Cloudflare
company, gatekeeper
| Cloudflare link () Website | |
|---|---|
| Formation | July 26, 2009 |
| Founders | Matthew Prince, Lee Holloway, Michelle Zatlyn |
| Headquarters | San Francisco, California, USA |
| Subgroups | Area 1 Security |
| Staff | 5,156 (2,025) |
| US "cybersecurity" company used by about 20% of websites, by 2026 it was actively fingerprinting all web traffic, deny access to users who used browser extension in an effort to preserve their privacy. | |
Cloudflare, Inc. is a US "cybersecurity" company. It runs a large network of servers around the world and provides services including DDOS-protection. This is usually provided free from financial recompense, but allows the company to MITM visits to its clients.
Overview
Cloudflare was founded in 2009 by Matthew Prince, Lee Holloway and Michelle Zatlyn (WEF YGL 2014). In 2019 the company went public.
It provides a range of internet services, including content delivery network services, cybersecurity, DDoS mitigation, wide area network services, reverse proxies, DDOS-protection, Domain Name Service, ICANN-accredited[1] and domain registration.[2][3][4] Cloudflare's headquarters are in San Francisco, California.[2]
As of 2025 Cloudflare is used by around 19.3% of all websites on the Internet for its web security services.[5]
Browser fingerprinting
As of 2026, the company was using WebGL to fingerprint all the browsers to website using its services. It denied access to browsers which did not provide it.
Criticism
Cloudflare's business model is to be a Man-In-The-Middle for every DNS Query and every HTTP Transaction. This makes it very suspicious and makes me think of Cloudflare as providing NSA or other security agencies access to the data and logs they collect.
HOW? No matter how secure your cloudflare based website is for the entire world, at cloudflare datacenters its all Naked. All the encryption and protection ends there and data is re-encrypted before sending to the origin servers/users. So, you are fully secured from 3rd parties, but fully naked for them. Security Agencies know this.
So, I would say, it is VERY LIKELY that either Cloudflare is an NSA project, or it is actively providing data to NSA or other agencies.
Look at the cloudflare products, and decide for yourself:
- Free Secure 1.1.1.1 "DNS Directory".
- Free DNS, with DNS over HTTPS.
- Free CDN.
- Free SSL certificates (SSL terminates at their data centers. They can see you.)
- Zero-Margin Domain Registrar, means bigger piece of the DNS cake.
For all the above security related offerings... you are being protected from the entire world, but at cloudflare datacenters everything is being decrypted and visible.
Considering the above points, Cloudflare can make it easy for agencies to do the surveillance at massive scale while at the same time preventing other country governments to do the same because of "Everything-Single-Thing-Over-Encrypted-Connection".[6]
What was one revelation of the Snowden leaks? NSA/five eyes really hate encryption and lamented about the fact more and more web traffic is encrypted. It would be very convenient for them to have a honeypot MITM that strips encryption and can see all traffic, while also preventing Tor users from effectively browsing the clearnet.
Cloudflare sees all traffic between you and the website you want to visit in clear text. Cloudflare is located in San Francisco, CA, USA. 20% of clearnet internet traffic goes through Cloudflare. Every US company can be forced by secret federal court order to allow the NSA to tap into their communications and no one at such a company who knows about it may talk about it to anyone unless they want to spend the next 10-20 years behind bars. It doesn't matter if Cloudflare was an NSA-thing from the start or turned into one later, it very surely is given its size and market share.
DDoS protection is nothing special. Hosters like Hetzner have first-rate DDoS-protection and it's included free of charge with their VPS packages. With some very few exceptions, I think it's nonsense that companies think they have to use Cloudflare for DDoS protection.
Please think twice before using services like Cloudflare, especially when they're "free". Who is the product?[7]
Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected = operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.
Expression error: Unexpected > operator.Expression error: Unexpected > operator.
Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.Expression error: Unexpected > operator.
References
- ↑ https://www.icann.org/en/accredited-registrars
- ↑ 2.0 2.1 https://www.cnbc.com/2020/10/06/cloudflares-election-security-services-used-by-most-states-ceo-says.html
- ↑ https://seekingalpha.com/article/4348730-cloudflare-thinking-big
- ↑ https://techcrunch.com/2018/09/27/cloudflare-launches-a-low-cost-domain-registrar/
- ↑ https://w3techs.com/technologies/details/cn-cloudflare
- ↑ https://www.quora.com/How-likely-is-it-that-CloudFlare-is-an-NSA-operation
- ↑ https://web.archive.org/web/20230810205454/https://lobste.rs/s/qk4gsg/blocked_by_cloudflare