What I like most about Cloudflare Application Security and Performance is how it combines strong security and performance optimization in a single platform. It provides essential features such as DDoS protection, Web Application Firewall (WAF), and a global CDN, which together significantly improve both the security and responsiveness of my applications.

In my personal setup, I use Cloudflare in front of a VPS hosted on DigitalOcean. I configured Cloudflare DNS and proxy (orange cloud) to route traffic through Cloudflare’s network instead of exposing my server directly to the internet. This helps reduce direct attack exposure on the origin server.

Additionally, I experimented with Cloudflare WARP connectivity in my setup to secure traffic paths and improve routing stability for VPN-style access. This setup helps me manage traffic more safely while benefiting from Cloudflare’s edge network performance improvements. Review collected by and hosted on G2.com.

One downside is that some advanced configurations, such as custom WAF rules, firewall tuning, and routing optimizations, require a good level of technical understanding. For users who are new to networking or security concepts, the learning curve can be challenging.

Also, certain advanced security and performance features are only available on higher-tier plans, which may limit flexibility for smaller projects or personal use cases. Review collected by and hosted on G2.com.

What I like most is how much Cloudflare lets you do in one place without introducing noticeable latency. You point your DNS at Cloudflare and, all of a sudden, you’ve got DDoS protection, a WAF, bot management, and CDN caching working together, instead of having to stitch five different vendors into a single setup.

A concrete example is rate limiting: the rules are dead simple to create—something like “block an IP hitting /login more than 20 times a minute”—and you can see the impact in the analytics dashboard within minutes. There’s no waiting around for logs to slowly trickle in before you know whether it’s doing what you intended.

It’s also worth calling out that the free/cheap tier is genuinely useful rather than just a teaser. Basic DDoS protection and CDN are free, so even a small side project can get real protection without feeling like it’s just being funneled toward an enterprise pitch deck. Review collected by and hosted on G2.com.

A few things stand out.

Over the years, the WAF rule language and dashboard have become more complex. There are now multiple overlapping products and rule layers (WAF, Rulesets, Bot Management, Page Rules vs. Rules) that can accomplish similar goals, and it isn’t always clear which one should “own” a given policy. New users will often create a rule in one place and then wonder why traffic still isn’t being blocked, only to find that a rule in another layer is overriding or interfering.

Debugging false positives is another pain point. When the WAF blocks a legitimate user (which can happen with aggressive managed rulesets), the error page is generic, and figuring out exactly which rule fired usually means digging through logs. Those logs also aren’t consistently available on lower-tier plans, since proper WAF event logging is often gated behind Enterprise pricing.

Pricing can also jump significantly between tiers. The free and Pro plans are great, but once you need advanced bot management, custom WAF rules at scale, or stronger support SLAs, the cost can rise sharply into enterprise territory. It ends up feeling like a steep cliff rather than a gradual scale-up. Review collected by and hosted on G2.com.

So I basically know that when I don't have the time to look up information on the website to b proven legit, if it is stamped with the cloudflare logo at the bottom or top of the website I totally trust it one hundred percent. Cloudflare has a wonderful security and performance program all in itself let alone a whole program of amazing features. Review collected by and hosted on G2.com.

I have not found much on the cloud flare application security and performance that I don't like so far. Love it actually and think its wonderful along with sum of the extra features that come with it as well. Review collected by and hosted on G2.com.

Strong DDoS protection and security features

Fast CDN improves website speed and performance

Easy DNS and SSL management

Helpful caching and traffic optimization tools

Simple and clean dashboard UI

WAF helps block malicious traffic and bots

Flexible pricing with useful free tier

Easy setup and quick domain onboarding

Smooth integration with CDN, DNL, SSL, and WAF services Review collected by and hosted on G2.com.

Support response time depends on the plan.

Pricing can increase for advanced security features

Some settings are difficult to troubleshoot Review collected by and hosted on G2.com.

I appreciate Cloudflare Application Security and Performance as a convenient all-in-one solution that integrates workers and domain control, making it easier for me by keeping everything in one place. The integration with Git is also a nice touch. I love the combination of speed and security it offers, with features like bot blocking and DDNS protection that simplify my life by ensuring my web apps are protected from attacks and can maintain reliable uptime. The initial setup was very easy, with every step being self-explanatory and supported by good information. Review collected by and hosted on G2.com.

I occasionally struggle with navigation around the site. Review collected by and hosted on G2.com.

I like the cost, performance, and ease of use of Cloudflare Application Security and Performance. Even on the free tier, there's a good standard of product that helps me. I find the paid plans valuable because they include allowances for additional filters and rules over the free one. The initial setup was super easy, and I obviously benefit from their DNS and domain registrar services. I'm also looking into using their Storage. Review collected by and hosted on G2.com.

Nothing. Review collected by and hosted on G2.com.

I like that all of the solutions are managed in one single console, and that the application all work together seamlessly and are very well integrated. The initial setup was very easy, with a lot of it working out of the box, and we only needed to tweak a few things to get it to where we need it to be. Review collected by and hosted on G2.com.

I think that their zero trust solution they offer is not as robust as some of its competitors, and that's why we are not using that product currently. I feel like their zero trust solution is primarily targeted at mid-sized customers, sub 2,500 users. As a larger organization, it doesn't seem like it has all the needed functionality. Review collected by and hosted on G2.com.

What I like best about Cloudflare Application Security and Performance is the combination of affordability, ease of use, and strong security capabilities. The pricing is very competitive compared to similar solutions, making it accessible even for smaller teams. At the same time, the platform is easy to build, configure, and manage, with a straightforward setup process that doesn’t require heavy effort.

On top of that, Cloudflare provides robust security features, including effective protection against common web threats, DDoS mitigation, and performance optimization tools. This balance of cost, simplicity, and powerful functionality makes it a highly practical solution for managing and securing applications. Review collected by and hosted on G2.com.

The jump in cost to access some premium features doesn’t feel reasonable for SMBs. Review collected by and hosted on G2.com.

Honestly, their WAF is top-notch and surprisingly easy to configure. I really value how fast we can push custom rules when a new vulnerability drops or when we're seeing weird traffic anomalies. The real-time visibility is great for threat monitoring, and getting those security events forwarded into our SIEM for deeper correlation is a pretty seamless process. It handles the heavy lifting for DDoS mitigation on autopilot, which gives me peace of mind. Review collected by and hosted on G2.com.

The main headache is around log retention and exporting. Getting granular, real-time logs pushed out to a SIEM can be unnecessarily restrictive and expensive if you aren't on the higher enterprise tiers. Also, while their managed rulesets are generally solid, tuning out false positives sometimes requires writing some pretty complex regex exceptions to ensure you aren't accidentally blocking legitimate API traffic. Support response times can also lag a bit unless you're a massive enterprise account. Review collected by and hosted on G2.com.

What I like best about Cloudflare Application Security and Performance is how it combines WAF, DDoS protection, bot management, and CDN into a single, easy-to-manage platform. It improves both security and website performance with minimal configuration while providing excellent global scalability. Review collected by and hosted on G2.com.

None in particular, as it's continuously evolving. Review collected by and hosted on G2.com.