Cloudflare One

What is Cloudflare One?

Cloudflare One is a set of networking and security services that organizations use in place of a traditional corporate network perimeter. Instead of trusting anyone who is on the office network or connected through a VPN, it follows a zero trust model: every request to an application is checked against the user’s identity, device and context before it is allowed. Because enforcement happens on Cloudflare’s global network, employees get the same protection in an office, at home or while traveling.

The platform combines several products managed from one dashboard. Cloudflare Access controls who can reach internal and SaaS applications, Cloudflare Tunnel connects private resources through outbound-only connections, and the Secure Web Gateway filters internet traffic from company devices. Other services add remote browser isolation, a cloud access security broker for SaaS apps, data loss prevention and email security based on technology from Area 1 Security, which Cloudflare acquired in 2022. The Cloudflare One Client, built on Cloudflare’s WARP app, sends traffic from laptops and phones to the network and checks device posture.

Cloudflare One also includes network services for whole offices and data centers: Magic WAN connects sites over Cloudflare’s network instead of private circuits, Magic Transit protects on-premises networks from DDoS attacks, and Magic Firewall applies firewall policies in the cloud. Cloudflare introduced the platform on October 12, 2020, with integrations for identity providers such as Okta and Microsoft and endpoint security vendors including CrowdStrike. Its competitors include security service edge and SASE products from Zscaler, Palo Alto Networks and Netskope.

Key features of Cloudflare One

1. 01

   Zero trust application access

   Cloudflare Access checks identity and device signals on every request to internal and SaaS applications, replacing VPN access and logging each event and request.

2. 02

   Cloudflare Tunnel

   Outbound-only connections link private servers and networks to Cloudflare, so applications can be published securely without exposing public IP addresses to the internet.

3. 03

   Secure Web Gateway

   DNS, network and HTTP filtering blocks malicious and risky sites, enforces acceptable use policies and inspects traffic from company devices wherever employees work.

4. 04

   Remote browser isolation

   Web pages can run in a browser on Cloudflare’s network instead of on the user’s device, limiting the damage malicious code on a website can do.

5. 05

   CASB and data loss prevention

   Scans of SaaS applications find risky settings and exposed data, while data loss prevention inspects traffic for sensitive information such as personal data and blocks leaks.

6. 06

   Email security

   Cloud email security detects phishing, business email compromise and email supply chain attacks before malicious messages reach employees’ inboxes.

7. 07

   Magic WAN and network services

   Branch offices, data centers and cloud networks connect through Cloudflare’s network, with cloud firewall and DDoS protection replacing much of the hardware at each site.

8. 08

   Cloudflare One Client

   A device client for Windows, macOS, Linux, iOS and Android sends traffic to Cloudflare and enforces device posture rules before granting access to resources.

Who uses Cloudflare One?

• Companies replace VPN concentrators with identity-based access to internal applications for employees, contractors and partners.
• Distributed workforces route internet traffic through the Secure Web Gateway to block phishing and malware both on and off the corporate network.
• Enterprises connect branch offices and data centers through Magic WAN instead of private MPLS circuits and on-premises firewalls.
• Security teams scan SaaS applications and web traffic for sensitive data leaks using CASB and data loss prevention policies.

History of Cloudflare One

Cloudflare first offered zero trust access controls through Cloudflare Access and added web filtering with its Gateway service and remote browser isolation through its January 2020 acquisition of S2 Systems. On October 12, 2020, it combined these tools with network services such as Magic Transit and its WARP client under the Cloudflare One name, presenting the package as a replacement for VPNs, MPLS circuits and hardware firewalls.

Cloudflare later expanded the platform with email security from Area 1 Security, acquired in 2022, along with a cloud access security broker, data loss prevention and digital experience monitoring. It now describes Cloudflare One as a single-vendor SASE platform, and its documentation lists the platform as available on all plans.

Cloudflare One pricing

Cloudflare One alternatives

Well-known alternativesZscaler Zero Trust Exchange, Palo Alto Networks Prisma SASE, Netskope One, Cisco Secure Access and Microsoft Entra Global Secure Access

Cloudflare One: frequently asked questions

Sources

1. Cloudflare One documentation developers.cloudflare.com
2. Introducing Cloudflare One, Cloudflare Blog blog.cloudflare.com
3. Cloudflare annual report on Form 10-K, 2025 sec.gov
4. Cloudflare One SASE platform cloudflare.com

Last reviewed September 17, 2026. Spotted an error? Send a correction.