Why a Cloudflare-only stack in 2026
One vendor, one account, zero dollars: a static frontend, serverless compute, a real SQL database, object storage, and bot protection — all inside a single Cloudflare account. For indie hackers and bootstrappers, that consolidation is the whole appeal: fewer dashboards, fewer bills, fewer integration points that can break at 2 a.m. This guide maps each product to a layer of your app, walks through the free-tier numbers that actually constrain you, and flags the caveats — including the fact that this stack has a glaring gap (auth) and that this writeup is based on official documentation, not hands-on testing. Cloudflare changes its limits frequently, so treat every number here as a snapshot and verify against the linked official pages before you commit.
The stack at a glance
Here’s how the pieces map onto a typical web app:
- Pages — hosting and preview deployments for your frontend
- Workers — the compute layer: APIs, cron jobs, request handling
- D1 — a serverless SQLite database for your relational data
- R2 — S3-compatible object storage for files, images, and blobs
- Turnstile — a CAPTCHA alternative for bot defense on forms
One architectural note worth internalizing early: if you use Pages Functions, those requests count toward the Workers quota. Your “frontend” and your “backend” share a request budget, which matters when you’re doing math against the free tier. (You can also serve static assets directly from Workers — more on that below.)
Pages: hosting and previews
The Cloudflare Pages limits page lays out the free tier plainly:
- 1 concurrent build
- 500 builds/month
- 20-minute build timeout
- 20,000 files per site
- 25 MiB maximum per file
- 100 custom domains per project
- 100 projects per account
- Unlimited preview deployments
The practical read: preview deployments are the standout free feature. Every pull request gets a live URL. The real constraint for CI-heavy teams is the 500 builds/month cap — if your team pushes frequently and every merge triggers a build, you can burn through that faster than you’d expect. With one concurrent build, queued builds stack up serially, so a slow build compounds the problem. The 20-minute timeout is generous for most frontend frameworks but worth knowing if you have a heavy build pipeline.
Workers: the compute layer
Workers is where your backend logic lives. On the free plan, per the Workers pricing page:
- 100,000 requests/day
- 10 ms CPU time per invocation
That 10 ms limit is CPU time. The Workers pricing page lists no charge for duration, so time spent waiting on I/O (a database query, a fetch to an external API) is not what the limit measures. For most CRUD-style APIs, that’s plenty. The Workers limits page has the full picture.
The escape hatch: static asset requests are free and unlimited. This is the single most important line in the Workers pricing table for bootstrappers. If you offload everything static — images, scripts, pre-rendered pages — to static assets (either via Pages or via Workers static assets), those requests don’t touch your 100,000/day budget. Only dynamic, compute-invoking requests count.
The paid trigger point: the Workers Paid plan starts at $5/month minimum, which includes 10M requests/month, then +$0.30 per additional million requests. CPU time on paid: 30M CPU ms included, then +$0.02 per additional million CPU ms.
Free observability: Workers Logs gives you 200,000 events/day with 3-day retention on the free plan. That’s enough to debug real issues without paying for a logging service — but 3 days means you can’t retroactively investigate something that happened last week.
Workers KV and Hyperdrive (the sidekicks)
Two supporting products round out the free compute story:
- Workers KV (free): 100,000 reads/day, 1,000 writes/day, 1 GB stored. KV is great for config, feature flags, and cached lookups. The 1,000 writes/day cap is the thing to watch — it’s easy to exceed if you treat KV like a database. It isn’t one; D1 exists for that.
- Hyperdrive (free): 100,000 queries/day. Hyperdrive accelerates connections to external databases (like a Postgres instance you run elsewhere). If you’re staying strictly Cloudflare-only, you may not need it — but it’s there if you bring your own database.
One more billing note: subrequests and Service Binding calls aren’t billed per request, so decomposing your app into multiple Workers that talk to each other doesn’t multiply your request bill.
D1: the SQL database
D1 is Cloudflare’s serverless SQLite, and its free tier is usable for an MVP, per the D1 pricing page:
- 5M rows read/day
- 100,000 rows written/day
- 5 GB total storage
The behavior when you exceed the free daily limits is the most bootstrapper-friendly part of the whole story: your queries error until the daily reset at 00:00 UTC — no bill, no surprise charge. You get a hard failure, not an invoice. For a solo founder, “my app breaks until midnight UTC” is preferable to “my card got charged because a script looped.” Design your error handling accordingly.
Other details worth knowing:
- No egress charge. Data leaving D1 doesn’t cost extra, which differentiates it from many traditional cloud databases.
- An empty D1 database is roughly 12 KB — so storage starts effectively at zero.
- Indexes add write cost. Writes to indexed columns cost more, which matters at the free tier because the write budget is 100,000 rows/day. The D1 index best practices page covers when indexes earn their cost — read it before adding indexes reflexively.
For the “what happens when I grow” reader: the paid tier includes 25B rows read/month, then +$0.001 per additional million rows read; 50M rows written/month, then +$1.00 per additional million rows written; and 5 GB storage included, then +$0.75/GB-month. The D1 limits page covers the operational ceilings.
R2: object storage with no egress bill
R2 is Cloudflare’s S3-compatible object storage, and its headline feature is zero egress fees. From the R2 pricing page, the free tier includes:
- 10 GB-month of storage
- 1M Class A operations/month (writes, lists — the costlier ops)
- 10M Class B operations/month (reads — the cheaper ops)
Paid rates: $0.015/GB-month for Standard storage, $4.50 per million Class A ops, $0.36 per million Class B ops — and egress stays free.
Fine print worth noting: the Infrequent Access storage class has a 30-day minimum storage duration, so don’t churn short-lived files into it expecting savings. And requests refused with a 401 (bad auth) aren’t charged — a small mercy when you’re debugging credentials.
For a bootstrapper, R2’s free tier comfortably covers user avatars, a few thousand uploaded documents, or a media library for a small app. With no egress fee, a traffic spike in image delivery does not add a bandwidth line item.
Turnstile: bot protection without puzzles
Turnstile is Cloudflare’s CAPTCHA alternative, designed to verify humans without making them click traffic lights. Per the Turnstile FAQ:
- It offers three widget types: Managed (recommended — Cloudflare decides whether to challenge), Non-interactive, and Invisible.
- It’s WCAG 2.2 AA compliant, so accessibility isn’t an afterthought.
- It works without routing your traffic through Cloudflare’s CDN — you can use it on any site, hosted anywhere.
An explicit caveat: Turnstile’s pricing and usage limits were not verified for this guide. I’m deliberately not quoting a price or a request cap here. Check the official Turnstile pages and Cloudflare plans directly before building it into your signup flow.
The comparison table
Cloudflare free tier at a glance (2026)
| Product | What it does | Free allowance | What happens when you exceed it | First paid step |
|---|---|---|---|---|
| Pages | Frontend hosting + preview deployments | 500 builds/month; 1 concurrent build; 20-min build timeout; 20,000 files/site; 25 MiB/file; 100 custom domains/project; 100 projects/account; unlimited previews | See official Pages docs | — (see official Pages docs) |
| Workers | Compute / API layer | 100,000 requests/day; 10 ms CPU/invocation | Free-plan daily cap applies; see official Workers docs | $5/mo minimum; 10M requests included, then +$0.30/M; 30M CPU ms included, then +$0.02/M CPU ms |
| Workers Logs | Observability | 200,000 events/day; 3-day retention | See official Workers docs | — (see official Workers docs) |
| Workers KV | Key-value storage | 100,000 reads/day; 1,000 writes/day; 1 GB stored | See official Workers docs | — (see official Workers docs) |
| D1 | Serverless SQL database | 5M rows read/day; 100,000 rows written/day; 5 GB storage | Queries error until 00:00 UTC reset; no bill | 25B rows read/mo included, then +$0.001/M; 50M rows written included, then +$1.00/M; 5 GB included, then +$0.75/GB-month |
| R2 | Object storage | 10 GB-month storage; 1M Class A ops/month; 10M Class B ops/month | See official R2 docs | $0.015/GB-month storage; $4.50/M Class A; $0.36/M Class B |
| Turnstile | Bot protection | Not verified in this guide | Not verified in this guide | Not verified in this guide |
Footnote: static-asset requests are free and unlimited on Workers, and both D1 and R2 have no egress charges.
What’s missing: auth
Cloudflare has no first-party user-auth product in this stack. There’s no Cloudflare-branded equivalent of Auth0, Clerk, or Supabase Auth sitting alongside Pages and D1. If your app needs email/password login, OAuth social sign-in, session management, or magic links, you’ll need to evaluate third-party auth providers yourself — or roll your own sessions on top of D1 and Workers, which is a real engineering project with real security stakes. Don’t let a “one vendor” fantasy talk you into hand-rolling password storage before you’ve thought it through. This is the single biggest gap in the Cloudflare-only story, and any guide should say so up front.
Putting it together: a reference architecture
Here’s how the pieces fit together conceptually. (This is a walkthrough of the architecture, not a hands-on tutorial — no screenshots, no “I deployed this.”)
Static frontend on Pages
Deploy your framework’s build output (React, Vue, Astro, plain HTML — anything that produces static files) to Pages. Connect a custom domain — you have up to 100 per project, so you’re not rationing. Lean on preview deployments for every branch so you can share staging URLs with collaborators or early users for free.
API routes as Pages Functions or Workers
Your dynamic endpoints live in Pages Functions or standalone Workers — remembering that Pages Functions requests draw from the same Workers quota. A useful pattern: keep static asset serving on the free-and-unlimited path, and reserve your 100,000 daily Worker invocations for genuinely dynamic work — API calls, form submissions, authenticated actions.
D1 schema and index trade-offs
Model your relational data in D1 with normal SQL. When adding indexes, remember the write-cost trade-off: indexed columns add write cost, which eats into your 100,000 daily rows written. Index the columns you actually query against; skip the speculative ones. Follow the official D1 index best practices guidance.
User uploads to R2
Wire file uploads through a Worker that validates and streams the file into an R2 bucket. Your 10 GB-month free storage and 10M monthly Class B reads cover a small app’s media needs. Since egress is free, serving those files back to users costs you nothing as traffic grows.
Turnstile on forms
Drop a Turnstile widget (Managed is the recommended type) on your signup, login, and contact forms, and verify the token server-side in your Worker before processing. It works regardless of where your site is hosted — no requirement to proxy traffic through Cloudflare’s CDN.
FAQ
What happens when I exceed the free limits? It depends on the product. On D1, queries error until the daily reset at 00:00 UTC — you get failures, not a bill. On D1, queries error until the daily reset at 00:00 UTC, with no bill. For Workers, the free plan caps requests at 100,000/day; check each product’s official docs for overage behaviour rather than assuming D1’s.
Is egress ever billed? No. Both D1 and R2 have no egress charges. This is the standout economic feature of the stack — traffic spikes don’t translate into bandwidth invoices.
Do I need a credit card to use the free tier? That depends on Cloudflare’s current signup requirements, which this guide didn’t verify. Check the official Cloudflare plans page for the current state.
What’s the first thing I’ll outgrow? It depends on your app’s shape. A CI-heavy team hits Pages’ 500 builds/month first. A write-heavy app hits D1’s 100,000 rows written/day. A viral consumer app hits Workers’ 100,000 requests/day. Know which axis your product lives on.
Is Turnstile free? Its pricing and limits were not verified in this guide, so I won’t state a number. Verify on the official Turnstile documentation before relying on it.
Does using Pages Functions eat into my Workers quota? Yes — Pages Functions requests count toward the Workers quota. Budget accordingly if you’re using both.
The Bottom Line
For a solo bootstrapper at MVP scale, this stack can run at $0 and is viable for an MVP. The architecture is coherent — one vendor, one dashboard, real SQL, real object storage, real bot defense. On D1, free-tier overage means query errors until reset rather than a bill, which is a sensible failure mode for someone watching their burn rate; check each other product’s overage behaviour on its own docs page.
The likely trigger points: Workers’ 100,000 requests/day (remembering static assets are free and unlimited, so offload aggressively), D1’s 100,000 rows written/day, and Pages’ 500 builds/month. For the Workers ceiling, the first spend is the $5/month Workers Paid plan — which unlocks 10M requests/month and 30M CPU ms included, with predictable per-million pricing beyond that. Five dollars a month to remove your request ceiling is about as gentle a first invoice as SaaS infrastructure offers.
The caveats: there’s no first-party auth here, Turnstile’s pricing wasn’t verified for this guide, and every number above comes from documentation snapshots rather than production experience. Verify against the linked official pages, then go build.
How This Guide Was Built
How This Guide Was Built: This guide was assembled from Cloudflare’s official documentation and pricing pages, fetched October 24, 2026. It was not run hands-on: no deployments, databases, or widgets were built or tested for this article. Turnstile pricing and plan limits were not verified and are described qualitatively only. Cloudflare’s limits change frequently — check the linked official pages before making decisions.