"Contact sales" is a pricing tier. This post is about which Cloudflare capabilities sit behind it, what a self-serve alternative can and cannot replace, and where the honest gaps are.
The ladder
Cloudflare's published plans run Free, Pro at $20/month per zone on annual billing ($25 monthly), Business at $200/month per zone annual ($250 monthly), and Enterprise, which has no list price — practical entry is commonly around $5,000/month on an annual commitment. Remember that every paid rung is per zone.
Cloudflare CDNShark
---------- --------
Free $0 per zone Free $0 per account
Pro $20/mo per zone Basic $9.99/mo per account
Business $200/mo per zone Enterprise $299.99/mo per account
Enterprise "contact us" per zone -- no unpublished tier --
~$5k/mo typical
per-zone billing means the per-account billing means the
cost scales with DOMAIN COUNT cost scales with BANDWIDTHThat is the structural difference. Neither is dishonest; they just fail in different directions. Cloudflare gets expensive when you have many domains. CDNShark gets expensive when one domain moves a lot of bytes.
What Enterprise pricing actually buys, and what replaces it
Things a self-serve platform can genuinely replace
| Typically Enterprise-gated | CDNShark equivalent |
|---|---|
| Custom cache rules and TTLs at scale | Included on all plans — match by file extension or path prefix, set TTL per rule |
| Aggressive rate limiting | Four per-site modes plus fleet defaults of 100 r/s per IP and 1000 r/s per hostname |
| Country and IP allow/block policy | Included — geo_mode and ip_mode, allow or block, evaluated in Lua at the edge |
| Bot challenge tuning | Two modes with published parameters: 12-bit PoW with 30-minute clearance, or 16-bit with 5-minute clearance under attack |
| Verified-bot allowlisting | Opt-in per zone, checked against a daily-refreshed IP range list — never on user agent alone |
| Many domains under one contract | 10 domains on Basic, 100 on Enterprise, certificates included |
| Private/unexposed origins | Private origin tunnels — 5 on Basic, 25 on Enterprise |
| Origin certificates | Per-record origin TLS mode with CDNShark-issued origin certificates |
Things it cannot replace, at any price
- Volumetric DDoS absorption. This is the honest one. Enterprise DDoS protection is a capacity purchase, and capacity is physical. CDNShark's defences are rate limiting, a threat-feed-driven global IP blacklist enforced in Lua, geo blocking, a proof-of-work challenge, and a shield tier. Against a large flood, that is not equivalent and we will not claim it is.
- A contractual uptime SLA with credits.
- 24/7 named support with an escalation path and a TAM.
- Edge compute. No Workers equivalent exists. Rules are declarative.
- Global footprint. 11 edges is 11 edges.
- HTTP/3 and Brotli — not offered today. HTTP/2 is live as of August 2026.
- Certified compliance programmes that large enterprises procure against.
If your reason for looking at Enterprise is any item on that second list, a cheaper platform does not solve your problem — it postpones it.
Why the features are not gated here
Less a philosophy than an architectural consequence. Every CDNShark edge holds its own Redis master containing one JSON document per hostname:
site:example.com -> {
"origin": "http://203.0.113.10:80", "cached": true,
"waf_mode": "strict", "rate_mode": "strict",
"geo_mode": "block", "geo_codes": "RU,CN",
"ip_mode": "allow", "ip_list": "198.51.100.0/24",
"hotlink_mode": "block", "cache_rules": [ ... ],
"edge_rules": [ ... ]
}
edge Lua reads this key on EVERY request
|- Redis unreachable? -> control-plane API fallback
|- reconciled every 15 min, healed every 5 min
`- an edge keeps serving correctly with the control plane DOWNTurning on the WAF sets a string in a JSON document that the edge already reads on every request. There is no per-tier code path to maintain, so there is no cost saved by gating it — which is why waf_mode is available on the free plan.
Published prices, in full
| Plan | Monthly | Bandwidth | Overage | Domains | Storage | Tunnels |
|---|---|---|---|---|---|---|
| Free | $0 | 50 GB | $0.005/GB | 1 | 5 GB | 2 |
| Basic | $9.99 | 100 GB | $0.02/GB | 10 | 10 GB | 5 |
| Enterprise | $299.99 | 1 PB | $0.01/GB | 100 | 1 TB | 25 |
Extra domains are $1.00/month on Basic and $0.50 on Enterprise. Extra tunnels are $1.99/month, 10 routes each. There is no quote, no commitment, and no call.
One quirk worth naming rather than hiding: the free plan's overage rate ($0.005/GB) is lower than Basic's ($0.02/GB). Basic is priced for included domains and pull zones rather than for cheap marginal bytes.
The honest summary
If Cloudflare Enterprise is on the table because you need attack absorption, an SLA, or compliance attestations, buy it. If it is on the table because you have twelve zones and want a WAF on all of them, that is a billing-model problem, and a per-account platform solves it for two orders of magnitude less.