Cloudflare Access Pricing (2026): Plans, Per-Seat Costs

Short answer: Cloudflare Access pricing is $0 for up to 50 users on Free, or $7 per user per month in USD on Pay-as-you-go. Budget paid seats at the paid-plan rate; the Free plan is a separate tier. Contract pricing is custom. These are Zero Trust prices, not Cloudflare CDN or website-plan prices. Checked October 25, 2026.

Access, Tunnel and CDN pricing: which bill are you comparing?

This page covers Access through Cloudflare One / Zero Trust plans. Cloudflare lists network/CDN and developer-service pricing separately from its Zero Trust seat plans. Do not apply a CDN website-plan rate to an Access user, or assume an Access subscription pays for every Cloudflare service (Cloudflare pricing guide).

If you are connecting an application through a tunnel, scope the connection and the user-access policy separately. Use the Zero Trust plan and seat documentation for authenticated Access users; check any other Cloudflare services against their own pricing. A tunnel-related search does not by itself establish which paid services your deployment needs.

Cloudflare Access plans and prices

Cloudflare sells Zero Trust access in three tiers, and the two self-serve tiers are list prices with no quote required. For the rest of the category, see the zero trust network access hub.

Cloudflare Zero Trust plans and prices in USD, checked October 25, 2026, from Cloudflare's published plan comparison:

All three tiers include the core connectivity software, the Application Connector and the Cloudflare One device client, so ZTNA itself is not the gate between tiers (Cloudflare Zero Trust and SASE plans, checked September 29, 2026).

Watch out: Cloudflare's own account-limits documentation labels the paid tiers "Zero Trust Standard" and "Zero Trust Enterprise" when it sets plan-gated Digital Experience Monitoring and Gateway limits, a different pair of names from "Pay-as-you-go" and "Contract" on the pricing page. Read those two documents as describing the same two paid tiers under two different names, not four tiers.

What Cloudflare Access costs for your team

The Free plan's 50-user cap, not a per-seat price, sets the cost for most small teams. Above that, or wherever 30-day logs, ticket support or the RBI add-on matter, the formula is seats x $7 x 12 months.

A 10-user or 50-user team that wants 30-day log retention, ticketed support or the RBI add-on has to move to Pay-as-you-go regardless of headcount: $840 a year at 10 users, or $4,200 a year at 50, on top of what the Free plan would otherwise cost. All figures are list-price estimates before tax and any negotiated discount; a 250-user deployment is also a realistic candidate for a Contract quote, which Cloudflare does not publish.

Do the first 50 users stay free on a paid plan?

The published comparison lists Free and Pay-as-you-go as separate tiers. For a paid-plan budget, multiply all purchased seats by $7 per month; do not subtract 50 Free-plan seats. For example, 60 paid seats cost $420 monthly, or $5,040 over 12 months before tax and add-ons, rather than $70 monthly for only the ten users above 50 (Cloudflare plans).

Cloudflare distinguishes purchased capacity from users consuming seats. A user takes one seat after an Access authentication or relevant Gateway activity, regardless of how many apps they use. Removing a user frees capacity, but reducing the purchased seat count is a separate subscription action. Check the dashboard invoice and renewal timing before assuming a lower user count lowers your bill (seat management, subscription FAQ).

What each Cloudflare Access plan includes

Free

The Free plan lists ZTNA, Secure Web Gateway, Digital Experience Monitoring and Network Flow Monitoring as included at $0 for up to 50 users, with Cloudflare's own page describing it as suited to "Teams under 50 users or enterprise proof-of-concept tests" (Cloudflare Zero Trust and SASE plans, checked September 29, 2026). It carries 2 read-only CASB integrations and a limited set of predefined DLP profiles, 24-hour log retention, and community forum and Discord support only.

Pay-as-you-go

Pay-as-you-go is $7 per user per month with no user limit, the same core CASB and DLP limits as Free, 30-day log retention, chat and ticket support, and Remote Browser Isolation available as a paid add-on. It is the tier Cloudflare recommends for "Teams over 50 solving narrow SSE use cases without enterprise support."

Contract

Contract is custom annual per-user pricing aimed at organizations "building toward full-featured SASE or workspace security." It offers up to six months of standard log retention with Logpush and phone support. Unlimited CASB integrations, full-featured DLP, Email Security and Network Services are listed as add-ons; confirm their prices and inclusion in your Contract quote (Cloudflare plans). No per-seat rate, minimum commitment or SLA figure is published; get it in writing during a quote.

Costs beyond the license

The seat price is not the whole bill. Confirmed extras and limits, checked September 29, 2026:

• DNS query overage: Cloudflare's Service-Specific Terms for Zero Trust Services cap Gateway DNS at an average of 150,000 monthly DNS queries per seat, equal to 5,000 a day. Go over that average and "Cloudflare reserves the right to require you to purchase additional Seats as required." The terms give a worked example: 1,000 seats cover 150 million monthly queries; if actual usage hits 200 million, the required seat count becomes (200,000,000 / 30) / 5,000, or 1,334 seats. A DNS-filtering-heavy rollout, not headcount, is what can push this line over budget.
• Remote Browser Isolation: documented as "available as an add-on to Zero Trust Pay-as-you-go and Enterprise plans," with no published per-user price. Budget it as a sales quote, not a list rate.
• CASB and DLP depth: both self-serve tiers cap CASB at 2 read-only integrations and DLP at predefined profiles; unlimited CASB and full-featured DLP are Contract add-ons, so request a quote that explicitly includes them regardless of seat count.
• Deployment work: Access is a Cloudflare service, but budget your application infrastructure, connector operation and administration separately. A per-seat service price is not the full cost of running the protected application.
• MSP and reseller pricing: Cloudflare does not publish a separate multi-tenant or reseller price list for Zero Trust on the pages reviewed here. Not published.

Free plan and trial

The published Free plan provides a proof-of-concept path, and Cloudflare's own plan page describes it as fitting "Teams under 50 users or enterprise proof-of-concept tests" with no stated end date (Cloudflare Zero Trust and SASE plans, checked September 29, 2026). An invited user does not consume an active seat until a qualifying authentication or device event. That is seat usage, not a promise that purchased but unused capacity is unbilled; check the subscription seat count (seat management).

Discounts and contract terms

Cloudflare publishes one dated discount-adjacent program rather than a percentage-off table. Through Project Galileo and the Athenian Project, Cloudflare gives the full Cloudflare One suite, including Access, free to qualifying at-risk nonprofits, journalists, humanitarian organizations and election sites, announced December 12, 2022. It is not a self-serve discount code; eligible organizations apply through Cloudflare's impact-program forms. No general commercial nonprofit or education discount is published for Zero Trust beyond that at-risk-group program.

On terms, Cloudflare states you "can change or cancel your subscription at any time." A downgrade "will apply in the next billing cycle," while an upgrade is billed "at the moment you select it" (Cloudflare Zero Trust getting-started FAQ, checked September 29, 2026). No minimum seat count or minimum term is published for Free or Pay-as-you-go; Contract terms are set in your own agreement and are not published.

Watch out: removing a user and revoking a user are not the same thing. Cloudflare's documentation states that removing a user frees the seat, but revoking a user "will not remove the user's consumption of an active seat." Revocation alone does not release capacity. Remove the user, block future access in your identity provider or policies, and separately adjust purchased seats when appropriate (seat management).

Renewal pricing

Cloudflare does not publish a first-year promotional rate or a separate renewal rate for Free or Pay-as-you-go; the list price on the plan page is also the ongoing price. This research found no dated, vendor-published announcement of when the current Free / Pay-as-you-go / Contract structure or the $7 per-seat rate took effect, so no price-change history is claimed here beyond what is stated below. Contract renewal terms depend on your own agreement and are not published.

Cloudflare Access price history

No dated announcement of a per-seat price change to the current three-tier structure was found during this research. Treat the September 29, 2026 figures as the confirmed baseline rather than as a stable long-term rate.

How Cloudflare Zero Trust pricing compares

Cloudflare's Pay-as-you-go tier has no published user minimum and no required add-on, which simplifies the comparison. List prices checked September 29, 2026, at 50 users on each vendor's mainstream paid plan:

At this basis, Cloudflare lists the lowest per-seat rate of the four with a published price. Zscaler Private Access, a common enterprise alternative, publishes no list price on its product page, so it cannot be placed in this table without a quote. See the zero trust network access category hub for the rest of the field.

Is Cloudflare Access worth the price?

For a team under 50 users, Cloudflare Access is close to free to evaluate: the Free plan carries production ZTNA rather than a countdown trial, so the real decision is whether 24-hour logs and community-only support are acceptable during a pilot. Most small teams can answer that quickly.

Above 50 users, Pay-as-you-go's $7 per user per month lists below Tailscale, Twingate and NordLayer's comparable per-seat rates, so price is rarely the reason to look elsewhere. The DNS query cap and the RBI add-on's unpublished price are the two costs worth confirming before committing at scale, because neither shows up on the plan comparison table itself.

Regulated teams that need six-month log retention, Logpush to a SIEM, unlimited CASB integrations or a support phone number should budget for a Contract quote from the outset rather than assuming Pay-as-you-go will cover it; that is where the real cost jump sits, not in the per-seat rate.

Bottom line

Cloudflare Access is inexpensive to evaluate under 50 users and competitively priced above it, at $7 per user per month against $8 to $11 from Tailscale, Twingate and NordLayer at the same seat count. Confirm the DNS query cap and the RBI add-on's price before scoping a rollout, and budget for a Contract quote from the start if you need six-month log retention or a support phone number, rather than assuming Pay-as-you-go covers it. To weigh it against the rest of the category, start from the zero trust network access category hub or the shortlist builder.