Overview

Cloudflare Access is a zero trust access service for teams securing self-hosted apps, SaaS tools, and infrastructure. It suits organizations that want resource-level controls across a hybrid, multicloud environment. The trade-off is a Cloudflare domain requirement for publishing a self-hosted public application.

Key features

Default-deny, per-resource access

Access evaluates identity, device posture, and request context, then applies policies to individual resources. Applications deny access unless a user matches an Allow policy. That gives teams a more focused alternative to broad network access when replacing or supplementing a VPN, but administrators must define the policies users need.

SAML- and OIDC-compliant identity providers are supported, including enterprise SSO, social identity providers, and Cloudflare as an identity provider. Contractors, partners, and users on unmanaged devices can use browser-based access with social identity or a one-time PIN, avoiding client installation for those cases.

Applications, infrastructure, and administration

Access covers apps as well as infrastructure targets including SSH and RDP. Supported protocols include HTTP, HTTPS, TCP, SSH, RDP, SMB, and VNC. Device posture checks and both client-based and clientless access methods help accommodate managed endpoints alongside browser-only users.

Policies can be administered centrally through APIs and Terraform, making the service a stronger fit for teams that want access controls managed as code. It supports AWS, Azure, and GCP in a hybrid deployment, along with application-aware routing, cloud on-ramps, zero-touch provisioning, network monitoring, and firewall policy management. SIEM log export is supported; session recording is not, which may matter to teams that need recorded sessions for review.

Device-management partners include Fleet, Hexnode, Intune, Jamf, JumpCloud, and Kandji for deploying the Cloudflare One Client and configuring devices remotely. Cloudflare publishes client releases for Windows, macOS, Linux, iOS, and Android. Its Trust Hub describes a compliance posture that includes ISO 27001, ISO 27701, PCI DSS, and SOC 2 Type II.

Pricing

Plan	Price	Fit
Free Plan	0.00 USD per free (billed forever; under 50 users)	Small teams and evaluations below the user cap.
Pay-as-you-go	7.00 USD per month (billed paid annually; over 50 users)	Teams exceeding the free tier’s user limit that want published per-user pricing.
Contract Plan	Custom pricing	Organizations seeking maximum support.
Cloudflare One free plan	0.00 USD per free (proof of concept; Cloudflare One is offered for free trial)	Proof-of-concept work.

The free plan is billed forever but capped at under 50 users, so it is not a route to unlimited free deployment. The paid plan’s annual billing term matters for budgeting; the stated price is 7.00 USD per month. A free trial is available, and the contract option is the path for teams that need maximum support rather than a published price.

Platforms

Access spans web, Android, iOS, Linux, macOS, and Windows, with API support. Its multicloud coverage includes AWS, Azure, and GCP, and its deployment model is hybrid.

Who it's for

Access is a strong fit for teams that need default-deny control over selected applications and infrastructure, want to extend access to contractors without managing a client on every device, or plan to maintain policy centrally through APIs and Terraform. It is less suitable for teams unwilling to configure an active Cloudflare domain for publishing a self-hosted public app, or for workflows that require session recording.

Pros and cons

Pros: Default-deny policies evaluated using identity, device posture, and context support least-privilege access per resource.
Pros: Browser access with social identity or one-time PINs can accommodate contractors and unmanaged devices without a client.
Pros: API and Terraform administration, infrastructure targets, and AWS, Azure, and GCP coverage suit teams managing access across a varied stack.
Cons: Publishing a self-hosted public application requires an active Cloudflare domain configured with full or partial CNAME setup.
Cons: The free tier is limited to under 50 users, and the paid plan is billed annually.
Cons: Session recording is not supported.

Alternatives

For a different mix of access and pricing, compare F5 BIG-IP APM, ZeroTier, Cato SASE Platform, Netskope One Private Access, Pomerium, WatchGuard FireCloud, OpenVPN CloudConnexa, and OpenVPN Access Server.

F5 BIG-IP APM is a paid option with a free trial and a perpetual-license offering across virtual editions, hardware, or hybrid environments. ZeroTier offers a free Personal plan for 10 devices, one network, and one network admin, with an Essential plan at 18.00 USD per month. Cato SASE Platform uses custom pricing by request, while Netskope One Private Access is an enterprise product with pricing not stated on the page.

Pomerium is worth comparing if its Personal Free allowance of 10 users, 10 routes, five policies, and two service accounts fits; its Business plan is 7.00 USD per month. WatchGuard FireCloud has a listed one-year option at 97.75 USD per year per user license for 1–50 licenses. OpenVPN CloudConnexa offers a Starter plan with five seats and an Essential plan at 7.00 USD per month. OpenVPN Access Server has a free tier capped at two connections.

For category-level comparisons, browse Business VPN Software, Zero Trust Network Access Software, SD-WAN Software, Cloud Network Management Software, Cloud Access Security Broker Software, and SaaS Security Posture Management Software.

Verdict

Choose Cloudflare Access if your team wants default-deny, context-aware access to specific applications and infrastructure, with policies managed through APIs or Terraform. Its main advantage is the combination of clientless contractor access and infrastructure coverage; look elsewhere if public self-hosted app publishing without a Cloudflare domain or session recording is essential.

	Barracuda Secure SD-WAN	Cloudflare Access
Free plan	No	Yes
Free trial	No	Yes
Paid from	—	$7/mo
Open source	No	No
Platforms	api, self-hosted	Android, api, iOS, Linux, macOS, Web, Windows
Free plan	—	Yes
Paid from	—	$7/user/mo

Barracuda Secure SD-WAN vs Cloudflare Access

Barracuda Secure SD-WAN

Cloudflare Access