Apps

Cloudflare — news, coverage & facts — IJR

History

Cloudflare was founded on July 26, 2009, by Matthew Prince, Lee Holloway, and Michelle Zatlyn. Prince and Holloway had previously collaborated on Project Honey Pot, a product of Unspam Technologies that partly inspired the basis of Cloudflare. In 2009, the company was venture-capital funded. On August 15, 2019, Cloudflare submitted its S-1 filing for an initial public offering on the New York Stock Exchange under the stock ticker NET. It opened for public trading on September 13, 2019, at $15 per share.

According to the company, the name 'Cloudflare' was chosen, over the initial 'WebWall', because it best described what they were trying to do: build a "firewall in the cloud."

In 2020, Cloudflare co-founder and COO Michelle Zatlyn was named president.

Cloudflare has acquired web-services and security companies, including StopTheHacker (February 2014), CryptoSeal (June 2014), Eager Platform Co. (December 2016), Neumob (November 2017), S2 Systems (January 2020), Linc (December 2020), Zaraz (December 2021), Vectrix (February 2022), Area 1 Security (February 2022), Nefeli Networks (March 2024), BastionZero (May 2024), Kivera (October 2024), Replicate (November 2025), and Human Native (January 2026).

Since at least 2017, Cloudflare has used a wall of lava lamps at its San Francisco headquarters as a source of randomness for encryption keys, alongside double pendulums at its London offices and a Geiger counter at its Singapore offices. The lava lamp installation implements the Lavarand method, where a camera transforms the unpredictable shapes of the "lava" blobs into a digital image.

In Q4 2022, Cloudflare provided paid services to 162,086 customers.

In October 2024, Cloudflare won a lawsuit against patent troll Sable Networks. Sable paid Cloudflare $225,000, granted it a royalty-free license to its patent portfolio, and dedicated its patents to the public by abandoning its patent rights.

In November 2025, it was announced Cloudflare had agreed to acquire Replicate, a San Francisco–based platform that enables software developers to run, fine-tune, and deploy open-source machine-learning models via an API without managing infrastructure.

In January 2026, Cloudflare released an analysis regarding BGP routing leaks observed from the Venezuelan state-owned ISP CANTV (AS8048), which occurred on January 2 coincides with the arrest of Nicolás Maduro. While some security researchers had speculated that the outages were linked to U.S. cyber operations, Cloudflare's data indicated that the anomalies were consistent with a pattern of "insufficient routing export and import policies" by the ISP rather than malicious external interference.

In January 2026, Cloudflare acquired Human Native, an AI data marketplace that brokers transactions between developers and content creators, for an undisclosed amount.

On January 16, 2026, Cloudflare acquired The Astro Technology Company, the developers behind the open-source web framework Astro.

In May 2026, Cloudflare announced the elimination of approximately 1,100 positions, around 20 percent of its workforce, in a restructuring the company attributed to the rapid adoption of artificial intelligence tools. The announcement coincided with the company's first-quarter 2026 earnings, which reported a record $639.8 million in quarterly revenue, a 34 percent year-over-year increase. CEO Matthew Prince stated the cuts were not driven by performance concerns but reflected roles made obsolete by AI, and that Cloudflare expected to employ more people by the end of 2027 than at any point during 2026.

In June 2026, Cloudflare acquired VoidZero, the open-source company behind the JavaScript tool Vite and related developer tools including Vitest, Rolldown, and Oxc. Cloudflare said the acquisition would integrate VoidZero's tooling into its Workers developer platform to support AI-assisted application development, while committing $1 million to an independent Vite ecosystem fund and continuing to maintain the projects as open source.

DDoS mitigation

Cloudflare provides free and paid DDoS mitigation services that protect customers from distributed denial of service (DDoS) attacks. Cloudflare received media attention in June 2011 for providing DDoS mitigation for the website of LulzSec, a black hat hacking group.

In March 2013, The Spamhaus Project was targeted by a DDoS attack that Cloudflare reported exceeded 300 gigabits per second (Gbit/s). Patrick Gilmore, of Akamai, stated that at the time it was "the largest publicly announced DDoS attack in the history of the Internet". While trying to defend Spamhaus against the DDoS attacks, Cloudflare ended up being attacked as well; Google and other companies eventually came to Spamhaus' defense and helped it to absorb the unprecedented amount of attack traffic.

In 2014, Cloudflare began providing free DDoS mitigation for artists, activists, journalists, and human rights groups under the name "Project Galileo". In 2017, it extended the service to electoral infrastructure and political campaigns under the name "Athenian Project". By 2025, more than 2,900 users and organizations were participating in Project Galileo, including 31 US states.

In February 2014, Cloudflare claimed to have mitigated an NTP reflection attack against an unnamed European customer, which it stated peaked at 400 Gbit/s. In November 2014, it reported a 500 Gbit/s DDoS attack in Hong Kong. In July 2021, the company claimed to have absorbed a DDoS attack three times larger than any it had previously recorded, which its corporate blog implied was over 1.2 Tbit/s in total. In February 2023, Cloudflare reported blocking a 71 million request-per-second DDoS attack which "the company says was the largest HTTP DDoS attack on record".

Cloudflare blocked the then largest publicly recorded DDoS attack in August 2025, with volumetric attacks peaking at 11.5 terabits per second (tbps). This was surpassed in December 2025 when an Aisuru botnet launched a 31.4 tbps attack, with a requests-per-second rate exceeding 200 million, against multiple companies in the telecommunications sector, a campaign Cloudflare dubbed "The Night Before Christmas".

In April 2026, Cloudflare released a system designed to let users implement their own custom DDoS mitigation logic, using protocols built on User Datagram Protocol (UDP).

Internet security

In April 2020, Cloudflare announced it was moving away from using reCAPTCHA in favor of hCaptcha. In September 2022, Cloudflare began to test Turnstile – an alternative to CAPTCHA. The product, instead of presenting a visual CAPTCHA for the user to solve, automatizes the verification process by conducting JavaScript-based checks inside the browser to determine whether the user is a real person or an automated entity. The algorithm reportedly uses machine learning to optimize the process.

Through a contract with the Cybersecurity and Infrastructure Security Agency, Cloudflare provides registry and authoritative DNS services to the .gov top-level domain. Cloudflare also launched Cloudflare for Campaigns in 2020, to offer free cybersecurity tools to political campaigns. Those tools expanded to include secure email systems in 2025.

In November 2020, Cloudflare announced Cloudflare for Teams, consisting of a DNS resolver and web gateway called "Gateway", and a zero-trust authentication service called "Access".

Cloudflare released an Oblivious HTTP relay service in 2022, called Privacy Gateway.

Cloudflare announced a partnership with PhonePe in January 2023 to secure its mobile payment system. In February, Cloudflare launched Wildebeest to allow Mastodon users to set up and run their own instances on Cloudflare's infrastructure.

In August 2023, Cloudflare started the Project Cybersafe Schools program as part of a $20 million grant program from Amazon Web Services, making 70 percent of public school districts in the United States eligible for no-cost cybersecurity services.

In March 2024, it announced Firewall for AI to defend applications running large language models (LLMs). In September, Cloudflare announced Ephemeral IDs, which identifies fraudulent activity by linking behavior to a client through a short-lived, generated ID, rather than the traditional means of using an IP address. The same month, the company also announced all ISP and equipment manufacturers could use its DNS resolvers for free.

Cloudflare introduced the Cloudforce One threat events platform in March 2025, offering real-time insights into cyberattacks using data gathered from Cloudflare's network.

Service terminations

Cloudflare provided DNS routing and DDoS protection for the white supremacist and neo-Nazi website The Daily Stormer. In 2017, after previously refusing to take any action against the website, Cloudflare stopped providing its services to The Daily Stormer after an announcement on the website asserted that Cloudflare executives were privately supporting its ideology.

In a statement to Business Insider, Cloudflare CEO Matthew Prince said that he was repulsed by The Daily Stormer's content while expressing regret at the fact that his decision to suspend services had taken the website offline: "The ability of somebody to single-handedly choose to knock content offline doesn't align with core ideas of due process or justice. Whether that's a national government launching attacks or an individual launching attacks."

As a self-described "free speech absolutist", Prince claimed he did not want to repeat the decision, and sought out protections for the company should they be faced with a similar situation in the future. Prince further addressed the dangers of large companies deciding what is allowed to stay online, a concern shared by a number of civil liberties groups and privacy experts. The Electronic Frontier Foundation, a US digital rights group, said that services such as Cloudflare should not be deciding what speech is acceptable and that illegal content should be handled through the legal system.

In 2019, Cloudflare was criticized for providing services to the far-right discussion and imageboard 8chan. The message board has been linked to mass shootings in the United States and the Christchurch mosque shootings in New Zealand. In addition, a number of news organizations including The Washington Post and The Daily Dot have reported on the existence of child pornography and child sexual abuse discussion boards. A Cloudflare representative said that the platform "does not host the referenced websites, cannot block websites, and is not in the business of hiding companies that host illegal content". Cloudflare did not terminate service to 8chan until public and legal pressure mounted in the wake of the 2019 El Paso shooting, in which the associated manifesto was published to 8chan. In an interview with The Guardian immediately after the shooting, CEO Matthew Prince defended Cloudflare's support of 8chan, saying that he had a "moral obligation" to keep 8chan online.

On August 5, 2019, two days after Prince's interview with The Guardian, Cloudflare terminated service to 8chan. Cloudflare explained that 8chan "have proven themselves to be lawless and that lawlessness has caused multiple tragic deaths. Even if 8chan may not have violated the letter of the law in refusing to moderate their hate-filled community, they have created an environment that revels in violating its spirit." Prince condemned the El Paso shooting as "abhorrent in every possible way", removing 8chan from the Internet was "the right thing to do".

Cloudflare provided DDoS mitigation and acted as a reverse proxy for Kiwi Farms. The site often engages in harassment and doxxing of targets and has been implicated in the suicides of at least three people. Kiwi Farms also has a reputation for transphobic content, and its users have been accused of swatting vulnerable individuals. Although Cloudflare was not the primary website host, it did perform critical services to keep Kiwi Farms on-line, both protecting the site from denial-of-service attacks and optimizing content delivery.

In 2022, a campaign was launched by transgender activist Clara Sorrenti, who has previously been targeted by the forum, to pressure Cloudflare into terminating service for Kiwi Farms. Cloudflare responded by issuing a statement on its abuse policies and saying it didn't want to set precedent for speech on the internet with its "extraordinary" decision.

The company also released a blog post and likened its services to that of a public utility, emphasizing that it does not believe in shutting down security services based on content it finds objectionable. They acknowledged that while it might be more popular to remove sites that the Cloudflare team finds offensive, it stood by its decision not to do so. The company also defended its decision by saying that it donated all earnings from anti-LGBTIQ+ sites to an organization that advocated for LGBTIQ+ rights. The blog post mentioned Cloudflare's terms of use agreement, which allows them to terminate service due to "content that discloses sensitive personal information, [and] incites or exploits violence against people" but, according to The Guardian, the statement did not address how Kiwi Farms users' doxxing behavior did not violate these terms.

On September 3, 2022, Cloudflare blocked Kiwi Farms, citing urgent escalating rhetoric against targets of Kiwi Farms, stating that there is an "unprecedented emergency and immediate threat to human life". According to The Washington Post, there was a "surge in credible violent threats stemming from the site" and CEO Matthew Prince said that Cloudflare believes "there is an imminent danger, and the pace at which law enforcement is able to respond to those threats we don't think is fast enough to keep up".

Switter was a social media network for the sex worker community, built by Australia-based company Assembly Four on Mastodon's open-source software, before Cloudflare dropped Switter as a client and ceased services in April 2018, citing terms of service violations. This occurred shortly after the passage of FOSTA/SESTA, a set of bills criminalizing websites that facilitate or support sex trafficking in 2018. SESTA weakened protections for Internet infrastructure companies and was criticized on free speech grounds due to concerns about disproportionate impact and disruptions to the lives of sex workers.

Cloudflare said the move was "related to our attempts to understand FOSTA, which is a very bad law and [sets] a very dangerous precedent". Assembly Four said that "Given Cloudflare's previous stances of privacy and freedom, as well as fighting alongside the EFF, we had hoped they would take a stand against FOSTA/SESTA".