TL;DR:

  • Cloudflare Zero Trust free tier (up to 50 users) includes secure application access (ZTNA), DNS filtering with content categories, and limited browser isolation — no credit card required
  • It replaces a traditional VPN for remote access to internal apps with a model that verifies users per-application rather than granting network-level access
  • Setup takes 2-4 hours for most small businesses; the main dependencies are a Cloudflare account and being willing to run a lightweight connector on your internal network

What You Get on the Free Tier

Cloudflare Zero Trust is part of Cloudflare One, Cloudflare’s networking and security platform. The free tier (as of 2026) covers:

Cloudflare Access (ZTNA): Secure access to internal web applications, SSH, RDP, and other protocols without a VPN. Users authenticate through Cloudflare’s edge before being connected to your internal resource. You can require specific identity providers (Google Workspace, Microsoft 365, Okta, GitHub, and others) and add additional policies like device posture checks.

Cloudflare Gateway (DNS filtering): DNS-level filtering that blocks malicious domains, phishing sites, and optionally content categories (adult content, social media, gambling, etc.). Can be applied to office networks (by pointing DNS resolvers) and to enrolled devices (via the WARP client).

Browser Isolation (limited): The free tier includes a limited monthly allocation of browser isolation — rendering web pages in a remote browser and streaming pixels to the user, so malware from the page can’t reach the user’s device. Suitable for occasional use of high-risk URLs.

WARP client: The Cloudflare device agent (available for Windows, macOS, Linux, iOS, Android) that routes DNS queries through Gateway and provides device posture reporting. Free with no per-device cost up to the 50-user limit.

What the free tier does NOT include: data loss prevention (DLP), email security, CASB (cloud app visibility), or more than 50 seats. For growing businesses, the paid tiers start at $7/user/month (Teams) and scale up.

Why This Matters for Small Businesses

Traditional VPNs solve remote access but create risk: once a user authenticates to a VPN, they typically get broad network access. If their credentials are stolen or their device is compromised, the attacker inherits that broad access. This is the model that has enabled most significant ransomware breaches — initial access via compromised VPN credentials, then lateral movement across the network.

Zero trust network access (ZTNA) inverts this: each application has its own access policy, and access is granted per-request rather than per-session. A user connecting to your internal HR system doesn’t automatically get access to your file server, accounting software, or backup infrastructure. Each requires its own authentication decision.

For small businesses, the practical benefit is that you can make remote access more secure than a VPN without buying expensive enterprise access management software. The Cloudflare free tier makes the architecture accessible.

Setting It Up

Step 1: Create a Cloudflare Account and Enable Zero Trust

Sign up at dash.cloudflare.com if you don’t have an account. In the dashboard, navigate to Zero Trust and follow the onboarding to create your Zero Trust organisation. Give it a name (this becomes part of your authentication portal URL). Select the free plan.

Step 2: Connect an Identity Provider

Go to Settings → Authentication. Add an identity provider — Google Workspace and Microsoft 365 are the most common for small businesses. Follow the OAuth app setup in your identity provider (you’ll create an OAuth application and paste the client ID and secret into Cloudflare). Test the connection.

This step determines who can log in to your protected applications. Users authenticate through their existing Google or Microsoft credentials; Cloudflare validates the identity before allowing access.

Step 3: Install the Cloudflare Tunnel Connector

To protect an internal application, you need a connector on your network that establishes an outbound tunnel to Cloudflare. This is the cloudflared daemon.

Install on your internal server or a small VM on your network:

# Linux (Debian/Ubuntu)
curl -L --output cloudflared.deb \
  https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# macOS
brew install cloudflare/cloudflare/cloudflared

In the Zero Trust dashboard: Networks → Tunnels → Create a tunnel. Give it a name, copy the token, and run the install command shown in the dashboard. The tunnel establishes an outbound connection (no inbound firewall rules needed) and appears as active in your dashboard.

Step 4: Expose an Internal Application

Within the tunnel configuration, add a public hostname:

  • Subdomain: internal-app (or whatever you want)
  • Domain: your Cloudflare domain (you’ll need at least one domain on your Cloudflare account)
  • Service: the internal URL of your application (e.g., http://192.168.1.50:8080 or https://fileserver.local)

This makes your internal application accessible at https://internal-app.yourdomain.com — but only to authenticated users.

Step 5: Create an Access Policy

In Access → Applications, add an application:

  • Application URL: the public hostname you just set
  • Session duration: how long an authenticated session lasts (e.g., 24 hours, or shorter for sensitive apps)
  • Policy: Allow users who are a member of your Google Workspace domain, or who are on an email allowlist

When a user navigates to your internal app URL, they hit a Cloudflare authentication page, log in with their Google/Microsoft account, and are proxied through to the internal service if the policy allows them.

For DNS filtering across your office or enrolled devices:

For the office network: Change your router’s DNS to use Cloudflare Gateway’s DNS-over-HTTPS or the dedicated DNS addresses provided in your Zero Trust dashboard under Gateway → DNS Locations.

For remote devices: Deploy the WARP client via MDM (Intune, Jamf, or others) or distribute it manually. In the Zero Trust dashboard, create a device enrollment policy and configure the devices to connect to your Zero Trust organisation. Once enrolled, DNS traffic goes through Gateway.

In Gateway → Policies → DNS, create policies to block malicious categories. At minimum, enable the Security category (malware, botnet C2, phishing domains). The free tier includes these threat categories at no extra cost.

Practical Limitations

50-user ceiling: The free tier hard-caps at 50 users. If your organisation is close to or above this, evaluate whether you’ll hit it within 12 months. Migrating a configured Zero Trust deployment to a paid tier is straightforward, but it’s worth budgeting for the cost.

No DLP or CASB on free: The free tier doesn’t include data loss prevention or cloud application security broker visibility. You can filter DNS and block sites, but you can’t inspect content of uploads to cloud services or see detailed SaaS usage analytics.

Browser isolation allocation: The free allocation of browser isolation sessions is limited. For organisations that want to route all browsing through isolation, the free tier won’t be sufficient — that’s a paid feature at scale.

Support: The free tier uses community forums for support. No SLA, no ticket system. For organisations that need responsive support for a production remote access deployment, this is a real consideration. The Teams tier adds email support.

Is It Worth Setting Up?

Yes, for most small businesses with 2-50 users that currently use a VPN or RDP exposed to the internet for remote access.

The security improvement is significant: replacing direct internet-exposed RDP or VPN credentials with Cloudflare-mediated access that requires your staff to authenticate through Google or Microsoft before reaching any internal resource eliminates a broad class of initial access vectors that attackers actively exploit.

The DNS filtering layer adds meaningful protection against malware and phishing at no cost or complexity beyond pointing your DNS resolver at Cloudflare.

The setup investment (2-4 hours for a typical small business) is reasonable for the access security improvement, and the ongoing maintenance burden is low — Cloudflare manages the infrastructure and the cloudflared tunnel agent auto-updates.