Cloudflare killed DDoS surge billing in 2017, then hit cloud egress fees a year later

Before September 25, 2017, a website getting flooded by a distributed denial-of-service attack faced a second, quieter attack from its own vendor: the overage bill. The traffic spiked, the mitigation kicked in, and the invoice arrived a month later charging per gigabit for the flood the customer never wanted. Cloudflare stood up on its seventh birthday and said it would simply stop doing that - no surge pricing when you come under attack, unlimited mitigation on every plan.¹³ It landed as a manifesto. It read like a company declaring, on principle, that it does not meter.

The official story is that Cloudflare is the vendor that refuses to charge by the byte. That's the folklore, and it's tidy, and it's mostly wrong. 'Unmetered' at Cloudflare was never a single founding conviction. It was a tactic - deployed in scoped, well-timed strikes, each aimed at whichever rival was extracting the most-hated fee that year.

The 2017 strike was aimed at one fee, not the whole meter: the announcement was scoped to DDoS attack traffic, but it got remembered as a promise about everything

Read what Cloudflare actually announced and the boundaries are sharp. Unmetered Mitigation was about DDoS attack traffic - the malicious flood - and about ending the specific practice of raising a customer's bill after an attack.¹ Independent coverage described it the same way: Cloudflare would no longer kick sites off its mitigation service during large attacks, and wouldn't charge more when one hit.² That's a real, generous move. It is also a narrow one. It was never a blanket vow about everyday content-delivery bandwidth. The genius of the framing was that it didn't have to be. A promise about attack traffic, delivered with enough conviction, gets remembered as a promise about all traffic - and the reputation does work the policy never signed up for.

Why attack traffic first? Because that was the rawest nerve in the security market. Rivals sold mitigation and then billed the customer for the size of the assault - a business model that punished victims. Cloudflare didn't invent a new price. It weaponized the absence of one, turning a competitor's most resented invoice line into its own marketing headline. The wedge wasn't a lower number. It was zero, aimed precisely where zero would sting the incumbents most.

A year later, the same move against a completely different enemy: the target shifted from DDoS vendors to hyperscale clouds, and 'unmetered' became a coalition instead of a feature

If the meter-refusal were a philosophy, you'd expect it to arrive once and cover everything. Instead the next strike came the following September - a full year later - and aimed at an entirely different rival. The Bandwidth Alliance launched in September 2018: a coalition of cloud and networking companies agreeing to discount or waive the data-transfer, or egress, fees that customers pay to pull their own data out of a cloud.⁴ Prince framed it as a direct counter to 'certain vendors' making it 'prohibitively expensive to transfer data out.'⁴ The villain this time wasn't the DDoS-mitigation shop. It was the hyperscaler charging you to leave.

The mechanism is worth pausing on, because it's easy to mistake for the 2017 move repeated. Unmetered Mitigation was Cloudflare declining to charge, by itself, for a thing it controlled. The Bandwidth Alliance is not that. It doesn't make Cloudflare's bandwidth free industry-wide. It's a network of partner clouds that individually agree to discount or waive egress on data moving between Cloudflare and that specific partner - a negotiated discount program, not a unilateral elimination of the meter.⁴ It was real and it grew: Alibaba Cloud joined in March 2020,⁵ and by the time Oracle came aboard in November 2021 the roster had reached 19 partners.⁴ Same headline word, 'unmetered.' Completely different machine underneath - a coalition doing to hyperscaler egress fees exactly what the 2017 feature did to DDoS overage: naming a hated fee and refusing to be the one who charges it.

The tell is what Cloudflare metered on its own customers: while the 'we don't meter' story spread, one of its own security features was priced at five dollars per million requests

Here's the fact that dissolves the founding-principle story. For years, Cloudflare sold Rate Limiting - a core security feature - on a straightforwardly metered basis: customers on Free, Pro, or Business plans bought it as an add-on at $5 per million requests.⁶ A company that never meters had a marquee product priced by the request the whole time it was building a reputation for not doing that. It only made Rate Limiting unmetered later, and pointedly staged the announcement on the anniversary of the 2017 DDoS move⁶ - because 'unmetered' was, by then, a brand asset worth extending one product at a time, on a birthday, for maximum narrative continuity.

And the present day settles it. Cloudflare's own pricing page today leads not with a refusal to meter but with the opposite headline: 'pay for what you use.' 'Unmetered DDoS Protection' sits there as one specific line item among many, distinguished across Free, Pro, Business, and Contract tiers.⁷ The newer growth engines - Workers compute, R2 storage, the AI products - are explicitly metered on requests, compute time, storage, and operations.⁷ The company didn't abandon a principle. It never had one. It had a repeatable tactic, and it stopped applying it exactly where usage-billing was too good a business to give up.

Isn't calling this a tactic just cynicism?: the moves were genuinely pro-customer, which is precisely why they worked as strategy

The fair objection is that this reading is too knowing - that Cloudflare gave customers real, unambiguous wins, ended a predatory billing practice, and built a coalition that lowered egress bills, and that calling it 'opportunistic PR strikes' is just cynicism dressed as analysis. That's true as far as it goes: the moves were pro-customer, and customers benefited. But that's the point, not the rebuttal. A pricing wedge only works if it's real. The reason 'we don't meter attacks' cut so deep is that Cloudflare actually stopped charging for them; the reason the Bandwidth Alliance mattered is that partners actually waived fees. The tactic and the generosity are the same act. What the folklore gets wrong isn't Cloudflare's sincerity - it's the shape of the thing. This wasn't a moral stance applied uniformly. It was a marketing instrument, sharpened on whichever rival's worst fee was most exposed, and quietly holstered wherever metering paid Cloudflare's own bills.

Cloudflare built one of the most durable reputations in infrastructure on a word it never actually promised in full. 'Unmetered' was never the company's nature; it was its aim. Twice - on two birthdays, against two different rivals, a year apart - it pointed the word at a fee everyone hated and pulled the trigger, and each time the reputation grew faster than the policy did. The lesson isn't that Cloudflare refuses to meter. It's that a company can turn the absence of a price into its most valuable product - as long as it remembers which prices it still intends to charge.