Vendor pricing

Cloudflare Zero Trust pricing 2026: free tier, $7 per user, and the add-ons

Name: Cloudflare Zero Trust
Brand: Cloudflare
Availability: InStock

Cloudflare Zero Trust is the cheapest credible entry point into the network pillar: free for the first 50 users, then a flat $7 per user per month. This page breaks down the three tiers, what each includes, the Browser Isolation and log-retention costs that sit on top, and how it stacks up against Zscaler. Figures dated June 2026 with sources at the foot of the page.

Tiers

The three Cloudflare Zero Trust plans

A genuinely usable free tier, a simple flat per-user paid plan, and a custom enterprise plan. The pricing transparency is itself a differentiator in this category.

Plan	Price	Users	Log retention	Includes
Free	$0	Up to 50	24 hours	Full ZTNA + SWG, limited DLP.
Pay-as-you-go	$7 / user / mo	No limit	Up to 30 days	ZTNA + SWG, predefined DLP, limited SaaS integrations. Billed annually.
Enterprise	Custom	No limit	Up to 6 months	Expanded CASB, custom DLP, RBI, mTLS, email security, dedicated egress IPs, 24/7 support.

Source: Control D pricing breakdown and Cloudflare official plans, June 2026.

The traps

Where the Cloudflare bill grows

The $7 base is honestly cheap. The cost climbs with isolation, long log retention and heavy DNS traffic.

Remote Browser Isolation. RBI is an add-on, reported at around $10 per user per month on top of the base seat, more than doubling per-user cost where you need it.

Log retention and Log Explorer. Beyond the included retention, Log Explorer bills at about $1 per GB per month after the first 10GB. Long retention for compliance adds up in high-traffic estates.

DNS query volume. Cloudflare cites an average of roughly 150,000 DNS queries per seat per month; environments that exceed the assumptions can incur additional seat or overage costs.

Enterprise feature gating. Expanded CASB, custom DLP profiles, email security and dedicated egress IPs sit behind the custom-priced Enterprise plan, not the $7 tier.

Alternatives

Compare before you commit

Cloudflare is the cheap, simple end of the SSE market. Price it against the enterprise platforms and the identity-led path.

Zscaler pricing

The enterprise SSE comparison

ZTNA cost (all platforms)

Market-wide ZTNA pricing

SSE bundle cost

Full secure service edge economics

VPN replacement cost

ZTNA vs legacy VPN over 3 years

Microsoft Entra pricing

The Microsoft-native ZTNA path

Full vendor comparison

Side-by-side across the market

Frequently asked

Cloudflare Zero Trust pricing questions

How much does Cloudflare Zero Trust cost?

Cloudflare Zero Trust has three tiers. The Free plan covers up to 50 users at $0 with full ZTNA and secure web gateway capabilities, 24 hours of log retention and limited DLP. The Pay-as-you-go plan is $7 per user per month (paid annually) with no user limit, up to 30 days of log retention, and predefined DLP policies. The Enterprise plan is custom-priced and adds expanded CASB, custom DLP, Remote Browser Isolation, email security, dedicated egress IPs and up to six months of log retention. The free tier makes Cloudflare the cheapest credible ZTNA entry point for small organisations.

What does the Cloudflare Zero Trust free plan include?

Up to 50 users (no device limit) at no cost, with full ZTNA and secure web gateway functionality, limited DLP, and 24 hours of DNS, HTTP and network event logs. For a small business replacing a VPN, the free tier genuinely covers the core network-pillar requirement, which is why Cloudflare is the standard recommendation for the Microsoft-first SMB path where M365 covers identity and device and Cloudflare covers the network pillar at zero marginal cost up to 50 seats.

What are the hidden costs in Cloudflare Zero Trust?

Two main ones. First, Remote Browser Isolation is an add-on, reported at around $10 per user per month on top of the base seat. Second, log and data costs: Log Explorer is billed at about $1 per GB per month after the first 10GB, and high-volume DNS environments (Cloudflare cites an average of roughly 150,000 DNS queries per seat per month) can trigger additional seat purchases or overages. The base $7 per-user figure is genuinely low; the cost grows with isolation, long log retention and heavy traffic.

Is Cloudflare Zero Trust cheaper than Zscaler?

On base licensing, almost always yes. Cloudflare's $7 per user per month Pay-as-you-go rate sits below Zscaler's ZIA-plus-ZPA combined range, and the 50-user free tier has no Zscaler equivalent. Zscaler's premium buys deeper inspection, a larger enterprise feature set and a more established large-enterprise track record. For SMB and mid-market organisations that need solid ZTNA and SWG without the enterprise SSE depth, Cloudflare is typically the cheaper and simpler choice. Large enterprises with complex inspection and CASB requirements often still evaluate Zscaler, Netskope and Palo Alto Prisma alongside it.

Does Cloudflare Zero Trust replace a VPN?

Yes, that is its core use case. Cloudflare Access provides identity-based ZTNA to private applications and Cloudflare Gateway provides secure web and DNS filtering, together replacing the remote-access function of a legacy VPN. You still need an identity provider (Entra ID, Okta, Google) to federate against; Cloudflare verifies identity and device posture but does not issue the identities. For the full VPN-to-ZTNA cost picture including migration, see our VPN replacement analysis.

Cloudflare and Cloudflare Zero Trust are trademarks of Cloudflare, Inc. ZeroTrustCost.com is an independent pricing reference and is not affiliated with, authorised by, sponsored by, or endorsed by any vendor named on this page. Product and company names are used for identification, commentary and price comparison only (nominative fair use).

Sources

Control D, Cloudflare Zero Trust Pricing Breakdown (tiers, free 50-user cap, $7 PAYG, RBI add-on, Log Explorer $1/GB). https://controld.com/blog/cloudflare-zero-trust-pricing/
Cloudflare, official Zero Trust / SASE plans and pricing. https://www.cloudflare.com/plans/zero-trust-services/

Tier structure and add-on costs from Control D's pricing breakdown and Cloudflare's official plans. Accessed and verified June 2026. Some add-on figures (e.g. RBI) are community-reported and change with negotiation.