Cloudflare (NYSE: NET) handles traffic for roughly 20% of websites, yet most consumers never see its name. Its origins trace back to 2004, when Matthew Prince and Lee Holloway created Project Honey Pot, an open-source system designed to track how spammers harvested email addresses. As the project grew popular, website owners began asking if the system could not just track the bad traffic, but actually block it. In 2009, Prince and Holloway, joined by Michelle Zatlyn, launched Cloudflare to solve this exact problem, re-architecting how traffic flows across the web.
The Reverse Proxy Architecture
Before Cloudflare, if a user in Tokyo wanted to load a website hosted on a server in New York, the data had to physically travel across the globe, resulting in slow load times. if a hacker launched a Distributed Denial of Service (DDoS) attack (flooding the server with millions of fake requests), the New York server would crash instantly. Cloudflare solved both problems using a "reverse proxy." It now runs data centers in more than 330 cities. When a website uses Cloudflare, all of its traffic is routed through Cloudflare's network first. Cloudflare caches (saves a copy of) the website on its local servers in Tokyo, delivering it instantly to the Japanese user. The network also acts as a shock absorber, identifying and blocking malicious DDoS traffic before it ever reaches the origin server.
The Freemium Engine
Cloudflare's defining strategic decision was offering its core product (basic DDoS protection and caching) for free. This resulted in rapid adoption. Millions of small businesses, bloggers, and hobbyists signed up. Free users bring a huge variety of traffic and attacks onto the network, and what Cloudflare learns from them improves the defenses it sells to paying customers. Enterprises buy annual contracts for application security, bot management, and Cloudflare One Zero Trust; in Q4 2025 Cloudflare signed its largest deal ever, averaging $42.5 million per year. Revenue reached $2.17 billion in 2025 and grew 36% to $696.1 million in Q2 2026, though the company still reports GAAP losses.
The Deplatforming Controversies
Because Cloudflare sits in front of approximately 20% of all websites, it operates as a de facto gatekeeper of the internet. The company generally argues it is an infrastructure provider, not a publisher, and should stay content-neutral. That position has drawn criticism when hate sites relied on Cloudflare. In a few publicized cases it ended service anyway: The Daily Stormer in 2017, 8chan in 2019, and Kiwi Farms in 2022, each time reopening the debate over how much power infrastructure companies should have over online speech.
Attacking the Cloud Monopolies
Today Cloudflare is expanding beyond security and into the core computing market, directly challenging the public clouds like Amazon Web Services (AWS). With products like "Cloudflare Workers," the company lets developers run code on "edge" servers close to users, and R2 storage charges no egress fees. Since 2025 it has added Workers AI inference, the Replicate model platform, tools for publishers to block or charge AI crawlers, and the teams behind Astro and Vite, betting that AI agents and developers will run more of the web on its network.
