Cloudflare Zero Trust pricing 2026: free tier, $7 per user, and the add-ons
Cloudflare is the only major SSE vendor that publishes a per-user rate, which makes this the one page in the category where the headline number is a list price rather than someone's estimate. This page breaks down the three published plans, the features that are add-ons rather than inclusions, the log-storage cost, and the DNS-query seat limit that can push your effective per-user price above $7.
Tiers
The three published Cloudflare Zero Trust plans
A genuinely usable free tier, a flat per-user paid plan billed monthly, and a custom annual contract. Publishing any per-user rate at all is itself a differentiator in this category.
Plan
Price
Users
Log retention
Includes
Free
$0
Up to 50
Up to 24 hours
ZTNA + SWG, limited predefined DLP profiles, up to 2 read-only CASB API integrations.
Pay-as-you-go
$7 / user / mo billed monthly
No limit
Up to 30 days
ZTNA + SWG, limited predefined DLP profiles, up to 2 read-only CASB API integrations. RBI available as an add-on.
Contract
Custom annual price per user
No limit
Up to 6 months
Everything above, plus these as paid add-ons: RBI, full-featured DLP, unlimited out-of-band CASB integrations, Email Security.
Source: Cloudflare's own Zero Trust and SASE plans page, checked 26 September 2026. Cloudflare names the third plan Contract on its pricing page and Zero Trust Enterprise in its product documentation; they are the same tier. Application connector and device client software are included on all three plans.
The traps
Where the Cloudflare bill grows
The $7 base is honestly cheap and honestly published. What moves the real number is the seat-count rule, the add-ons Cloudflare prices on quote, and log storage.
The DNS-query seat limit is the one to model first. Cloudflare's Zero Trust service-specific terms state that Gateway DNS-only is subject to an average monthly DNS queries limit of 150,000 per seat, which Cloudflare equates to 5,000 queries per seat per day, and that if your average exceeds it Cloudflare reserves the right to require you to purchase additional seats. This is a contractual ceiling, not a soft guideline, and it is the mechanism by which a busy estate ends up paying more than $7 per actual headcount.
Remote Browser Isolation is an add-on, at an unpublished price. Cloudflare lists RBI as an add-on on both Pay-as-you-go and Contract. It publishes no rate for it, so anyone quoting you a per-user RBI figure is estimating. Budget for it as a quote line, and ask for it in writing before you sign the base seats.
Several enterprise features are add-ons on top of Contract, not inclusions. Full-featured DLP, unlimited out-of-band CASB integrations and Email Security all sit as paid add-ons on the Contract plan. Treating them as bundled is the most common way a Cloudflare comparison understates its own enterprise total.
Log storage. Log Explorer is an add-on on every plan, including Free, and Cloudflare states there is no free version or trial. Contract customers can extend storage to two years at an additional $0.10 per GB per month. Billing is by GB ingested and stored, not by how often you query.
Alternatives
Compare before you commit
Cloudflare is the cheap, simple, published end of the SSE market. Price it against the enterprise platforms and the identity-led path.
Cloudflare publishes three plans. Free covers up to 50 users at $0 with ZTNA and secure web gateway, 24 hours of log retention, limited predefined DLP profiles and up to 2 read-only CASB API integrations. Pay-as-you-go is $7 per user per month with no user limit and up to 30 days of log retention. Contract is custom-priced, quoted as an annual price per user, and raises log retention to up to 6 months. Cloudflare is the only major SSE vendor that publishes a per-user rate at all, which makes it the cheapest verifiable entry point into the network pillar.
Is Cloudflare Zero Trust Pay-as-you-go billed monthly or annually?
Cloudflare lists Pay-as-you-go at $7 per user per month, billed monthly with no term commitment. The annual commitment sits on the Contract plan, which Cloudflare describes as an annual price per user and prices on quote. This matters for a buyer comparing Cloudflare to Zscaler, Netskope or Prisma Access: those three quote annual contracts, so Cloudflare is the only one of the four you can start and stop month to month.
What does the Cloudflare Zero Trust free plan include?
Up to 50 users at no cost, with ZTNA and secure web gateway functionality, limited predefined DLP profiles, up to 2 read-only CASB API integrations, and 24 hours of DNS, HTTP and network event logs. The application connector and device client software are included on every plan including Free. For a small business replacing a VPN, the free tier genuinely covers the core network-pillar requirement, which is why Cloudflare is the standard recommendation for the Microsoft-first SMB path where M365 covers identity and device and Cloudflare covers the network pillar at zero marginal cost up to 50 seats.
What are the hidden costs in Cloudflare Zero Trust?
Three, and the biggest one is not a price. First, the seat maths: Cloudflare's service-specific terms cap Gateway DNS-only usage at an average of 150,000 DNS queries per seat per month, about 5,000 per seat per day, and state that if you exceed it Cloudflare reserves the right to require you to purchase additional seats. A high-query estate can therefore pay above $7 per actual user. Second, features you may assume are included are add-ons: Remote Browser Isolation is an add-on on Pay-as-you-go and Contract, and full-featured DLP, unlimited CASB integrations and Email Security are add-ons on top of Contract, not inclusions. Cloudflare does not publish add-on prices, so those land on a quote. Third, log storage: Log Explorer is an add-on on every plan with no free tier, and Contract customers can store logs for up to two years at an additional $0.10 per GB per month.
Is Cloudflare Zero Trust cheaper than Zscaler?
On published rates, yes, by a wide margin. Cloudflare lists $7 per user per month. The nearest published Zscaler figure is its own AWS Marketplace listing, where Zscaler for Users Business Edition for 50 users is $15,750 per 12 months, which works out at $26.25 per user per month on those two published inputs. Palo Alto's Prisma Access ZTNA Edition is filed at $120 per user per year on the UK G-Cloud framework, roughly $10 per user per month. So Cloudflare undercuts Zscaler's published bundle heavily and sits near Prisma's ZTNA edition, and the 50-user free tier has no equivalent at either. What the premium platforms buy is deeper inspection, a larger enterprise feature set and a longer large-enterprise track record.
Does Cloudflare Zero Trust replace a VPN?
Yes, that is its core use case. Cloudflare Access provides identity-based ZTNA to private applications and Cloudflare Gateway provides secure web and DNS filtering, together replacing the remote-access function of a legacy VPN. You still need an identity provider (Entra ID, Okta, Google) to federate against; Cloudflare verifies identity and device posture but does not issue the identities. For the full VPN-to-ZTNA cost picture including migration, see our VPN replacement analysis.
Cloudflare and Cloudflare Zero Trust are trademarks of Cloudflare, Inc. ZeroTrustCost.com is an independent pricing reference and is not affiliated with, authorised by, sponsored by, or endorsed by any vendor named on this page. Product and company names are used for identification, commentary and price comparison only (nominative fair use).
Sources
Cloudflare, Zero Trust / SASE plans and pricing (plan names, $0 Free at 50 users, $7 Pay-as-you-go per user/month, Contract annual price per user, log retention by tier, add-on gating). https://www.cloudflare.com/plans/zero-trust-services/
Cloudflare, Log Explorer docs (add-on on any Zero Trust purchase, no free version, $0.10 per GB per month for up to two years' storage on Contract). https://developers.cloudflare.com/log-explorer/
Every figure on this page is published by Cloudflare and was checked against the linked Cloudflare surface on 26 September 2026. Where Cloudflare does not publish a price, most notably for the Remote Browser Isolation, DLP, CASB and Email Security add-ons, this page says so rather than substituting an estimate.