A free Cloudflare alternative depends on which Cloudflare job you need to replace. Cloudflare's own Free plan bundles DNS, CDN, TLS, DDoS protection, and limited WAF features. Few no-cost options replace that entire combination. A free hosting platform may serve a site globally but cannot sit in front of an arbitrary existing origin; free authoritative DNS does not cache web traffic; a self-hosted WAF still needs a server and an operator. Start by naming the layer you actually use. Cloudflare's plan comparison is the baseline for this comparison.
Fluxtail publishes this guide. Fluxtail itself has paid Starter and Pro plans only and is a log-management service, not one of the free CDN, DNS, or WAF options below. This non-ranked comparison was reviewed on September 16, 2026. Plans and restrictions can change, so check each linked vendor page before a cutover.
Seven options, grouped by the job they do
For a bundled CDN, DNS, and basic WAF offer, examine Amazon CloudFront's flat-rate Free plan. For CDN delivery with usage-based billing above a free allowance, examine Fastly. For a site you can deploy on the provider's platform, examine Netlify or, for personal non-commercial work, Vercel Hobby. For authoritative DNS alone, use deSEC. For a self-managed web security layer, consider BunkerWeb; for a self-managed reverse proxy with automatic HTTPS, consider Caddy. These categories are not interchangeable.
The distinction between no subscription charge and no operating cost matters. Hosted free plans have usage and feature boundaries. Self-hosted software can avoid a software license fee while still requiring compute, bandwidth, patching, monitoring, and incident response. Confirm both the technical fit and the billing boundary before moving DNS.
Amazon CloudFront: a bundled free edge plan
CloudFront's flat-rate Free plan combines CDN delivery with Route 53 DNS, TLS, DDoS protection, and a basic AWS WAF capability for a distribution. AWS describes a no-overage flat-rate plan with a designed usage allowance rather than an unlimited production tier. Its feature matrix lists detailed CloudFront access logs and WAF request logs for Pro and above, not Free. A separate cost note says CloudWatch Logs ingestion for those log types is covered by the plan, while storage and queries can incur charges. That cost note does not establish Free-plan access to the logging features.
This is the closest bundled option in this list when you need to front an existing AWS-hosted site or origin. It is not a promise of feature-for-feature Cloudflare parity. Check the precise origin types, WAF rules, DNS configuration, security visibility, and upgrade behavior for your distribution. An application already in AWS may have fewer moving parts to integrate, but that is an architecture consideration, not a measured cost or performance claim. If request logs are required for operations or investigations, verify the Free plan's logging boundary before choosing it.
Fastly: CDN delivery with a free usage allowance
Fastly's Full Site Delivery pricing lists a monthly free tier for bandwidth and requests. It also lists managed TLS allowances, while Next-Gen WAF appears as a separate security product—not an included free-CDN feature. Fastly's account documentation says usage beyond free-tier limits is billed automatically under the account's terms. This is materially different from a hard-stop hobby allowance.
Fastly is a candidate when the main job is caching and delivering an existing site through a CDN, with a team willing to configure origin behavior and watch usage. It is not a free all-in-one DNS and WAF replacement just because CDN delivery begins within a free allowance. Before connecting production traffic, identify who owns billing alerts, TLS setup, cache rules, request logging, and origin protection. Evaluate WAF separately if it is part of your current Cloudflare setup.
Netlify: free site hosting with global delivery
Netlify's Free plan includes deployment, custom domains with SSL, a global CDN, and a monthly credit limit. Its credit model measures several activities, so a small site with functions, previews, or substantial traffic can consume more than just bandwidth. Verify the current credit calculator against the site's real build and request pattern before assuming the plan fits indefinitely.
Netlify works best if you can move the site deployment to Netlify, not when you need a transparent reverse proxy in front of an existing application on another host. Its Free plan also lists traffic rules and basic rate limiting, but those do not establish parity with Cloudflare's DNS, proxy, DDoS, and WAF combination. Check how custom headers, redirects, cache behavior, forms, functions, and origin-dependent routes behave during a staged deployment. Keep the old site available until both the content and non-cacheable paths are verified.
Vercel Hobby: free hosting for personal projects
Vercel offers a free Hobby plan for projects deployed on its platform. Its plan documentation describes deployment, automatic HTTPS, and included resources. Crucially, Vercel's terms restrict Hobby use to personal or non-commercial purposes. That makes it unsuitable as a free plan for a business site merely because its traffic fits the technical limits.
For an eligible personal project, Vercel can replace hosting and web delivery, especially when the application already uses its deployment workflow. It does not automatically become a drop-in DNS/WAF proxy for an unrelated origin. Check deployment framework support, function limits, custom-domain behavior, logging access, and the applicable plan before migration. Commercial work needs an appropriately licensed plan or a different option; do not treat a temporary evaluation offer as a permanent free alternative.
deSEC: free authoritative DNS, not a CDN
If the only Cloudflare component you want to leave is DNS hosting, deSEC describes itself as a free hosted DNS service. It is a focused replacement for authoritative DNS records, not for caching, proxying, WAF rules, bot controls, or web hosting. Your website still needs a separate origin, TLS arrangement, and any desired edge security.
This narrower scope can be an advantage: DNS ownership becomes a deliberate, separate choice. Before switching nameservers, reproduce the complete zone, including A and AAAA, CNAME, MX, TXT, CAA, and service-specific records as applicable. Check DNSSEC delegation and any automation that updates records. A successful web lookup alone does not prove that mail or other services survived a nameserver change. If you are troubleshooting an existing zone, use the DNS diagnosis guide before treating migration as a fix.
BunkerWeb: self-hosted WAF and reverse proxy
BunkerWeb's documentation describes an AGPLv3-licensed, NGINX-based web server with an integrated ModSecurity WAF and OWASP Core Rule Set. It can be a no-license-cost security layer in front of services you operate. It is self-hosted: you must supply and secure the machines, keep the software and rules current, tune false positives, manage certificates, and retain the logs needed to understand blocked requests.
BunkerWeb is a WAF/proxy candidate, not a global CDN or authoritative DNS service. Self-hosting also changes your failure domain: if the proxy instance or its upstream connectivity fails, there is no hosted edge network automatically substituting for it. Decide how many instances and locations are justified by your availability needs, then test rules in a controlled path before routing all production traffic through them. Review the AGPLv3 license obligations for your deployment rather than assuming “free” means obligation-free.
Caddy: self-hosted reverse proxy and HTTPS
Caddy's reverse-proxy guide shows how to put an HTTP proxy in front of an existing backend. When Caddy knows a public hostname and DNS/ports are configured, its documentation describes automatic HTTPS. This makes it useful when the actual requirement is a simple, self-managed reverse proxy with TLS—not a global CDN, authoritative DNS host, or Cloudflare-equivalent WAF.
The software may be straightforward to configure, but you still own server capacity, operating-system updates, upstream health, certificate connectivity, and availability architecture. Confirm how the client IP reaches the application through any other proxies and which proxy is trusted to set forwarding headers. Test cache requirements separately: a reverse proxy does not imply a worldwide cache. Caddy and BunkerWeb can solve different jobs, and either can be paired with a separate DNS provider if that better matches the application.
Choose by the missing function, not the vendor count
Write down the current Cloudflare features your site actually uses: authoritative DNS, proxied HTTP, caching, custom cache keys, TLS, WAF and bot rules, redirects, rate limits, analytics, request logs, and origin-access controls. Mark each as required, replaceable elsewhere, or unused. Then test one candidate against the required items. A site that only needs static deployment has a different shortlist from a public API that relies on WAF rules and detailed edge logs.
Check the free boundary in three separate ways: eligibility (such as Vercel Hobby's non-commercial restriction), usage (such as Fastly's billable overages or Netlify's credits), and feature entitlement (such as CloudFront's access-log tier). For self-hosted software, estimate infrastructure and operational work instead. Avoid a low-license-cost move that removes a critical security control or makes incidents harder to investigate.
If no single candidate covers everything, a component stack can work: one authoritative DNS provider, one CDN or hosting platform, and a separate reverse proxy or WAF. That flexibility brings more configuration and ownership boundaries. Document who operates each layer and how an incident is traced across them. DNS load balancing may matter if you currently use DNS to steer traffic, but record changes alone do not provide the request forwarding or health policy of a managed edge service.
Migrate one domain without losing the evidence
Make the change in stages. DNS, TLS, cache, and security behavior can all fail independently, so a page loading from one laptop is not enough proof.
- Inventory the present path. Export or otherwise record DNS records, origin addresses, hostnames, redirects, TLS modes, cache behavior, WAF rules, trusted proxy headers, and logging destinations. Treat configuration exports as sensitive: they can contain private origins and credentials.
- Build the replacement off the production path. Prove that the new edge or host reaches the intended origin over verified TLS, serves a representative static asset, and handles an uncached authenticated route without caching private responses. Test allowed and blocked requests; a WAF false positive is a user-visible failure.
- Check DNS separately. Use read-only
dig example.com A,dig example.com AAAA, anddig example.com NSfrom more than one resolver, and compare answers with the authoritative zone. Check mail and other TXT/MX records and DNSSEC state when changing nameservers. A recursive resolver may continue serving cached prior answers until their TTL expires; one local result does not prove global propagation. - Check delivery and visibility. Verify the certificate and hostname at the new endpoint, redirects, cache-control and
Varybehavior, origin IP restrictions, error responses, and the logs you actually receive. Keep credentials, cookies, and full personal URLs out of shared diagnostic screenshots and logs. - Change a small, reversible slice. Use a controlled test hostname or a bounded traffic slice where the platform permits it. Compare application errors and user-facing results before expanding. Retain the previous configuration until cached clients and dependent services have been checked; do not shut the old origin on the strength of a single lookup.
If HTTPS fails after the cutover, distinguish the browser-to-edge certificate from edge-to-origin TLS. The TLS handshake guide covers that boundary without recommending disabled verification. Record a named owner and an explicit stop condition for the change.
Logs are a separate decision
An edge migration can change which request and security events are available, especially on a no-cost tier. Fluxtail does not replace Cloudflare, provide CDN/DNS/WAF functions, or make a free edge offer. Its paid Starter and Pro plans are for log management. If your chosen edge, proxy, and application emit logs through supported collection paths, Fluxtail can help search and filter the events that are actually delivered; collection and field mapping must be verified for each source. For that separate need, see Fluxtail pricing.