Cloudflare Access

Cloudflare Access controls access to self-hosted apps, SaaS applications, and infrastructure by checking identity, device posture, and other context for each request. Policies can grant access at the individual resource level, and applications deny connections unless a user matches an Allow policy. Access supports SAML- and OIDC-compliant identity providers, including enterprise and social providers, as well as Cloudflare as an identity provider. Contractors, partners, and users on unmanaged devices can connect through a browser with social sign-in or one-time PINs. The service can replace or supplement a legacy VPN by providing access to specific applications, and its controls extend to SSH and RDP infrastructure. Teams can manage policies centrally using APIs and Terraform. Publishing a self-hosted public application requires an active Cloudflare domain configured with full or partial CNAME. The free plan is billed forever for fewer than 50 users. Pay-as-you-go costs $7 a month, billed annually, for over 50 users. A contract plan has custom pricing.

Cloudflare Access provides identity- and context-based controls for applications and infrastructure, with options for browser access and VPN replacement. Public self-hosted apps require an active Cloudflare domain, and paid pricing starts at $7 a month billed annually.

Cloudflare Access suits organizations that need to set resource-level access rules for apps and infrastructure. Its browser access options also suit contractors, partners, and people using unmanaged devices.

Overview

Cloudflare Access is a zero-trust access service for organizations protecting applications and infrastructure. It suits teams that need to grant access resource by resource, including to contractors and unmanaged devices. Its default-deny approach and broad protocol support are compelling, but publishing a self-hosted public app requires an active Cloudflare domain.

Key features

Access tied to identity and context

Access checks identity, device posture, and other context on each request, with policies that grant permissions to specific resources. Applications deny access unless a user matches an Allow policy. That is a useful foundation for least-privilege access and can replace or supplement a traditional VPN when people need particular applications rather than broad network access. The tradeoff is that administrators need to define the policies users require.

SAML- and OIDC-compliant identity providers are supported, including enterprise SSO, social identity providers, and Cloudflare as an identity provider. Contractors, partners, and people using unmanaged devices can connect through a browser with social identity or a one-time PIN. This clientless option can simplify access for outside users without requiring a managed device.

Applications, infrastructure, and administration

Access covers infrastructure targets such as SSH and RDP as well as applications. Supported protocols include HTTP, HTTPS, TCP, SSH, RDP, SMB, and VNC. Device posture checks, hybrid deployment, and multicloud support for AWS, Azure, and GCP extend its reach across varied environments. The product also supports VPN management, firewall policy management, network monitoring, application-aware routing, zero-touch provisioning, cloud on-ramps, and integrated security.

Administrators can centralize and scale policy management with APIs and Terraform. Cloudflare names Fleet, Hexnode, Intune, Jamf, JumpCloud, and Kandji as partners for deploying the Cloudflare One Client and configuring devices remotely. Stable client releases are available for Windows, macOS, Linux, iOS, and Android. SIEM log export is supported, but session recording is not, a meaningful gap for teams that need recorded sessions.

One deployment condition deserves attention: publishing a self-hosted public application requires an active Cloudflare domain configured with full or partial CNAME setup. Teams unwilling to make that commitment should look elsewhere.

Pricing

The Free Plan costs nothing, billed forever, for under 50 users. It is a practical fit for small teams and evaluations, but the user cap rules it out for larger deployments.

Pay-as-you-go costs $7 a month, billed paid annually, for over 50 users. It carries the service beyond the free tier's user ceiling, though the annual billing term is an important commitment. The Contract Plan has custom pricing and maximum support, making it the option for organizations seeking that support arrangement rather than a published per-user price.

Cloudflare One also has a free plan at no cost for proof of concept; Cloudflare One is offered for free trial. That proof-of-concept offer is distinct from the Free Plan's under-50-user terms.

Platforms

Cloudflare Access is listed for Android, iOS, Linux, macOS, web, Windows, and API use. Its published Cloudflare One Client releases cover the five major desktop and mobile operating systems: Windows, macOS, Linux, iOS, and Android.

Who it's for

Access is best suited to organizations that want per-resource controls for applications and infrastructure, need to accommodate contractors or unmanaged devices, or are moving away from broad VPN access. Its APIs and Terraform support also suit teams that want to manage policies centrally. Smaller teams can start below the free tier's 50-user threshold; organizations publishing self-hosted public apps must be prepared to use a Cloudflare domain.

Cloudflare says its Trust Hub compliance posture includes ISO 27001, ISO 27701, PCI DSS, and SOC 2 Type II. Those credentials may matter to organizations evaluating security vendors, though they do not replace checking requirements against a specific deployment.

Pros and cons

• Pros: Per-resource policies evaluate identity, device posture, and context, with access denied by default.
• Pros: Browser access with social identity or one-time PINs accommodates contractors and unmanaged devices.
• Pros: Coverage extends from applications to SSH and RDP, with protocols including SMB and VNC.
• Pros: API and Terraform support help centralize and scale policy administration.
• Cons: Public self-hosted app publishing requires an active Cloudflare domain with full or partial CNAME setup.
• Cons: The free plan is limited to under 50 users, while the paid entry price is billed annually.
• Cons: Session recording is not supported.

Alternatives

Consider NetBird if its free plan's stated allowance of up to 5 users and 100 machines better matches a small deployment. Twingate is another freemium option with a free Starter plan, though its stated allowance is up to 5 users and 50 resources.

Cloudflare Gateway is worth comparing if a free plan for 50 users and up to 24 hours of standard log retention fits the requirement. OpenVPN CloudConnexa may suit a smaller setup starting with its Starter plan, which includes 5 seats and requires no credit card.

Menlo Security Secure Cloud Browser is an alternative to consider for browser-focused access. Sangfor EasyConnect is another paid option with pricing available by contacting Sangfor. Zscaler Private Access is a paid alternative with no free plan. Cato Client is a paid option with a free trial.

Readers comparing broader categories can browse Zero Trust Network Access Software, SD-WAN Software, Cloud Network Management Software, Cloud Access Security Broker Software, SaaS Security Posture Management Software, and Business VPN Software.

Verdict

Cloudflare Access is a strong choice for organizations that want identity- and context-based access to specific apps and infrastructure, with browser access for outside or unmanaged users and automation for policy administration. Choose it when least privilege and VPN replacement matter more than session recording, and when a Cloudflare domain is acceptable for publishing self-hosted public apps. Look elsewhere if that domain requirement or the absence of session recording conflicts with your needs.