Cloudflare One, Cloudflare Zero Trust and Cloudflare Access
Cloudflare One is the account-level platform that brings together access control, secure web gateway, private-network connectivity and related security services. Cloudflare Zero Trust is the service family and subscription used for those controls. Cloudflare Access is the identity-aware proxy inside that family: it protects a specific application and checks every request against its Access policies before the origin receives it.
Applications define the resource being protected
A self-hosted Access application identifies a public hostname, a private hostname or a narrower URL path. Protect the smallest stable scope that represents the application. More-specific application paths take precedence, so a policy for an administrative path can be stricter than the policy for the rest of the hostname.
- The hostname must already resolve through the intended Cloudflare path.
- Use a path only when its authentication boundary is genuinely different.
- Test adjacent paths as well as the protected path so an application is neither exposed nor unintentionally blocked.
Policies decide who is admitted
An Access policy combines one action with Include, Require and Exclude rules. Include creates the eligible population, Require adds conditions every admitted user must satisfy, and Exclude removes matching users. Allow and Block govern interactive access; Service Auth covers machine authentication; Bypass removes Access enforcement for the matching traffic and therefore needs exceptional care.
- Every application should begin with a narrow Allow policy, such as one verified email address or one corporate email domain.
- Use identity-provider groups, authentication method and device posture when the risk requires stronger conditions.
- Do not use Include Everyone or a broad Bypass as a shortcut for a failed login flow.
Identity providers and login
Cloudflare One can use the Cloudflare identity provider, email one-time PIN and supported corporate providers such as Microsoft Entra ID, Okta, Google, SAML or OIDC. Identity attributes are evaluated at login, while selected non-identity signals such as device posture can be evaluated again during the session. Configure account recovery and at least two trusted administrators before making Access the only route to a critical console.
Cloudflare Tunnel and private origins
Cloudflare Tunnel creates an outbound connection from a private network or origin to Cloudflare, so the service can be reached without publishing an inbound port. Access supplies the identity decision; Tunnel supplies the private network path. They solve different parts of the design and can be used together for internal web applications, SSH, RDP and other private services.
Gateway and the Cloudflare One Client
Cloudflare Gateway filters the DNS, HTTP and network traffic generated by users and devices. Identity-based outbound policies normally require the Cloudflare One Client so traffic and device context reach the account. Gateway policy is separate from an Access application policy: one controls a user's outbound traffic, while the other controls entry to a protected resource.
Included capabilities and Enterprise extensions
Free and Paid workforce plans include Access, Gateway, Tunnel, One Client and Digital Experience Monitoring. DEX logs have seven-day retention. Basic DLP includes predefined financial and identification-number profiles; full DLP requires an Enterprise add-on. CASB is available on all plans, with up to two integrations on Free and individual finding details reserved for Enterprise. Browser Isolation, Email Security and network services such as WAN, Network Firewall and Magic Transit have separate commercial terms. Buying a workforce plan does not activate those additional subscriptions.
A controlled rollout
Start with one non-critical application, one administrator and a narrow Allow policy. Confirm login, logout, session expiry, denial for an unlisted identity and origin inaccessibility outside the intended path. Add the identity provider and stronger Require conditions only after the basic route works, then expand to more applications or devices while reviewing authentication and Gateway evidence.
Plans and account scope
Cloudflare One belongs to the Cloudflare account rather than to one DNS zone. The account-level manager therefore remains available without a zone. A public-hostname Access application is the narrow exception because that hostname must belong to an active zone. Zero Trust Free is the bounded starting plan; the published Paid workforce price is per user for a full year, excluding VAT, with a twelve-month commitment. The cart shows the full annual total for the selected team size. Contract and broader SASE components are requested as a reviewed scope before any order.
How this differs from public website protection
Access protects who may enter an application and Gateway controls team traffic. The zone's WAF, DDoS protection, CDN and authoritative DNS protect a public website's delivery. A private administration hostname can use both layers: ordinary Cloudflare application security for hostile traffic and Cloudflare Access for an explicit identity decision.
