Cloudflare alternatives: what replaces each service, and how to leave without downtime
Eight destinations, sorted by the service you're replacing, and a nine-step exit plan.
Cloudflare isn't one product, it's five: a CDN, a WAF with DDoS protection, DNS, a developer platform (Workers and Pages) and Zero Trust tunnels. You don't replace "Cloudflare". You replace the piece you use. The short answer: Bunny.net for the CDN, at $0.01/GB in North America and Europe; Gcore if you want 1 TB free every month; CloudFront if you already live on AWS; Fastly for heavy traffic and fine-grained control; Vercel or Netlify to replace Pages; Bunny DNS or deSEC if you only need DNS; Tailscale or Pangolin for tunnels. One thing up front: nothing free today bundles a CDN, a WAF and unmetered DDoS protection for $0. Leaving costs something, in money or in time. We compared these eight options and checked their pricing in 2026.
Some links may be affiliate links. The ranking is editorial: a sponsored spot is always labeled on its card, and no affiliate link changes a score.
Why people leave Cloudflare, and why most stay
Let's be fair: on paper, Cloudflare is hard to beat. The free plan caches your site, issues the SSL certificate, absorbs DDoS attacks with no cap and runs a managed firewall, all for $0. It holds the top score in our CDN ranking, 4.6/5. People leave for other reasons: concentration risk, two global outages in 2025, support locked behind paid plans, and privacy questions. Here are six, each one sourced.
Two global outages a few weeks apart
In 2025, an outage of almost six hours took down the CDN, Turnstile, Workers KV, Access and even dashboard logins. Cloudflare's own post-mortem explains it: a database permissions change doubled the size of a file used by Bot Management, and its proxies refused to load it. It wasn't an attack. Cloudflare called it its worst outage since 2019. Weeks later, an emergency WAF change meant to block a React vulnerability knocked out roughly 28% of the HTTP traffic it serves, for less than an hour. Your origin was up. Nobody could reach it.
An account can be cut off fast
A Business customer paying $250 a month wrote that Cloudflare asked for $120,000 upfront for a year of Enterprise, with 24 hours to sign. After the customer mentioned talks with Fastly, every domain was removed: DNS, cache and inbound email. They moved to Fastly in an emergency. Later coverage tells another side: the customer reportedly ran an online casino, and Cloudflare cited a terms-of-service violation. Both versions are out there. The lesson holds either way: don't register your domain with your CDN, and be ready to move within 24 hours.
Human support starts at $20 a month
Free gets the community forum and the docs. Tickets come with Pro ($20/month billed annually), chat with Business ($200/month annually), and 24/7 phone only on Enterprise, priced by quote. The 100% uptime SLA is Business and Enterprise only. Reviews repeat the same complaint: during an attack, there's nobody to call without Business. Another common one: legitimate visitors blocked by mistake, especially on VPNs or Tor.
Your traffic is decrypted at Cloudflare
With the orange cloud on, your visitor's HTTPS connection terminates at Cloudflare, gets inspected, then is re-encrypted to your origin. Your data is readable on its servers. To be fair, every caching CDN and every WAF works this way, Bunny.net and Fastly included. Only DNS-only, with no proxy, avoids it. If that's your real reason to leave, change the model, not just the vendor.
Vendor concentration
The most common reason in developer write-ups isn't price. It's that one company can disable all of your sites for any reason, and that a big share of the web shares the same single point of failure. For European teams, the US CLOUD Act adds a compliance question: Cloudflare relies on the EU-US Data Privacy Framework and standard contractual clauses. Bunny.net (Slovenia) and Gcore (Luxembourg) are the usual EU picks.
The more Workers you use, the harder it gets
A static site behind the CDN moves in a day. An app on Workers with KV, Durable Objects, R2 or D1 doesn't: those pieces have no direct equivalent elsewhere, and you'll rewrite. The classic fallback is gone too: in 2026 Deno announced it is joining Cloudflare, and Deno Deploy shuts down six months after that announcement. On Hacker News, Workers and R2 come up again and again as the hardest parts to replace. Keep your code as standard as you can if you want the door open.
You're leaving because… go to…
Find the line that fits. If you use several Cloudflare services, you'll end up with several destinations, and that's fine: nothing says it all has to sit with one vendor again.
$0.01/GB in NA and EU, free WAF tier, free DNS up to 500 domains.
You want the biggest free allowanceGcore1 TB free every month, then €0.01/GB, no subscription.
Your stack already runs on AWSAmazon CloudFrontFree flat-rate plan, Pro at $15 with no overage bills.
Heavy traffic, deep control, or a contract fight with CloudflareFastlyThe most configurable, and the priciest: $0.12/GB.
Your site runs on Cloudflare Pages or WorkersVercel or NetlifyVercel for Next.js and big traffic, Netlify for content sites.
You only use DNS, or you expose a home serverdeSEC or PangolindeSEC for free nonprofit DNS, Pangolin to replace Tunnel.
Cloudflare alternatives, service by service
For each tool: why move to it, who it's for, its catch, how to migrate from Cloudflare, and what it costs. Prices are what vendors list in 2026. Scores out of 5 match our other pages. To pick a CDN from scratch, read our best CDN ranking. Three names worth a line but not a card: Akamai, enterprise-only with no public price list; Sucuri, a WordPress-focused firewall, and Imperva, both treated here as quote-based since we couldn't read an official price; and BunkerWeb, an open source WAF you host yourself in front of your server (it isn't a CDN).
Bunny.net: the most-cited replacement
CDN, WAF and DNSWhy Bunny.net. It's the name in almost every "I left Cloudflare" post. The company is Slovenian and the price fits on one line: $0.01/GB in North America and Europe on the Standard network (119 PoPs), $0.03 in Asia and Oceania, $0.045 in South America, $0.06 in the Middle East and Africa. The Volume network, on 10 PoPs, drops to $0.005/GB. Minimum spend is $1 a month. At 1 TB a month in the US, you pay $10. Bunny also covers two more Cloudflare services: Bunny Shield (free Basic tier with 71 WAF rules, Advanced at $9.50/month, Business at $99, DDoS included) and Bunny DNS, free up to 500 domains per account with unlimited queries and DNSSEC.
Who it's for. Small business sites, stores, blogs and media that want off Cloudflare without a new budget line, plus anyone serving video: the per-GB price doesn't care whether it's an image or a movie.
Who it's not for. Anyone relying on Cloudflare to hide their origin IP. Bunny works as a pull zone: your hostname points to Bunny by CNAME, and Bunny fetches from you. It's not the same full proxy as the orange cloud.
The catch. Some developers criticize support and Edge Scripting, and the CDN itself has no free plan: the trial is 14 days, no card. Shield Basic and Bunny DNS are free.
How to migrate. Create a pull zone with your server's real IP as origin, add your hostname, then hit "Verify & Activate SSL". Set caching to respect origin headers instead of rebuilding rules. Watch out: no-cache at the origin means no caching on Bunny. One developer caches HTML at the edge with public, s-maxage=86400, max-age=0 and purges after each deploy.
- Price
- $0.01/GB NA/EU, $1/mo minimum
- Our score
- 4.4/5
- Replaces
- CDN, WAF, DNS
- Catch
- doesn't hide origin IP like a full proxy
Gcore: the most generous free tier
1 TB free a monthWhy Gcore. It's the closest thing to Cloudflare's free CDN. Gcore, based in Luxembourg, gives you 1 TB of traffic a month, then charges €0.01/GB up to 500 TB, €0.008 up to 1 PB, €0.0065 up to 2 PB and €0.005 beyond. No subscription, no card, 210+ PoPs. A site serving 1 TB a month pays nothing.
Who it's for. Small and mid-size sites that want a cheap, pay-as-you-go CDN with an EU vendor.
Who it's not for. Anyone counting on Cloudflare's free WAF and DDoS layer: Gcore sells those separately.
The catch. Protection is the weak spot of its score (3.4/5 on that criterion with us), and support is middling. Pricing is listed in euros, so US invoices move with the exchange rate.
How to migrate. Same as any pull CDN: declare your origin, add your domain, let Gcore issue the certificate, point a subdomain first, then switch the main site.
- Price
- 1 TB free, then €0.01/GB
- Our score
- 4.1/5
- Replaces
- CDN
- Catch
- WAF and DDoS sold separately
Amazon CloudFront: if you already live on AWS
Flat rate, no overageWhy CloudFront. AWS now sells flat-rate plans per distribution with no overage charges: Free at $0 (1M requests, 100 GB, 5 WAF rules), Pro at $15/month (10M requests, 50 TB, 25 rules), Business at $200 (125M, 50 TB, 50 rules), Premium at $1,000. Or stay pay-as-you-go: 1 TB and 10M requests free each month, then $0.085/GB in the US and Europe. If your site is on S3 or EC2, it's the natural exit.
Who it's for. Engineering teams already on AWS who want one console and one bill.
Who it's not for. A small site that wants a five-minute setup. CloudFront takes more know-how than Cloudflare.
The catch. Setup (3.4/5 with us) and support (3.5/5). DNS doesn't come along: you need Route 53 or another provider.
How to migrate. Create the distribution with your bucket or server as origin, request a certificate in AWS Certificate Manager, rebuild cache and redirect rules, then switch DNS once the distribution is deployed.
- Price
- Free $0, Pro $15/mo
- Our score
- 3.9/5
- Replaces
- CDN, WAF rules
- Catch
- more technical setup
Fastly: fine-grained control at a premium
Heavy trafficWhy Fastly. It's where the customer in the $120,000 story landed, and where teams go when they want to tune everything: cache logic is programmable (VCL, then Compute for code at the edge). Fastly includes 100 GB and 1M requests a month per region, then $0.12/GB in North America and Europe. DDoS protection costs $1 per 10,000 requests past 500,000, the Next-Gen WAF is quote-based, and Deliver Basic starts at $1,500 a month.
Who it's for. Media, high-traffic stores and platforms with an engineering team and a matching budget.
Who it's not for. A small business coming off Cloudflare's free plan. At 1 TB a month, you're around $108 before requests, versus $10 on Bunny.
The catch. Price, hence its 3.4/5, the lowest of our CDNs, despite a network we score 4.5/5.
How to migrate. Inventory your cache, redirect and firewall rules first: they get rewritten in VCL or the Fastly UI. Test on a subdomain, then cut over.
- Price
- $0.12/GB after 100 GB free
- Our score
- 3.4/5
- Replaces
- CDN, Workers (Compute)
- Catch
- expensive for small sites
Vercel: the clearest path off Pages and Workers
Replaces PagesWhy Vercel. If your site is on Cloudflare Pages or a Next.js app runs on Workers, Vercel has an official migration guide from Cloudflare. Hobby is free (100 GB of transfer, capped, personal non-commercial use only). Pro is $20 per developer per month with 1 TB included, then from $0.15/GB. DDoS mitigation is on every plan, with 3, 40 or 250 custom firewall rules depending on the plan.
Who it's for. Teams building in Next.js or React who want preview deployments per branch.
Who it's not for. A commercial site hoping to stay free: Hobby doesn't allow it. Also anyone deep in KV, R2 or D1, which have no direct equivalent.
The catch. The managed OWASP ruleset is Enterprise-only, and bills climb fast past the included terabyte.
How to migrate. Your _redirects file moves into vercel.json (the /* wildcard becomes :path*). Pages Functions become API routes, Workers become Edge Functions. Data in KV, R2 or D1 moves to a database or storage of your choice.
- Price
- Pro $20/developer/mo, 1 TB included
- Our score
- 4.4/5
- Replaces
- Pages, Workers
- Catch
- Hobby is non-commercial
Netlify: for content sites deployed from Git
Replaces PagesWhy Netlify. For a marketing site, a blog or docs deployed from GitHub, Netlify does what Pages does with an easier setup. Free is $0 (300 credits a month), Personal $9 (1,000 credits), Pro $20 a month for the whole team with unlimited members (3,000 credits). One GB of bandwidth uses 20 credits (about $0.13), one production deploy 15 credits.
Who it's for. Small content teams that ship often and want per-team pricing, not per-developer. Unlike Vercel's Hobby, Netlify's free plan allows commercial use.
Who it's not for. High-traffic sites: 1 TB burns 20,000 credits. Pages and Vercel are far cheaper there.
The catch. On Free, once the 300 credits are gone, your sites pause until next month. Our full Netlify review explains the credit system, and our Netlify pricing breakdown runs the numbers.
How to migrate. Connect your Git repo, reuse the build command, copy your _redirects file (Netlify reads the same format), then add your domain.
- Price
- Pro $20/mo per team
- Our score
- 4.1/5
- Replaces
- Pages
- Catch
- bandwidth is costly in credits
deSEC: free, nonprofit, DNSSEC by default
Replaces DNSWhy deSEC. Plenty of sites only use Cloudflare as DNS. deSEC is a free DNS host run by a Berlin nonprofit, funded by donations, with open source code. It signs your zone with DNSSEC automatically and has a REST API, handy for DNS-based Let's Encrypt validation.
Who it's for. Developers, nonprofits and small teams that want DNS independent of a big vendor, at no cost.
Who it's not for. Anyone wanting a polished dashboard and guaranteed support: it's a nonprofit service. If you're on Bunny for the CDN, Bunny DNS (free up to 500 domains) is simpler.
The catch. No proxy, no cache, no application-layer DDoS protection: it's DNS and nothing else.
How to migrate. Export your zone as BIND, swap the Cloudflare IPs on proxied records for your origin's, import the zone, then follow the DNSSEC order in step 5 before changing nameservers.
- Price
- free (donations)
- Replaces
- DNS
- Best for
- independent DNS with DNSSEC
- Catch
- no proxy or cache
Pangolin: replace Cloudflare Tunnel on your own box
Replaces TunnelWhy Pangolin. Cloudflare Tunnel exposes a home service (a NAS, Jellyfin, an internal app) without opening ports. Pangolin does the same on your own server: a self-hosted tunneled reverse proxy over WireGuard with a small client called Newt. On r/selfhosted, users call it the most user-friendly self-hosted alternative to Cloudflare Tunnel. The software is free; you pay for a small VPS with a public IP.
Who it's for. Self-hosters who don't want their traffic going through Cloudflare, especially for video, which Cloudflare's proxy gets in the way of on apps like Jellyfin.
Who it's not for. Team access to internal tools with identity and per-user policies: Tailscale fits better. Our guide to switching from Tailscale covers Tailscale against Cloudflare Zero Trust, which is free up to 50 users, then $7 per user per month. One user reports running Plex behind CGNAT on Tailscale for about two years almost flawlessly.
The catch. No DDoS protection: your VPS takes the hit. And you maintain it.
How to migrate. Install Pangolin on the VPS and Newt at home, recreate each public route, then delete the tunnel and matching Access app in Cloudflare.
- Price
- free, plus a VPS
- Replaces
- Tunnel
- Best for
- self-hosting
- Catch
- no DDoS protection
The 8 alternatives side by side
For a ballpark, take a site serving 1 TB a month in the US or Europe. Cloudflare Free: $0. Gcore: €0, the terabyte is free. CloudFront: $0 pay-as-you-go (1 TB free) or $15 on the Pro flat rate. Bunny.net: $10. Vercel Pro: $20, terabyte included. Fastly: about $108 before requests. The math shifts once you add WAF and DDoS, bundled at Cloudflare and Bunny, sold separately at Gcore and Fastly.
| Starting price | What it replaces | |
|---|---|---|
| CloudflareWhere you start | Free $0, Pro $20, Business $200 a month (annual) | CDN, WAF, DDoS, DNS, Workers, Pages, Zero Trust |
| Bunny.netEU-based | $0.01/GB in NA and EU, $1/month minimum | CDN, WAF (Shield), DDoS, DNS |
| GcoreBiggest free tier | 1 TB free, then €0.01/GB | CDN (protection sold separately) |
| Amazon CloudFrontAlready on AWS | Free $0, Pro $15 a month | CDN, WAF rules |
| FastlyHeavy traffic | $0.12/GB after 100 GB free | CDN, edge compute |
| VercelNext.js apps | Hobby $0, Pro $20 per developer | Pages, Workers, DDoS |
| NetlifyContent sites | Free $0, Pro $20 per team | Pages |
| deSECNonprofit DNS | Free | DNS with DNSSEC |
| PangolinSelf-hosted | Free, plus a VPS | Tunnel |
Prices as listed by vendors in 2026, before tax, subject to change.
Leaving Cloudflare in nine steps
Most outages during a move come from doing things in the wrong order: nameservers changed before the new zone is ready, DNSSEC forgotten, a certificate that only works behind Cloudflare. This order avoids all three.
List the Cloudflare services you actually use
Day 1Open each domain and note what's on: CDN and cache rules, WAF and rate limiting, DNS, Workers and Pages, Access and Tunnel, Registrar, Email Routing. Each has its own exit, and the one you forget (often Email Routing) is what breaks on cutover day.
Tip: you don't have to move everything. Keeping DNS at Cloudflare and moving only the CDN, or the reverse, is a legitimate setup.
- Time
- one to two hours
- Risk if rushed
- a forgotten service breaks
Export the DNS zone and flag proxied records
Day 1In the dashboard, go to Records, then Import and Export, then Export: you get a BIND file (the API does it too, at 3 requests per minute, up to 256 KiB). Proxied records carry the cf-proxied:true tag. Those pointed at Cloudflare's IPs; at the new provider they must point at your origin's real IP.
If your bare domain uses a CNAME, Cloudflare allowed that through CNAME flattening. Elsewhere you'll need an ALIAS or ANAME record, or a fixed IP, so check your new DNS supports it.
- Format
- BIND file
- Gotcha
- CNAME at the apex
Build the full zone at the new DNS, email included
Day 2Recreate everything before touching nameservers: MX, SPF, DKIM, DMARC, CAA (which lets Let's Encrypt issue your certificate) and Google or Microsoft verification records. One Mastodon admin wrote that missing MX records bounced email during his move.
Some registrars make you switch nameservers before you can enter records. In that case, prepare the zone at an independent DNS (Bunny DNS, deSEC) so it's ready the moment you switch.
- Time
- half a day
- Risk if rushed
- lost email
Lower TTLs a few days ahead
D-3TTL tells resolvers how long to cache an answer. Lower it on the records you'll change a few days before cutover. A nameserver change still takes 24 to 48 hours to propagate no matter what, so keep the old setup running in the meantime.
- Propagation
- 24 to 48 hours
- Keep
- old config live
Turn off DNSSEC in the right order
D-2This is the step that takes the most sites down. Remove the DS record at your registrar first, wait for it to propagate, and only then disable DNSSEC at Cloudflare. Do it the other way around and validating resolvers return SERVFAIL: your domain vanishes for part of the internet. Once at the new DNS, re-enable DNSSEC and publish the new DS.
- Order
- remove DS, wait, then disable
- Risk if rushed
- domain unreachable
Replace certificates, especially Origin CA
D-1The certificate your visitors see belongs to Cloudflare. It doesn't come with you; the new CDN issues its own. The real trap is on your server. If you installed a Cloudflare Origin CA certificate there, only Cloudflare trusts it. Once traffic hits your origin directly or through another CDN, browsers show an untrusted certificate error. Swap it for a public certificate, such as Let's Encrypt, before cutover.
- Replace
- Origin CA certificate
- With
- a public certificate
Rebuild rules at the new provider
D-1Redirects, cache rules, firewall rules, rate limits: none of them export to another vendor. For caching, prefer "respect origin headers": your server decides, and you stop depending on a CDN's proprietary rules. Your next migration gets easier too.
- Time
- a few hours
- Tip
- origin-driven caching
Cut over a subdomain first, then the site
Day DStart with a static-assets subdomain (cdn.example.com), check caching, headers and the certificate, then switch the main site. Keep the old setup for a few days: traffic keeps hitting old URLs. One admin measured about 1 GB a day still served the old way after his move.
- Time
- a day, then a few days of watch
- Risk if rushed
- visible downtime
Transfer the domain out of Cloudflare Registrar
AfterIf your domain is registered with Cloudflare, unlock it (Manage Domains, then Configuration, then Unlock), copy the authorization code and start the transfer at the new registrar. Cloudflare can approve right away; otherwise it auto-approves on day five. ICANN rules block any transfer within 60 days of a registration, a transfer or a registrant contact change. Our best domain registrar guide helps you pick where it goes.
- Delay
- up to 5 days
- Lock
- 60 days after a change
Is your tool missing from this page? Email us: hello@hackceleration.com
What makes a Cloudflare exit go wrong
Leaving Cloudflare isn't technically hard. What hurts is what you forget: an order, a record, a certificate. Each takes minutes to fix before, and hours of downtime after.
Switching nameservers before the zone is ready
When you change nameservers, the new zone must already be complete. An empty zone for a few hours means site and email down for some visitors, and up to 48 hours of propagation to fix it.
Forgetting DNSSEC
A stale DS at the registrar means SERVFAIL. You may not see it if your own resolver doesn't validate, but everyone whose resolver does will.
Leaving an Origin CA certificate on the server
Everything works while Cloudflare sits in front. The day you remove it, visitors get a security warning. Check your origin certificate's issuer before cutover.
Keeping the domain at your CDN
If your CDN shuts your account and holds your domain, you can't even repoint it. Keep registrar, DNS and CDN separate, or at least the registrar.
Comparing prices that don't compare
Cloudflare bundles WAF and DDoS. Gcore and Fastly sell them separately; CloudFront caps rules per plan. Compare with the protection you need, not just the per-GB price.
Leaving Workers without a data plan
Code gets rewritten. Data in KV, R2, D1 or Durable Objects has to be exported and moved. Don't schedule cutover until that data is copied and checked.
- Active Cloudflare services listed per domain
- DNS zone exported as BIND
- Proxied records pointed at the real origin IP
- Apex CNAME replaced with ALIAS, ANAME or IP
- MX, SPF, DKIM, DMARC and CAA recreated
- TTLs lowered a few days ahead
- DS removed before disabling DNSSEC
- Origin CA certificate replaced with a public one
- Cache, redirect and firewall rules rebuilt
- Subdomain cut over and checked before the site
- Workers data (KV, R2, D1) copied
- Domain transferred out of Cloudflare Registrar if needed
Cloudflare alternatives: frequently asked questions
Is there a free alternative to Cloudflare?
For one service, yes. For the bundle, no. Gcore gives 1 TB of CDN a month, CloudFront 1 TB pay-as-you-go or a Free flat-rate plan, Bunny DNS and deSEC free DNS, Pangolin free tunnels on your own server. But nothing free combines a CDN, a WAF and unmetered DDoS protection the way Cloudflare Free does.
Is there anything better than Cloudflare?
Better at one thing, yes. Fastly gives deeper control over caching, Bunny.net is simpler to price and EU-based, CloudFront fits AWS teams better. As an all-in-one free package, nothing matches it, which is why it holds 4.6/5 in our CDN ranking.
What is the best European alternative to Cloudflare?
Bunny.net, from Slovenia, covers CDN, WAF and DNS in one account. Gcore, from Luxembourg, has the bigger free CDN allowance. For DNS only, deSEC is a Berlin nonprofit. Other EU names you'll see are Scaleway, OVHcloud, Myra and Link11, without readable public CDN pricing.
How do I move my DNS off Cloudflare?
Export the zone as BIND, replace the Cloudflare IPs on proxied records with your origin's, rebuild email records at the new provider, remove the DS record before disabling DNSSEC, then change nameservers. Expect 24 to 48 hours of propagation.
Can Cloudflare suspend my account?
Yes, under its terms of service, and it has happened to paying customers. The protection is structural: keep your domain at a separate registrar, export your DNS zone and rules regularly, and know how you'd repoint within 24 hours.
What replaces Cloudflare Tunnel?
Pangolin if you want a self-hosted tunnel on a VPS, Tailscale or Headscale for private access between devices, and ngrok or frp for quick exposure of a local service. None of them adds DDoS protection.
Can I use Cloudflare with another CDN?
Yes. You can keep Cloudflare for DNS only (grey cloud) and put Bunny.net or CloudFront in front of your site. A full multi-CDN setup with failover is costly to run and mostly makes sense for large companies.
What replaces Cloudflare Workers?
Vercel Edge Functions, Netlify Edge Functions, Fastly Compute or AWS Lambda@Edge, depending on where the rest of your app lives. Skip Deno Deploy: Deno is joining Cloudflare and Deno Deploy shuts down six months after the announcement. The slow part is data in KV, R2 or D1, which has no direct equivalent.
Get the next migration guide in your inbox
One tool to leave, one destination, one migration plan. Nothing else.