxied, a mail record can remain DNS-only, and a separate application can run on the developer platform.
Main parts of the platform
Cloudflare groups products around different jobs. The boundaries help explain the platform without treating it as one giant switch.
Application performance and security
These services work with public websites, APIs, and applications. They include DNS, content delivery, load balancing, HTTPS, DDoS protection, web application firewall controls, rate limiting, bot controls, and related products.
Each product answers a different problem. A proxied domain does not automatically prove that a web application firewall, bot product, or custom rate limit is enabled. A site owner must configure and test the controls that matter to the application.
Zero Trust and SASE
Cloudflare also provides services that control how employees, devices, and networks reach private applications, the public Internet, and software services. This area is commonly described with terms such as Zero Trust, security service edge, or SASE.
It is different from placing a public website behind a reverse proxy. A company can protect its workforce without hosting its public site on the developer platform, and it can proxy a website without using workforce access products.
Network services
Some products operate at broader network layers rather than only at the web-application layer. They can protect or connect networks, route traffic, or support protocols beyond a normal browser request.
This is why one traffic diagram cannot describe every Cloudflare service. A proxied web request, an employee using a private application, and an organization protecting an IP network follow different paths.
Developer platform
Cloudflare’s developer platform lets teams run code and use managed data services on its network. Common components include:
| Product | Plain-language role |
|---|---|
| Workers | Runs application code without managing a conventional server for that code |
| D1 | Provides managed SQL storage |
| R2 | Stores files and other objects |
| KV | Stores values addressed by keys |
| Durable Objects | Combines state with coordinated compute |
| Queues and Workflows | Supports background messages and multi-step jobs |
These products can be combined, but they are not interchangeable. A relational application may need SQL, an image library may need object storage, and a collaborative session may need coordinated state.
The existence of these services does not mean every site behind Cloudflare was built with Workers or stores data in D1. Many customers keep their application on another host and use Cloudflare only in front of it.
Is Cloudflare a hosting provider?
It can host application code and data through its developer products, but a Cloudflare IP address alone does not show where a site’s origin runs.
In a reverse-proxy setup, visitors see the proxy’s public address. The origin can be in a private data center or with another cloud or hosting provider. Shared proxy addresses intentionally hide that detail from a basic lookup.
Use more precise language:
- “The site’s public traffic passes through Cloudflare” when proxy evidence supports it.
- “The domain uses Cloudflare authoritative DNS” when nameserver evidence supports it.
- “The application runs on Workers” only when direct evidence supports that conclusion.
Does Cloudflare cache every page?
No. Cloudflare offers caching and content-delivery controls, but effective behavior depends on the request, response, cache rules, product, and customer configuration.
Dynamic or personalized responses may not be suitable for shared caching. A customer can bypass cache for selected paths or change how long eligible content is stored. A single Cloudflare response therefore does not establish the cache policy for the whole site.
The same caution applies to security. Cloudflare offers many controls, but presence on the network does not prove that every option is purchased, enabled, or configured correctly.
Privacy, security, and operational trade-offs
When Cloudflare is a reverse proxy, traffic reaches its network before it reaches the origin. That position enables performance and security functions, and it also makes data handling and access control important evaluation topics.
Cloudflare publishes a privacy policy and trust hub with current information about data protection, security, and compliance. A site owner should review those documents for the products and regions it plans to use.
The site owner still has responsibilities. Cloudflare does not make application code correct, permissions narrow, data collection necessary, or an origin secure by default. Teams should review:
- Which records and applications are proxied
- What request and response data passes through the service
- Whether the origin accepts unintended direct traffic
- How certificates, secrets, and administrator access are managed
- Which security rules are enabled and tested
- How logs are retained and who can access them
- What happens during a configuration error or service incident
A layered service can reduce risk while also becoming an operational dependency. Teams need change control, monitoring, backups, and a recovery plan appropriate to the application.
How to evaluate Cloudflare
Begin with the problem rather than the product list. A small website, an internal application, a global network, and a serverless workload have different requirements.
Ask:
- Do we need authoritative DNS, proxying, or both?
- Which hostnames and traffic types should Cloudflare handle?
- Which performance or security problem are we trying to solve?
- Is the task about a public application, employee access, or a network?
- Does the workload fit Workers and the available data services?
- What information will the service process?
- Which features, limits, and support options apply to the intended plan?
- How will we test changes and recover from mistakes?
Then build a representative trial. Measure real pages and requests, test cache and security behavior, verify the origin path, and document the resulting configuration. Current product documentation is more reliable than a generic checklist because plans and capabilities change.
Cloudflare is best understood as a broad connectivity platform. It can answer one focused need, such as authoritative DNS, or combine several services across applications and networks. The correct description for a customer depends on what that customer actually configured, not on the full list of products Cloudflare offers.
A successful response is not a guarantee of safety. Measurements describe one observation in time.