Foundations

How Cloudflare works & where we sit

Before the product demos, here's the big picture: what Cloudflare actually is on the Internet, how a request flows through us, our global network, and how sharing one network with millions of other customers makes everyone safer and faster.

Where Cloudflare sits

Cloudflare is a reverse proxyreverse proxyA server that sits between visitors and your origin, forwarding requests and applying services (security, caching) on the way. Cloudflare is a reverse proxy.: we sit in front of your website. Instead of visitors connecting straight to your originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it. server, their request first arrives at the nearest Cloudflare PoPPoPPoint of Presence — a physical Cloudflare data center location where our servers process traffic. More PoPs means we're closer to more users.. We apply security and performance there, then — only if we have to — forward the request to your origin.

👥
Visitors worldwideBrowsers, mobile apps, APIsAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server.
nearest PoPPoPPoint of Presence — a physical Cloudflare data center location where our servers process traffic. More PoPs means we're closer to more users.
via AnycastAnycastA networking trick where one IP address is announced from many locations at once, so each user is automatically routed to the nearest Cloudflare data center.→
🧡
Cloudflare global edgethe edge“The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center.330+ cities — every service runs here
DNSDNSDomain Name System — the Internet's phone book, translating a domain name (example.com) into a server address.SSL/TLSTLSTransport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser.CDN cachecacheStoring copies of content so it can be served quickly without fetching or recomputing it every time.WAFWAFWeb Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.DDoSDDoSDistributed Denial of Service — an attack that floods a site with junk traffic from many sources to knock it offline.Bot ManagementbotAutomated software making requests instead of a human. Some bots are good (search engines); many are malicious.load balancingload balancingSpreading incoming traffic across multiple servers so no single one gets overwhelmed.
only cache-missescacheStoring copies of content so it can be served quickly without fetching or recomputing it every time. & dynamic requests→
🏢
Your originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it.Your servers or cloud host

1 · Get there fast

AnycastAnycastA networking trick where one IP address is announced from many locations at once, so each user is automatically routed to the nearest Cloudflare data center. routing sends each user to the closest of our 330+ cities automatically, cutting latencylatencyThe delay before data starts transferring — essentially how long a user waits. Lower is better.. No matter where someone is, Cloudflare is usually milliseconds away.

2 · Do the work at the edge

At that location we serve cached content, run the WAFWAFWeb Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site., absorb DDoSDDoSDistributed Denial of Service — an attack that floods a site with junk traffic from many sources to knock it offline. floods, score botsbotAutomated software making requests instead of a human. Some bots are good (search engines); many are malicious., terminate SSL/TLSTLSTransport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser., and more — all before traffic ever reaches you.

3 · Only bother the origin when needed

Static content is served straight from cachecacheStoring copies of content so it can be served quickly without fetching or recomputing it every time.. Your originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it. only sees the requests that truly need it, which is huge origin offloadorigin offloadReducing how much traffic reaches your origin by serving it from Cloudflare's cache/edge instead. and cost savings.

Our global network

Every dot is a data center running the full Cloudflare stack.

Cloudflare city (135 of 330+ shown) AWS region (23)
Cloudflare — SeattleCloudflare — PortlandCloudflare — San FranciscoCloudflare — San JoseCloudflare — Los AngelesCloudflare — Las VegasCloudflare — PhoenixCloudflare — DenverCloudflare — DallasCloudflare — HoustonCloudflare — ChicagoCloudflare — MinneapolisCloudflare — Kansas CityCloudflare — AtlantaCloudflare — MiamiCloudflare — TampaCloudflare — AshburnCloudflare — WashingtonCloudflare — New YorkCloudflare — BostonCloudflare — PhiladelphiaCloudflare — TorontoCloudflare — MontrealCloudflare — VancouverCloudflare — DetroitCloudflare — NashvilleCloudflare — Salt Lake CityCloudflare — Mexico CityCloudflare — GuadalajaraCloudflare — QuerétaroCloudflare — BogotáCloudflare — MedellínCloudflare — LimaCloudflare — SantiagoCloudflare — Buenos AiresCloudflare — São PauloCloudflare — Rio de JaneiroCloudflare — CuritibaCloudflare — Porto AlegreCloudflare — FortalezaCloudflare — BrasíliaCloudflare — Panama CityCloudflare — QuitoCloudflare — CaracasCloudflare — Santo DomingoCloudflare — GuayaquilCloudflare — LondonCloudflare — ManchesterCloudflare — DublinCloudflare — AmsterdamCloudflare — BrusselsCloudflare — ParisCloudflare — MarseilleCloudflare — MadridCloudflare — BarcelonaCloudflare — LisbonCloudflare — FrankfurtCloudflare — BerlinCloudflare — MunichCloudflare — HamburgCloudflare — DüsseldorfCloudflare — ZurichCloudflare — MilanCloudflare — RomeCloudflare — ViennaCloudflare — PragueCloudflare — WarsawCloudflare — StockholmCloudflare — CopenhagenCloudflare — OsloCloudflare — HelsinkiCloudflare — BudapestCloudflare — BucharestCloudflare — SofiaCloudflare — AthensCloudflare — IstanbulCloudflare — KyivCloudflare — MoscowCloudflare — BelgradeCloudflare — ZagrebCloudflare — Tel AvivCloudflare — DubaiCloudflare — DohaCloudflare — RiyadhCloudflare — MuscatCloudflare — Kuwait CityCloudflare — AmmanCloudflare — CairoCloudflare — CasablancaCloudflare — TunisCloudflare — LagosCloudflare — AccraCloudflare — NairobiCloudflare — JohannesburgCloudflare — Cape TownCloudflare — MombasaCloudflare — Dar es SalaamCloudflare — LuandaCloudflare — MaputoCloudflare — DakarCloudflare — MumbaiCloudflare — New DelhiCloudflare — ChennaiCloudflare — BangaloreCloudflare — HyderabadCloudflare — KolkataCloudflare — KarachiCloudflare — LahoreCloudflare — ColomboCloudflare — DhakaCloudflare — KathmanduCloudflare — BangkokCloudflare — HanoiCloudflare — Ho Chi Minh CityCloudflare — SingaporeCloudflare — Kuala LumpurCloudflare — JakartaCloudflare — ManilaCloudflare — Hong KongCloudflare — TaipeiCloudflare — ShanghaiCloudflare — BeijingCloudflare — GuangzhouCloudflare — SeoulCloudflare — TokyoCloudflare — OsakaCloudflare — UlaanbaatarCloudflare — AlmatyCloudflare — PerthCloudflare — AdelaideCloudflare — MelbourneCloudflare — SydneyCloudflare — BrisbaneCloudflare — AucklandCloudflare — Wellington AWS region — us-east-1 N. VirginiaAWS region — us-east-2 OhioAWS region — us-west-1 N. CaliforniaAWS region — us-west-2 OregonAWS region — ca-central-1 CanadaAWS region — sa-east-1 São PauloAWS region — eu-west-1 IrelandAWS region — eu-west-2 LondonAWS region — eu-west-3 ParisAWS region — eu-central-1 FrankfurtAWS region — eu-north-1 StockholmAWS region — eu-south-1 MilanAWS region — me-south-1 BahrainAWS region — me-central-1 UAEAWS region — af-south-1 Cape TownAWS region — ap-south-1 MumbaiAWS region — ap-southeast-1 SingaporeAWS region — ap-southeast-2 SydneyAWS region — ap-southeast-3 JakartaAWS region — ap-northeast-1 TokyoAWS region — ap-northeast-2 SeoulAWS region — ap-northeast-3 OsakaAWS region — ap-east-1 Hong Kong

Each orange dot is a Cloudflare data center city (a representative sample — the real network spans 330+ cities in 120+ countries). Blue squares are AWS cloud regions, shown to illustrate the architectural difference. Positions are approximate and for illustration only.

How we compare

Where competitors sit — and why the model matters.

On the map above, notice the difference in shape. Cloudflare's orange dots are spread densely near population centers worldwide. A traditional cloud like AWS concentrates compute in a relatively small number of large regions (blue squares). Both serve global users, but Cloudflare does the security and performance work at the edgethe edge“The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center. — right next to the user — rather than sending traffic back to a distant region.

ProviderNetwork modelApprox. footprintEgress
CloudflareSingle global network — every security & performance service runs in every location330+ cities / 120+ countriesNo egress fees (R2)
AWS (CloudFront + regions)CDN edge caches, but compute/data concentrated in a few large regions~600+ edge PoPs / ~30+ regionsEgress charged
AkamaiVery large CDN-first edge; security & compute bolted on separately~4,000+ edge locationsEgress charged
FastlyFewer, larger POPs; edge compute focus~90+ POPsEgress charged
Google / Azure CDNCloud-region centric with a CDN layer added onMany edge nodes / regional DCsEgress charged

Figures are approximate and publicly cited numbers, provided for illustration. The point isn't the raw count — it's the model: Cloudflare runs the entire stack in every location, close to users.

How we interact with other customers

One shared, multi-tenantmulti-tenantOne shared platform serving many customers at once, with strong isolation between them. network — and why that's an advantage.

example.comshop · bank · newsmillions more
↓ all protected by ↓
🧡 One Cloudflare network
shared threat intelligence
↑ instantly protects ↑
everyone

Millions of Internet properties run on the same Cloudflare network. Each customer is fully isolated — your traffic and data are your own — but the intelligence is shared.

Because Cloudflare sees a very large share of all web traffic, when we spot a new attack, botbotAutomated software making requests instead of a human. Some bots are good (search engines); many are malicious. pattern, or malicious IPIP addressA numeric address that identifies a device or server on the Internet. hitting one customer, we can instantly use that knowledge to protect every customer.

The network effect: more customers make the managed rulesetsmanaged rulesetA set of security rules that Cloudflare writes and keeps up to date for you, so you don't have to maintain them. smarter and the whole network stronger and faster for everyone on it — something a single, isolated deployment can never do.