No cherry-picking. We show where Cloudflare is ahead, where we are, and where it depends on your use case.
Cloudflare pricing sourced from public plan page. EmpireCDN is in MVP — features marked "Planned" are on the public roadmap. Last verified: May 2026.
| Feature | CF Free $0 |
EmpireFreeours $0 |
CF Pro $20 /mo |
EmpireProours $10 /zone/mo |
CF Business $200 /mo |
EmpireTeamours $25 /zone/mo |
|---|---|---|---|---|---|---|
| DNS | ||||||
| DNS records per zone CF has a hard 200-record cap on all zones regardless of plan | 200 max | Unlimited | 200 max | Unlimited | 200 max | Unlimited |
| Authoritative nameservers | CF shared NS | CoreDNS (MVP) PowerDNS (Planned) |
CF shared NS | PowerDNS + Knot AXFR failover | CF shared NS | PowerDNS + Knot AXFR failover |
| Custom nameservers Use your own brand for NS records | Enterprise only ($) | Included (ns1/ns2.empirecloud.*) | Enterprise only ($) | Included | Enterprise only ($) | Included |
| DoT / DoH support | Via 1.1.1.1 resolver | Planned (dnsdist) | Via 1.1.1.1 resolver | Planned | Via 1.1.1.1 resolver | Planned |
| WAF & Security | ||||||
| Managed WAF ruleset | Free ruleset (Log4J, Shellshock, WordPress) | OWASP CRS v4 baseline | Full CF Managed + OWASP CRS | OWASP CRS v4 full + 5 custom rules | Full CF Managed + OWASP CRS | OWASP CRS v4 full + custom rule editor |
| WAF mode Detection only logs; Blocking enforces | Detection only | Detection only | Blocking | Blocking + per-rule whitelist UI | Blocking + advanced | Blocking + custom rule editor |
| Bot management transparency CF's bot scoring is a black box; no appeal path | Opaque CF score | Open-source rules, auditable | Opaque CF score | Open-source rules, auditable | Bot Fight Mode (limited control) | Open-source, per-rule whitelist |
| DDoS protection | CF network-level (unmetered) | Rate-limit only (dnsdist + nftables) | CF network-level (unmetered) | Rate-limit only (Pro: CF redirector add-on planned) | Advanced DDoS + Magic Transit option | Rate-limit; Enterprise DDoS add-on planned |
| CDN & Performance | ||||||
| Edge locations (PoPs) | 300+ global PoPs | 3 (Ashburn, Falkenstein, GCP us-east) | 300+ global PoPs | 3 day-1, Tokyo Phase 2 | 300+ global PoPs | 3–4 day-1 |
| Bandwidth included | Unmetered (Fair use) | 100K req/mo (Free) | Unmetered | 100 GB/zone/mo | Unmetered | 500 GB/zone/mo |
| GeoIP routing | Pro+ only | Included (nginx + MaxMind GeoLite2) | Yes | Included | Yes + Load Balancing | Included + weighted upstream |
| Page rules | 3 rules | Unlimited cache rules | 20 rules | Unlimited | 50 rules | Unlimited |
| Analytics & Observability | ||||||
| Analytics retention | 24 hours | 7 days | 7 days | 30 days | 30 days | 90 days |
| Cache hit rate reporting | Limited | Yes | Yes | Yes | Yes + advanced | Yes |
| WAF block event log | No | Yes (detection events) | Yes | Yes + Telegram alert on threshold | Yes + advanced filtering | Yes + Slack webhook |
| SSL / TLS | ||||||
| Automatic TLS / HTTPS | Yes (CF Universal SSL) | Yes (Let's Encrypt) | Yes | Yes (wildcard per zone) | Yes + custom cert upload | Yes + wildcard |
| Minimum TLS version control | Pro+ only | nginx TLS config = full control | Yes | Yes | Yes | Yes |
| Platform & Migration | ||||||
| CF → EmpireCDN migration tool | N/A | Included (Planned Phase 2) | N/A | Included + 24h parallel safe-mode | N/A | Included |
| Data residency / privacy CF routes all traffic through CF network including "Full" SSL-terminated | US-based, traffic routed through CF | EU node (Falkenstein) available; traffic goes direct to your origin | US-based | EU-routable; origin traffic not stored | US-based (CF stores logs) | EU-routable; GDPR-friendly logs |
| Stack auditability | Closed-source | 100% open-source components | Closed-source | 100% open-source | Closed-source | 100% open-source |
| Support | Community | Community | Email (priority) | Email 24h SLA | 24/7 phone (Business) | Email 4h SLA (no phone yet) |
| Start free | Try Pro | See Team | ||||
Unlimited DNS records (CF hard-caps at 200 regardless of plan), unlimited page/cache rules, GeoIP routing on all tiers, EU data residency option, fully auditable open-source stack, honest WAF (you see the exact rules that fire), and 50% cheaper than CF Pro per zone on the Pro tier.
Network scale: CF has 300+ PoPs vs our 3 day-1. DDoS absorption: CF absorbs volumetric DDoS at network layer; we rate-limit only (adequate for most SMB traffic, not for 100 Gbps attacks). Brand trust: CF has 20+ years of market presence. If you need BGP anycast and global PoPs before Phase 2, CF is still better for pure CDN performance.
You're a good fit if: (1) you hit the CF 200-record limit, (2) you want GDPR-compliant EU routing, (3) you're annoyed by CF's bot-management black box blocking real users, (4) you want to inspect and customize your WAF rules, or (5) you want Empire-stack integration (same login as EmpireGit, Plausible analytics, etc.).
Our migration tool imports your CF zone records automatically. Run parallel for 24 hours before switching NS — zero-risk cutover.