What Is Cloudflare? How It Works, Products, & 2026 Outages

If you’ve ever seen a “Checking your browser before accessing…” screen, you’ve met Cloudflare, even if you didn’t know it. This one company now sits in front of a huge share of the sites you visit every day — quietly deciding which traffic gets through, which gets challenged, and which gets blocked. That’s not a small role. Cloudflare handles roughly a fifth of all web requests worldwide and protects tens of millions of domains, which means when Cloudflare stumbles, a noticeable slice of the internet stumbles with it.

This guide breaks down what Cloudflare is, what it’s built to do, where it’s headed in 2026, and where things have actually gone wrong — including the outages nobody at Cloudflare enjoys talking about. No fluff, no recycled marketing copy, just what you need to know if you’re deciding whether to use it, trying to understand why your site went down, or just curious what’s behind that little orange cloud icon.

What Cloudflare Is, In Plain Terms

Cloudflare started as a content delivery network and DDoS protection service, but it’s grown into something closer to a full internet utility. Site owners point their domain’s DNS at Cloudflare, and from there, nearly every request to that site passes through Cloudflare’s network before it reaches the origin server. That single choke point is what makes the whole thing work: Cloudflare can cache content closer to visitors, filter out malicious traffic, encrypt connections, and absorb attacks before they ever touch the actual hosting infrastructure.

What most explainers skip is why this architecture matters so much. Because Cloudflare terminates traffic at its own edge, it isn’t just a pass-through pipe — it’s a control point. That’s genuinely useful for performance and security. It’s also exactly why outages at Cloudflare ripple outward so violently. When the company’s core proxy layer has a bad day, it doesn’t just affect Cloudflare’s own products; it takes down every site relying on that layer, from tiny blogs to services like ChatGPT and Spotify, both of which were affected during a major incident in November 2025.

Core Products: More Than Just a CDN

People still think of Cloudflare mainly as a CDN, but that’s an outdated picture. The product lineup now spans several genuinely distinct businesses stitched together under one dashboard.

The security side includes the Web Application Firewall (WAF), DDoS mitigation, bot management, and Zero Trust tools under the Cloudflare One umbrella, which handle things like secure remote access and browser isolation for businesses. On the developer side, Cloudflare Workers lets people run serverless code directly on Cloudflare’s edge network, and products like R2 (object storage) and D1 (a serverless database) round out a genuine cloud computing platform that competes, in narrower ways, with AWS and Google Cloud. There’s also 1.1.1.1, Cloudflare’s free public DNS resolver, which has quietly become one of the most-used privacy-focused DNS services around.

The part that’s easy to miss: Cloudflare’s own leadership has said the company is increasingly betting its future on AI infrastructure rather than just security and CDN services. At its Agents Week event in 2026, the company rolled out compute tools built specifically for running AI agents and large language model inference at the edge, including a compression system called Unweight designed to shrink model footprints and speed up inference. That’s a meaningful pivot for a company that made its name blocking bad traffic, not running AI workloads. techware

Cloudflare vs. AI Crawlers: The Fight Over Content

Here’s something almost nobody outside the industry press has fully connected: Cloudflare has positioned itself as the internet’s gatekeeper against AI companies scraping content without paying for it, and it’s now acting on that in a way that will change how publishers operate.

Starting September 15, 2026, new Cloudflare customers and new sites from existing customers will default to a setting that allows traditional search crawlers to index their pages while blocking “mixed-use” bots — the ones that blend search indexing with AI training and agent scraping — from any page carrying ads. CEO Matthew Prince framed this as a response to the fact that non-human traffic now makes up the majority of internet requests, arguing the ecosystem needs faster, more deliberate controls. Alongside the blocking defaults, Cloudflare introduced a “Pay Per Use” framework meant to let publishers actually get compensated when AI systems consume their content, plus an attribution dashboard so site owners can see who’s crawling them and why.

This matters because Cloudflare’s market position gives it outsized leverage here. Because so much of the web already routes through its network, a policy change like this doesn’t just affect Cloudflare’s own customers in isolation — it reshapes the default economics of how AI companies access web content at scale. Whether that model actually holds up, or whether AI companies find workarounds, is still an open question nobody can answer honestly yet.

The Outages: What Actually Happened and Why They Matter

Cloudflare has had a genuinely rough stretch of high-profile incidents, and pretending otherwise would be dishonest. Being straight about this is part of understanding the company, not a knock against it.

The November 18, 2025 outage was the big one: a misconfigured Bot Management feature file grew unexpectedly large, crashed proxy servers across the network, and took down access to major services for nearly six hours. Weeks later, on December 5, 2025, a botched Web Application Firewall rule — meant to patch a security issue related to React Server Components — caused a wave of 5xx errors that hit sites including LinkedIn, Zoom, and Discord. Then came February 20, 2026: a change to how Cloudflare manages IP addresses onboarded through its Bring Your Own IP pipeline accidentally caused the network to withdraw around 1,100 customer IP prefixes via BGP, leaving some customers unreachable from the internet for over six hours. Cloudflare later confirmed publicly that this wasn’t the result of any attack — it was a self-inflicted configuration error.

After that second global outage in close succession, Cloudflare’s engineering team declared what it internally called “Code Orange: Fail Small,” a company-wide push to make sure the failure modes behind those incidents can’t repeat. Smaller incidents have continued through 2026 — a Sites and Services degradation in April, WAF challenge failures, and a 15-hour minor outage in early July — which is a reminder that even a company built around reliability isn’t immune to its own complexity.

What’s New for Cloudflare Right Now

Beyond the AI crawler policy, 2026 has been a genuinely active year for Cloudflare’s roadmap. The company posted a strong close to 2025, including its largest annual contract deal to date, averaging $42.5 million a year, with total new contract value growing close to 50% year-over-year — its fastest growth in recent memory. Investor sentiment followed: shares climbed from the low $220s into the high $260s in early July 2026, with several Wall Street banks raising price targets after the company’s Investor Day laid out an aggressive long-term growth roadmap tied heavily to AI infrastructure demand.

On the product side, Wrangler Flagship shipped as a new command-line suite for managing feature flags and app configuration on the Workers platform without redeploying code, and the company introduced an “Agent Readiness” score to help site owners understand how well their infrastructure supports AI agents crawling and interacting with it. None of this is speculative roadmap talk — these are shipped features, not promises.

Common Myths About Cloudflare, Cleared Up

A few misconceptions keep circulating, so it’s worth addressing them directly.

Myth one: Cloudflare hosts your website. It doesn’t, in the traditional sense — it sits in front of your existing host and proxies traffic, though products like Cloudflare Pages do offer actual hosting for static and Jamstack sites. Myth two: Cloudflare outages mean the whole internet goes down. Not quite — only sites and services actively routed through Cloudflare’s network are affected, but because that’s such a large slice of the web, it can feel that sweeping. Myth three: the free plan is basically useless. It’s actually one of the more generous free tiers in the industry, covering CDN, basic DDoS protection, and SSL at no cost, though serious businesses will outgrow it fast.

Frequently Asked Questions

Is Cloudflare free to use? Yes, Cloudflare offers a genuinely usable free plan covering CDN, SSL, and basic DDoS protection. Paid plans add advanced WAF rules, image optimization, and dedicated support.

What caused the most recent major Cloudflare outage? The February 20, 2026 incident was caused by an internal configuration change to Cloudflare’s Bring Your Own IP system, which accidentally withdrew around 1,100 customer IP prefixes from the network.

Does Cloudflare block AI chatbots from using my content? Starting September 15, 2026, new sites and new customers will default to blocking mixed-use AI/search crawlers from ad-supported pages, while still allowing traditional search indexing. Existing sites keep their current settings unless changed.

Is Cloudflare the same as a VPN? Not exactly. Cloudflare’s WARP and 1.1.1.1 products offer some VPN-like privacy features, but Cloudflare’s core business is proxying and protecting websites, not anonymizing individual user browsing the way a dedicated VPN does.

Why do so many websites go down at once when Cloudflare has an outage? Because Cloudflare terminates traffic at its own network edge for a large share of the web, a failure in its core proxy or routing layer can simultaneously affect every site that relies on it — this isn’t confirmed to be intentional design risk, just a consequence of centralization.

Is Cloudflare a good choice for a small business website? For most small sites, yes — the free and lower-tier paid plans cover the essentials well. Larger businesses with complex compliance or Zero Trust needs will likely need the enterprise-tier products.

The Bottom Line

Cloudflare isn’t just a CDN anymore, and it hasn’t been for a while. It’s become one of the load-bearing pieces of internet infrastructure, an increasingly serious AI compute platform, and — like anything that big — occasionally a single point of failure for a huge chunk of the web. The company has been unusually transparent about its outages, which counts for something, and its new stance on AI crawlers could genuinely reshape how publishers get paid for their content. Whether you’re evaluating Cloudflare for your own site or just trying to understand why half the internet seemed to disappear for an afternoon, the honest picture is this: it’s an enormously capable platform that carries enormous concentrated risk, and both of those things are true at the same time.