Cloudflare's catalog is genuinely confusing, and not because the products are badly named. It is because they solve four structurally different problems on one platform, and the marketing presents them as one continuous thing.
Sorted into families, it becomes straightforward. Everything in the catalog sits in front of one of four things: your published applications, your people, your networks, or nothing at all — the last being the developer platform, where you build rather than protect.
Family 1 — Application Services: in front of what you publish
These protect and accelerate things you intentionally expose to the internet.
CDN and caching. Static content served from edge locations near the user. The oldest part of the platform and usually the reason an organization arrives.
DNS. Authoritative DNS, operated at scale, with DNSSEC. Often the first thing migrated, and the migration that makes everything else possible.
WAF. Inspects HTTP requests against managed rulesets and your own rules, blocking injection, cross-site scripting and known CVE exploitation. Worth reading our note on why most WAF deployments are misconfigured before you assume yours is working.
Bot Management. Distinguishes legitimate automation from credential stuffing, scraping and inventory hoarding. Increasingly the highest-value control on the list, because most hostile traffic is now automated.
Rate Limiting. Caps request rates per endpoint. Essential on authentication and password-reset paths, and commonly absent.
DDoS protection. Always on, included on every plan, applied at the edge.
Load Balancing. Health-checked traffic distribution across origins and regions.
Turnstile. A CAPTCHA alternative that verifies humans without the puzzle.
Email Security. Pre-delivery inspection for phishing and business email compromise, in front of your existing mail platform.
Use this family when: you publish anything on the internet.
Family 2 — Zero Trust (Cloudflare One): in front of your people
This is the SASE side, and the products are frequently confused with one another. They are not alternatives; they are layers.
| Product | What it does | Replaces |
|---|---|---|
| Access | Authenticates and authorizes every request to an application, per identity and device | VPN for application access |
| Gateway | Filters DNS, HTTP and network traffic outbound from users and sites | Secure web gateway, DNS filtering appliance |
| WARP | The device client that puts users on the network | VPN client |
Tunnel (cloudflared) |
Outbound-only connectivity from your origins to Cloudflare | Inbound firewall rules, public IPs |
| Browser Isolation | Runs risky web sessions remotely, streaming only pixels | Nothing — this is new capability |
| CASB | Finds misconfiguration and risky sharing in SaaS platforms | Manual SaaS audits |
| DLP | Inspects traffic for sensitive data patterns | Endpoint DLP, partially |
The minimum viable Zero Trust deployment is Tunnel plus Access: connectivity without inbound rules, and a policy deciding who gets through. Add WARP when you need device posture or non-HTTP protocols. Add Gateway when you want to govern where users go, not just what they reach. We covered the architecture in connecting applications without firewall rules.
Use this family when: you have a VPN you want to retire, contractors who need scoped access, or applications reachable from the internet that should only be reachable by named people.
Family 3 — Network Services: in front of your networks
These operate on IP, not HTTP, and are the least understood part of the catalog.
Magic WAN. Connects your sites, data centers and clouds to each other through Cloudflare's backbone. Functionally an SD-WAN overlay where the middle mile is a private network rather than the public internet. Sites attach via IPsec, GRE, or a Cloudflare device.
Magic Transit. DDoS protection and firewalling for your own IP ranges, advertised through Cloudflare via BGP. This is for organizations with their own address space protecting entire network blocks, not individual applications.
Spectrum. Proxies arbitrary TCP and UDP applications — SSH, RDP, game servers, custom protocols — with DDoS protection and access control. The answer when the thing you need to protect is not a website.
Argo Smart Routing. Routes traffic across Cloudflare's network by real-time congestion rather than by BGP default. A performance product, not a security one.
Use this family when: you are connecting sites rather than publishing applications, you own IP space, or you need to protect something that is not HTTP.
Family 4 — Developer Platform: things you build on
Workers (serverless compute at the edge), Pages (static and full-stack site hosting), R2 (object storage with no egress fees), D1 (SQL database), KV and Durable Objects (state), Queues, Stream and Images.
This is a different purchase entirely — an application platform, evaluated against AWS, Azure and Google Cloud rather than against security vendors. The relevant advantage is proximity: code runs in the same edge locations the traffic already passes through.
Use this family when: you are building, not protecting.
Decision table: the problem you have, the product that solves it
| Your problem | What you need |
|---|---|
| Our website gets attacked | WAF + Bot Management + Rate Limiting |
| Our origin server is directly reachable | Tunnel |
| Contractors need one internal app | Tunnel + Access |
| We want to retire the VPN | Tunnel + Access + WARP |
| Users reach things they should not | Gateway |
| Staff click phishing links | Email Security + Gateway + Browser Isolation |
| We do not know what SaaS we use | CASB |
| Sensitive data is leaving | DLP |
| Branch sites need to reach each other | Magic WAN |
| Our whole IP range gets DDoSed | Magic Transit |
| We need to protect SSH or RDP | Spectrum, or Access for infrastructure |
| We need to run code near users | Workers |
Three things we see go wrong
A tunnel with no policy in front of it. The tunnel provides connectivity, not security. Publishing an internal application through a tunnel without an Access policy exposes it to the entire internet, more reliably than a firewall rule ever would. Create the policy before the hostname.
Buying Zero Trust and deploying DNS filtering. Many deployments stop at Gateway DNS policies, which is a useful control and is not Zero Trust. Without Access enforcing per-application authorization, the trust model has not changed.
Treating Magic WAN and Tunnel as interchangeable. Tunnel connects applications to Cloudflare. Magic WAN connects networks to Cloudflare. Using the wrong one produces an architecture that works in the pilot and does not scale.
A note on plans and licensing
Cloudflare's commercial model is unusual: application services are largely plan-based (Free, Pro, Business, Enterprise) with capability tied to plan tier, while Zero Trust is per-seat and network services are bespoke. That mix means the question "what does Cloudflare cost" has no single answer, and that capability you tested on one plan may not exist on another.
Two practical rules: confirm which plan tier a feature requires before designing around it, and count Zero Trust seats including contractors and service accounts, because that is where estimates are usually wrong.
BlackHawk Data is a Cloudflare Elite Partner, with 50+ Cloudflare certifications across our engineering team — a Cloudflare-specific figure within the 100+ certifications we hold across all vendors. Our Cloudflare Zero Trust assessment maps your applications, identities and current exposure into a phased plan, and practice detail is at /solutions/cloudflare.