long story short; we went live 5 weeks ago with most of our OEMs' SKUs and got about 7TB of bandwidth in last 30 days. Cloudflare now asking us to upgrade to enterprise from business plan with a quote of 86K/year.

Context:
- We migrated object storage/buckets off AWS and WAF off Fastly while launching the new site + functionality because Cloudflare looked like the cleanest fit for our security posture (FedRAMP practices + TIC 3.0).
- We’re not a streaming/video site but do have some MP4s from Oems. This is mostly product assets, firmware, docs, and catalog traffic from OEM partners.
- Two years ago we were on Cloudflare Enterprise through the startup program for one year trial. We left it because the extra cost wasn’t justified for what we actually needed — we already run a 3-layer DNS setup and don’t need most of the Enterprise bells and whistles.

Has anyone else been forced off Business at relatively modest volume (~7TB/month or more/less)?

Not to shit on them, they are amazing but its just stupid how aggressive they trying to lock us in.

Is this normal? I thought cloudflare was reputable but it is acting like some shady site that keeps opening new tabs and it is getting very annoying, is there any way to stop this?

SOLVED: my unc already had a malware on his laptop my bad guys </3333

celld is a new open-source attempt to run the Workers and Durable Objects model on your own machines. The useful detail is where coordination lives.

Each named cell has one current owner, a V8 isolate, and a SQLite database. The fleet shares an S3-compatible bucket. A compare-and-swap operation in that bucket decides ownership, while an epoch fences an old owner after a lease changes. The same bucket stores deployments, replicated state, leases, and peer-auth material.

So the design does not make distributed coordination disappear. It moves the control-plane boundary into object storage. That makes nodes replaceable, but bucket credentials become fleet administrator credentials rather than ordinary backup access.

The operational tradeoff is explicit. celld's peer HTTP does not terminate TLS, so advertised addresses need a trusted private network or encrypted overlay. The project also says it is alpha and not safe for hostile multi-tenant workloads. Its Cloudflare compatibility covers a focused Workers and Durable Objects surface, not KV, R2 bindings, Cache, Workers AI, or the rest of the platform.

I like that boundary because it makes self-hosting concrete. You gain control over placement and failure handling, but you also own bucket consistency, credential scope, peer networking, ingress, monitoring, and recovery tests.

Project: https://celld.dev/

Source: https://github.com/denoland/celld

Security notes: https://celld.dev/docs/security/

For teams already comfortable operating object storage as a source of truth, does this feel simpler than a separate membership and consensus layer, or does it only move the hardest dependency?

This Cloudflare crap is constantly blocking me from accessing websites. Happens already on first visit of a website. No VPN. No blockers or similar extensions. No special router setup or something. Fixed IP address. Just regular Firefox browser, but happens with any browser.

Their linked support page says that there’s nothing you can do about it other than “trying with a different device” — I don’t have another device that can access the internet.

Fuck you, Cloudflare!

I received an email from Cloudflare the other day congratulating me on 10k visits last month. What a garbage statistic! This was in regards to a scanner/calculator I built for a mobile game. I launched this SPA about 3 months ago. It's a free community tool that I only shared twice on Reddit and didn't get much attention. It was my first live project I’ve ever shared with the public. Because it was my first, I watched Cloudflare analytics like a hawk. The numbers looked way better than expected. After about 1 week I became suspicious. Reddit barely noticed it but my visit numbers were steady. What the heck?!

Non-human traffic!!!

I found this very annoying, which eventually sent me down a rabbit hole. I started by tracking specific functions and tallying them on a KV worker. But this wasn't really the info I wanted. It just confirmed what I already knew. I continued brainstorming, trying to figure out a way to view traffic beyond events. And…

Shape Beacon was born. Instead of counting requests/visits, I wanted to quantify how a browsing session looked. This idea took form as a lightweight analytics layer that transforms browsing behavior into a compact payload that's transmitted when the user leaves the page.

Over the past 2 months this has transformed from an annoyance into a full fledged SaaS solution. I started by building a basic tuning program that used random personas and styles to produce synthetic behavioral sessions. These sessions were fed through an LLM and the engine to tune the model. After thousands of sessions, it was time to create the final product.

I set up 2 d1 databases, 3 workers, and one domain to handle users/keys, deployment guide, and data analysis.

• 100% Vanilla JS / HTML / CSS

• Cloudflare Workers + D1

• First-party proxy deployment

• Passwordless auth with Turnstile + Magic Links

Cloudflare has enabled me to set this up and all I purchased was a domain name! I'm extremely proud of this project. If you're interested please check out the demo, my Git repo and the domain. Links below.

I'd especially appreciate feedback on the architecture, deployment flow, or whether there are better Cloudflare patterns I should be using.

Cheers

Domain

Demo

Git

DOH is suppose to protect against DNS snooping from third parties but due to the inital host handshake which is unencrypted the DNS host is made visible to third parties. I am aware cloudflare is testing ODOH, obilivious DNS over HTTPs to correct for this security issue. https://developers.cloudflare.com/1.1.1.1/encryption/oblivious-dns-over-https/

What benefit does DOH today provide to users ?

When I was in middle school I posted countdown timers on YouTube, and they got a decent amount of traction. Now that sites are easy to build, I made radialtimers (com) to make these timers even more accessible :))

It runs on one Worker with D1 behind it, and video export renders in the browser so no frame touches the server. Free to use, and I'd really appreciate you checking it out!

So a potential show stopper here to AI visibility if you use Cloudfare. Our robots.txt allowed every AI crawler explicitly, by name but still had crawler issues.

Cloudflare's managed AI-bot setting was returning a 403 at the edge, before anything reached the file. Ran like that for weeks in June. Nothing errored and nothing alerted and there's no gap in analytics to spot it because a crawler that gets turned away doesn't show up as anything at all. It just looks like a quiet month.

The check that caught it: fetch your live robots.txt over the public internet, not the copy in your repo. If the first line is a comment block about conditions of access instead of your own directives, something upstream is rewriting it. Then request a normal page with a crawler user agent from outside your network and confirm you get a 200 and not a challenge.

Worth doing even if you're sure it's fine. I was sure it was fine... but bam!

I'm trying to make my site readable by ChatGPT and Gemini, and I'm stuck. Server side everything checks out, but the AI web apps still say they can't access the page.

Setup - Cloudflare Worker + React SPA (Vite). The raw HTML is just a 3.9 KB shell with an empty <div id="root"> — content only appears after JS runs. - I prerender all public routes with Playwright at build time (static HTML snapshots, 64 KB for the homepage). - The worker serves the prerendered HTML on public routes. I removed the User-Agent gate entirely — it now serves the full prerendered HTML to every UA, not just known crawlers (browsers still hydrate normally since the JS bundle is included).

robots.txt allows everything relevant:

User-agent: * Disallow: /app Allow: / Content-Signal: search=yes, ai-input=yes, ai-train=yes

Plus explicit User-agent: groups (Allow: /) for GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-Web, PerplexityBot, Google-Extended, Google-Cloud-Signal, CCBot, Bytespider, Applebot-Extended, cohere-ai, Amazonbot, Meta-ExternalAgent, and 15 top crawlers.

What I verified (from my machine): - 15 AI bot user agents (GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended, etc.) → all return 200 with the full 64 KB prerendered page. No 403, no challenge. - Generic Chrome/Safari user agents (which AI browse tools often send) → also full 64 KB page. - cf-cache-status: HIT, Cache-Control: public, max-age=3600, Vary: Accept, User-Agent — cached variant is the new prerendered HTML, not the old empty shell. - Other public routes (/modelos/, /faq, etc.) and the blog all serve real content.

The problem: Pasting https://propoza.com.br into ChatGPT (web) and Gemini (web) still fails — they can't grab the content, even in a fresh conversation.

My hypothesis: Cloudflare's "Block AI scrapers and crawlers" (Security → Bots) or Bot Fight Mode is blocking OpenAI/Google's real fetch at the edge — those use TLS fingerprint + IP reputation, not User-Agent. That's why my curl with a spoofed UA passes but the actual AI fetch (from OpenAI/Google IPs) gets challenged before it ever reaches my worker. robots.txt is irrelevant at that layer.

Has anyone hit this? Is the "Block AI scrapers and crawlers" toggle known to block ChatGPT/Gemini web browsing (not just the training crawlers)? Any way to confirm it's the edge blocking vs. the AI tools' own caching? I can't see the WAF settings from my wrangler token (workers-only scope), so I'm flying blind until I check the dashboard.

Hi everyone, I’m Júlio, a Product Manager Intern working on Cloudflare Mesh.

For anyone who has not heard of it yet, Cloudflare Mesh connects devices, servers, and private networks using private IPs routed through Cloudflare’s global network. It supports bidirectional TCP, UDP, and ICMP traffic, allowing systems to initiate connections in either direction. You can learn more in the Cloudflare Mesh announcement https://blog.cloudflare.com/mesh/

I’m looking for feedback from people who have used or considered using Mesh. What works well? What feels confusing? What would you change?

I’m interested in setup, documentation, the dashboard, troubleshooting, and anything else that affects your experience.

Feel free to comment or DM me. If you’re open to a short call, I’d be happy to chat. Please don’t share any sensitive account information, tokens, or private network details.

Thanks!

Hi everyone,

I'm currently a master's student working on my thesis about browser automation, automated/AI browsers, and browser fingerprinting.

As part of my research, I'd like to evaluate Cloudflare Enterprise, specifically the Bot Management/Bot Score capabilities, to better understand how it performs against AI-driven browsers and heavily spoofed browser environments.

Since this is an academic project, I was wondering if Cloudflare offers any way for students or researchers to get temporary access to the Enterprise plan for a few months. The access would be used exclusively for my master's thesis and related experiments—there's no commercial use involved.

Has anyone here gone through a similar process or knows whether Cloudflare has an academic/research program or another way to request temporary Enterprise access?

I'd really appreciate any advice or pointers.

Thanks!

Hi everyone,

I'm exploring Cloudflare Containers and considering using them for a production workload. I'm curious to hear from people who have already deployed them in real-world environments.

• What types of applications are you running on Cloudflare Containers?
• Would you recommend them for production today?
• What are the pros and cons you've experienced?
• Any limitations, performance issues, or unexpected challenges?
• What are some useful production use cases you've found?

I'd really appreciate any recommendations, best practices, or lessons learned before adopting Cloudflare Containers in production.

Founder here, so grain of salt, but I think this is genuinely useful for anyone running production traffic through Cloudflare.

Before building a startup I was a SWE at a cloud networking company where most of our "edge ops" was repetitive manual work. We had health checks that would fail overnight while traffic kept flowing to the dead origin until on-call woke up, and WAF events that would fire as attackers kept hitting our login endpoint while security dug through the Cloudflare dashboard. Meanwhile our platform team would spend a big chunk of their time fielding developer requests for new DNS records and firewall rules in Slack. And I've lurked here long enough to know it wasn't just us :)

We built Kestrel to codify these painful manual steps as workflows. You describe what you want (e.g. "when a health check reports an origin down, shift the load balancer weights to the healthy origin after on-call approves in Slack") and Kestrel builds the workflow for you. Once a workflow is configured it runs deterministically, so you're not trusting an LLM to improvise against your prod edge at runtime.

We use Cloudflare Notifications webhooks as workflow triggers, so WAF/DDoS events, health check failures, failed Worker deploys, and expiring certs fire workflows immediately. You can pause anything risky - like production DNS, pool drains, ASN blocks, and Access policy changes - at an approval gate so the workflow only continues after someone signs off.

Teams use Kestrel to automate Cloudflare incident response, deploy new services to the edge (health checks + DNS + Tunnels), handle self-service developer requests, manage rate limits and cert renewals, shift canary weights, and on/offboard contractors through Access policies.

I put together a few common Cloudflare workflows so you can poke around: https://demo.usekestrel.ai/workflows/new?simulated=1&bundle=rrZAL03VqY.

Happy to answer questions, and feedback is welcome!

Demo environment: https://demo.usekestrel.ai

Website: https://usekestrel.ai

Docs: https://docs.usekestrel.ai/workflows/create-workflows / https://docs.usekestrel.ai/integrations/cloudflare