CLOUDFLARE

The origin story starts with Project Honey Pot, a free open-source project that Matthew Prince created in 2004 to track online spammers and hackers. The project grew to track millions of malicious IP addresses, and the Department of Homeland Security started using the data.

But Prince noticed something: he had all this threat intelligence and no good way to help website owners actually use it.

At Harvard Business School in 2009, Prince teamed up with Michelle Zatlyn for a class project exploring how to turn that threat data into a product. Their professor gave them a B — which Prince has jokingly called the most expensive B in HBS history, given what the company became.

They brought in Lee Holloway, a brilliant but unconventional systems programmer Prince had worked with previously, as the third co-founder and technical architect.

Cloudflare launched publicly at TechCrunch Disrupt in September 2010 with a bold pitch: sign up for free, change your DNS, and Cloudflare will make your website faster and more secure. No hardware to install.

No software to configure. Just a DNS change.

In the first day, thousands of websites signed up. The simplicity was the product — in an industry where security meant expensive appliances and complex configurations, Cloudflare said "just point your domain at us and we'll handle it."

Cloudflare operates on a freemium model with usage-based pricing. The free tier provides basic CDN, DDoS protection, and SSL for any website — this is how millions of sites use Cloudflare without paying a cent.

Paid plans start at $20/month (Pro), $200/month (Business), and custom enterprise pricing for large organizations.

The free tier is the growth engine, not charity. Every free website that routes through Cloudflare adds data to the network — more traffic patterns to analyze, more attacks to learn from, more threat intelligence to feed the machine learning models.

Free users make the paid product better.

Enterprise contracts are where the real money lives. Large organizations pay six and seven figures annually for advanced security, performance, and compliance features.

Revenue exceeded $1.7 billion in 2024, growing 30%+ year-over-year. The company has been approaching profitability with improving margins.

Cloudflare CDN — a content delivery network spanning 330+ cities in 120+ countries that caches and serves web content from the nearest location to each user, making websites dramatically faster. Cloudflare DDoS Protection — automatic detection and mitigation of distributed denial-of-service attacks.

Has blocked some of the largest DDoS attacks in internet history, including a 71 million requests-per-second attack in 2023. Cloudflare Workers — a serverless computing platform that lets developers deploy code to Cloudflare's edge network, running applications in 330+ locations worldwide with millisecond latency.

Cloudflare Zero Trust — a complete security platform replacing traditional VPNs and firewalls with identity-based access controls for remote workforces. Cloudflare R2 — object storage that competes with Amazon S3 but with zero egress fees, saving companies thousands on data transfer costs.

Cloudflare grew by being free. The free tier removed every barrier to adoption.

A blogger in India and a Fortune 500 company could both sign up in five minutes. This created a massive installed base that generates word-of-mouth, training data, and upsell opportunities.

The developer community became the second growth engine. Cloudflare Workers turned the company from a security vendor into a cloud computing platform.

Developers build entire applications on Cloudflare's edge network, which creates deep technical lock-in. Once your application runs on Workers, migrating to AWS Lambda is a significant engineering effort.

Strategic pricing warfare accelerated commercial adoption. When Cloudflare launched R2 storage with zero egress fees, it directly attacked Amazon S3's most hated pricing model.

The "Bandwidth Alliance" partnered with cloud providers to eliminate data transfer fees. These moves positioned Cloudflare as the anti-AWS — the cloud company that doesn't nickel-and-dime you.

AWS, Google Cloud, and Microsoft Azure are simultaneously partners and competitors. Cloudflare's network sits in front of these clouds, which makes the cloud providers uncomfortable.

As Cloudflare expands into compute (Workers), storage (R2), and databases (D1), the competitive overlap grows. The cloud providers could theoretically build or acquire similar capabilities and bundle them for free.

Profitability pressure is real. Cloudflare has prioritized growth over profits, spending aggressively on network expansion and R&D.

Operating margins have been negative for most of the company's public life, though they've been improving. Investors have tolerated this during growth-stock mania but patience may not last forever.

Content moderation controversies arise periodically. As a company that provides infrastructure to millions of websites, Cloudflare occasionally faces pressure to terminate service to controversial or harmful sites.

They removed 8chan after the El Paso shooting in 2019 and the Daily Stormer in 2017. Prince has described these decisions as uncomfortable, arguing that infrastructure providers shouldn't be arbiters of online speech but sometimes have no choice.

New Enterprise Associates (NEA) led the Series A. Venrock, Pelion Venture Partners, and Union Square Ventures invested early.

Fidelity, Microsoft, Google Capital (now CapitalG), and Baidu all invested in later rounds — notably both Google and Baidu investing in the same company. The September 2019 IPO raised $525 million at a $4.4 billion valuation.

The stock has since grown significantly.