Introduction
Content delivery networks have evolved far beyond their original purpose of caching static files closer to users. Today's CDNs are full application delivery platforms that handle security, compute, routing, and optimization — often serving as the primary interface between users and your infrastructure.
This evolution raises a fundamental architectural question: is a CDN a feature of your cloud provider, or is your cloud a feature of your CDN?
Cloudflare, AWS CloudFront, Azure CDN (and its successor Azure Front Door), and Google Cloud CDN represent four distinct answers to this question. Each reflects a different philosophy about where intelligence should live in the stack, how security should be integrated, and what you should pay for.
This comparison goes beyond feature checklists. We will examine the architectural decisions that make each platform fundamentally different — and why those differences compound as you build on top of them.
Every price and network figure below was re-read from the vendor's own pricing or documentation page on 13 August 2026. That matters more than usual here, because AWS has restructured CloudFront onto flat-rate plans with no overage charges, which invalidates the "Cloudflare $0 versus CloudFront $850" comparison that almost every CDN article on the internet — including an earlier version of this one — still runs. Where a number could not be verified from a vendor source this session, it is labelled as such rather than repeated.
Architecture and Network Design
The most important difference between these CDNs is not the feature list — it is the network architecture. Every other difference in performance, pricing, and capability flows from this foundational design choice.
Cloudflare: Every Server Runs Everything
Cloudflare operates a single-tier anycast network across 337 cities (its own figure, checked 13 August 2026), and claims that 95% of the world's internet-connected population is within 50 milliseconds of one of its data centres. The critical design decision: every server in every data center runs the full software stack. There is no distinction between "edge" and "origin shield" — every node is both.
When a request hits Cloudflare, the nearest server handles caching, DDoS mitigation, WAF inspection, bot detection, SSL termination, and Workers compute in a single pass. There is no internal hop from an edge node to a regional cache to a security inspection layer. This single-pass architecture reduces latency and eliminates the cascading failure modes that come with multi-tier designs.
For dynamic content, Argo Smart Routing optimizes the path between edge and origin by routing over Cloudflare's private backbone rather than the public internet, reducing latency by an average of 30% according to Cloudflare's published benchmarks.
The key insight: Cloudflare's network IS the product. The CDN, WAF, DDoS protection, and compute are all properties of the same network — not separate services bolted together.
AWS CloudFront: Two-Tier Cache Hierarchy
CloudFront operates a two-tier architecture. AWS's own features page now states "750+ POPs in 100+ cities across 50+ countries" plus 15 regional edge caches, and separately "1,140+ embedded POPs across 300+ cities" placed inside ISP networks. Edge locations handle initial request processing and cache hits, but cache misses route to regional edge caches before reaching the origin. This tiered approach reduces origin load but adds an internal hop for uncached content.
CloudFront's architecture is deeply integrated with the AWS ecosystem. Data transfer from S3, EC2, ALB, and MediaStore origins is free when the origin is in AWS — a powerful economic incentive to keep your entire stack on AWS. Origin groups provide automatic failover between primary and secondary origins, and Origin Access Control (OAC) restricts S3 access exclusively to CloudFront.
The architecture assumes your origin lives in AWS. While CloudFront supports custom (non-AWS) origins, the deepest integrations and cost benefits are reserved for AWS-native workloads.
Azure CDN / Azure Front Door: Convergence in Progress
Microsoft's CDN story is a convergence narrative. Azure CDN historically offered three provider tiers — Microsoft, Verizon (Edgio), and Akamai — each with different capabilities, pricing, and management interfaces. This created confusion about which tier to choose and inconsistent behavior across tiers.
Azure Front Door is Microsoft's strategic direction. Front Door Standard and Premium tiers combine global HTTP load balancing, CDN caching, WAF, and DDoS protection into a unified service. It operates on Microsoft's global network (the same backbone that serves Microsoft 365, Xbox, and Bing). Microsoft's own documentation states Front Door has 192 edge locations across 109 metro cities, plus four more across Azure US Government regions.
Front Door's distinguishing feature is Private Link origin support, enabling secure backend connectivity without exposing origins to the public internet. For enterprises already running on Azure, Front Door provides native integration with App Service, Azure Storage, and Azure Kubernetes Service.
The consolidation is still in progress. You will encounter documentation, tutorials, and Stack Overflow answers referencing both Azure CDN and Azure Front Door, sometimes conflating the two. New deployments should use Front Door.
Google Cloud CDN: Coupled to the Load Balancer
Google Cloud CDN is architecturally inseparable from Google's global external HTTP(S) Load Balancer. You do not configure Cloud CDN independently — you enable it as a property of your load balancer backend. This tight coupling means you get CDN caching, health checking, and traffic distribution from a single configuration surface, but it also means you cannot use Cloud CDN without using Google's load balancer.
Google's network advantage is real: Cloud CDN runs on the same infrastructure that serves YouTube, Gmail, and Google Search. The backbone is one of the largest private networks in the world. Google is the one vendor here that does not put a headline PoP count on its Cloud CDN pricing or product page — it publishes cache locations as a list instead — so the "180+ PoPs" figure that circulates in comparison articles could not be verified from a Google source on 13 August 2026 and is omitted from the table below rather than repeated.
For streaming and media workloads, Google offers Media CDN as a separate product, built specifically for high-throughput video delivery with features like prefetching and token authentication.
The notable gap: Google Cloud CDN has no native edge compute capability. Unlike Cloudflare Workers or CloudFront Functions, there is no way to run code at Google's edge locations through Cloud CDN. Compute stays in regions.
Content Delivery Capabilities
Beyond architecture, the practical capabilities of each CDN determine what you can build and how much operational work is required.
| Capability | Cloudflare | CloudFront | Azure Front Door | Google Cloud CDN |
|---|---|---|---|---|
| Points of presence (vendor-published, 13 Aug 2026) | 337 cities | 750+ PoPs in 100+ cities, 15 RECs, 1,140+ embedded PoPs | 192 edge locations, 109 metros | Not published as a headline count |
| Cache hierarchy | Single-tier (all nodes equal) | Two-tier (edge + regional) | Single-tier | Two-tier (edge + origin shield) |
| Cache purge speed | <150ms global | 10-15 min | Minutes | Seconds |
| Cache key customization | Comprehensive (headers, cookies, query strings, device type) | Cache policies (headers, cookies, query strings) | Route-based rules | Cache key policy |
| WebSocket support | Yes (all plans) | Yes | Yes | No |
| HTTP/3 QUIC | Yes (default) | Yes | Yes | Yes |
| Image optimization | Yes (Polish, Mirage, Image Resizing) | No (requires Lambda@Edge) | No | No |
| Edge compute | Workers (V8 isolates) | Lambda@Edge + CloudFront Functions | Rules Engine (limited) | No |
| Video streaming | Stream (separate product) | Via S3 + MediaConvert | Via Azure Media Services | Media CDN (separate product) |
| Origin shielding | N/A (every node is the shield) | Regional edge caches | Built-in | Origin shielding option |
| Brotli compression | Automatic | Configurable | Configurable | Configurable |
Cache purge speed deserves emphasis. Cloudflare's sub-150ms global purge means you can deploy content changes and know they are live worldwide almost instantly. CloudFront's 10-15 minute invalidation window means stale content may persist across edge locations — a meaningful difference for applications that require immediate content freshness.
Image optimization is another notable differentiator. Cloudflare includes automatic image optimization (Polish for lossless/lossy compression, Mirage for mobile image loading, and Image Resizing for on-the-fly transforms) as built-in features. On AWS, equivalent functionality requires building a Lambda@Edge function or using a third-party service — adding cost, complexity, and maintenance burden.
Security Features
Security integration is where the architectural philosophies diverge most sharply. Cloudflare treats security as inseparable from content delivery. The hyperscalers treat security as additional services you purchase and configure alongside the CDN.
DDoS Protection
All figures below verified against the vendor's own pricing page on 13 August 2026.
| Provider | Offering | Cost | Notes |
|---|---|---|---|
| Cloudflare | DDoS protection on all plans | $0 — "Unmetered DDoS Protection" on Free, Pro, Business and Enterprise | Included in the flat plan fee |
| AWS | Shield Standard (L3/L4) | $0, automatically enabled for all customers | |
| AWS | CloudFront flat plans | "Always-on DDoS Protection" on Free/Pro; "Advanced DDoS Protection" on Business/Premium | Bundled into the $15/$200/$1,000 plan fee |
| AWS | Shield Advanced (L3/L4/L7 + response team) | $3,000/month, 1-year commitment, plus data transfer out at $0.025/GB via CloudFront and $0.050/GB via ELB/EC2/Global Accelerator | Includes up to 50 billion AWS WAF requests monthly |
| Azure | DDoS IP Protection | $199/month per protected public IP | Per-IP, no minimum |
| Azure | DDoS Network Protection | Fixed monthly fee covering 100 public IP resources — amount not rendered on the public pricing page | See note below |
| Cloud Armor Enterprise Paygo | $0.273972603/hour (about $200/month at 730 hours), includes 2 protected resources | Plus a data processing fee per GiB | |
| Cloud Armor Enterprise Annual | $4.109589041/hour (about $3,000/month), includes 100 protected resources, 1-year commitment | Plus a data processing fee per GiB |
An honest note on the Azure figure. Comparison articles, including an earlier version of this one, quote Azure DDoS Network Protection at $2,944/month. On 13 August 2026 the Azure pricing page renders that value only inside its interactive calculator; the static page shows a placeholder where the number should be, and states only that Network Protection "will have a fixed monthly charge, which includes protection for 100 public IP resources." The one Azure DDoS price that is published in plain text is IP Protection at $199 per public IP per month. If you need the Network Protection number for a budget, pull it from the Azure pricing calculator for your region rather than from any article — including this one.
Two things stand out once the numbers are current. First, the $3,000/month, one-year-commitment tier is not an AWS quirk — Google Cloud Armor Enterprise Annual lands at effectively the same price for the same shape of deal. Second, Cloudflare's unmetered DDoS on every plan, and AWS's decision to bundle DDoS protection into the flat CloudFront plans, both reflect the same conclusion: absorbing volumetric attacks is now table stakes, and the premium tiers sell response teams and SLAs rather than mitigation itself.
Web Application Firewall (WAF)
Verified 13 August 2026.
| Provider | Offering | Cost |
|---|---|---|
| Cloudflare | Managed WAF rulesets | Included in the plan fee: Free / $20 per month Pro (annual) / $200 per month Business (annual). No per-request charge. |
| AWS CloudFront flat plans | WAF rule allowance bundled | 5 rules (Free), 25 rules (Pro, $15/mo), 50 rules (Business, $200/mo), 75 rules (Premium, $1,000/mo) — no overage charges |
| AWS WAF (standalone) | Custom + managed rules | $5.00 per web ACL per month + $1.00 per rule per month + $0.60 per million requests |
| Azure WAF | Managed rules on Front Door | Included in Front Door Premium at no additional cost (Premium base is $330/month) |
| Google Cloud Armor Standard | Security policies and rules | $0.006849315 per policy-hour (about $5.00/month) + $0.001369863 per rule-hour (about $1.00/month) + $0.75 per million globally scoped requests ($0.60 per million regionally scoped) |
Cloudflare includes WAF rules in its plan pricing with no per-request charges, and AWS has now done something structurally similar inside the flat CloudFront plans — a bundled rule count with no overage. Standalone AWS WAF and Google Cloud Armor Standard still use per-rule, per-request pricing that scales with traffic: effective for small sites, and the line item that grows quietly at scale. Azure's approach is the cleanest to budget: WAF and Private Link are both included in Front Door Premium at no additional cost, which is much of what you are buying with the $330 monthly base fee over Standard's $35.
Bot Management
Cloudflare offers Super Bot Fight Mode on Pro+ plans and Bot Management on Enterprise, using machine learning across its entire network to identify bot traffic. Because Cloudflare sees a meaningful percentage of global HTTP traffic, its bot detection models have an unusually large training dataset.
AWS offers Bot Control as a managed rule group for AWS WAF at $10.00 per month per web ACL, with the first 10 million requests per month free on the common rule group and $1.00 per million after, or the first 1 million free on the targeted rule group and $10.00 per million after. That targeted rate is worth reading twice: at 100 million requests a month, targeted bot control alone is roughly $990. Azure Front Door Premium adds a CAPTCHA challenge at $0.40 per 1,000 sessions. Google routes Cloud Armor bot management through reCAPTCHA pricing rather than charging for it inside Cloud Armor.
Pricing Models
Pricing reveals more about a CDN's strategy than any technical specification.
The 2026 change most comparisons missed: CloudFront went flat-rate
AWS now sells CloudFront primarily as flat monthly plans with no overage charges, alongside the traditional pay-as-you-go rate card. This is the single biggest change in CDN pricing since Cloudflare's free tier, and almost every published comparison — including the February 2026 version of this article — still prices CloudFront as if it did not exist.
| CloudFront plan | Price | Data transfer included | Requests included | WAF rules | S3 storage | Overage |
|---|---|---|---|---|---|---|
| Free | $0/month | 100 GB | 1M | 5 | 5 GB | "No overage charges" |
| Pro | $15/month | 50 TB | 10M | 25 | 50 GB | "No overage charges" |
| Business | $200/month | 50 TB | 125M | 50 | 1 TB | "No overage charges" |
| Premium | $1,000/month | 50 TB | 500M | 75 | 5 TB | "No overage charges" |
Verified against the AWS CloudFront pricing page, 13 August 2026. AWS states the plans carry "no additional overage charges or usage calculations, even during traffic spikes or attacks."
Read the request column, not the data transfer column. Pro, Business and Premium all include the same 50 TB of data transfer — what you are actually buying as you move up is request headroom, WAF rules and bundled S3 storage. For a typical site with 250 KB average objects, 50 TB is about 200 million requests, which means the request cap binds long before the bandwidth cap on every plan below Premium. Pro's 10 million requests is the real ceiling of the $15 plan, not its 50 TB.
There is also a separate always-free tier on pay-as-you-go: 1 TB of data transfer out, 10 million HTTP/HTTPS requests, and 1,000 invalidation paths per month. That alone falsifies the "CloudFront costs $85 at 1 TB" line that circulates widely — at 1 TB and under 10 million requests, pay-as-you-go CloudFront is $0.
Bandwidth Cost Comparison
Because pricing now has two shapes — flat plans and metered rates — a single per-TB table is misleading. Here is the metered rate card for each provider, verified 13 August 2026, followed by two modelled workloads.
Pay-as-you-go egress, North America (per GB or GiB):
| Volume band | CloudFront | Azure Front Door | Google Cloud CDN |
|---|---|---|---|
| First tier | $0 (first 1 TB free) | $0.083 (first 10 TB) | $0.08/GiB (first 10 TiB) |
| Next band | $0.085 (next 9 TB) | $0.066 (next 40 TB) | $0.055/GiB (10–150 TiB) |
| Then | $0.080 (next 40 TB) | $0.057 (next 100 TB) | $0.03/GiB (150–1,000 TiB) |
| Then | $0.060 (next 100 TB) | Over 150 TB: contact sales | $0.02/GiB (over 1,000 TiB) |
| Then | $0.040 (next 350 TB), $0.030, $0.025, $0.020 at higher bands | — | — |
| Base fee | $0 | $35/mo Standard, $330/mo Premium | $0 (but Cloud Load Balancing charges apply) |
| Requests | $0.0100 per 10,000 HTTPS (first 10M free) | $0.009 per 10,000 Standard, $0.015 Premium | $0.0075 per 10,000 cache lookups |
| Other | Invalidations $0.005/path over 1,000/mo; AWS-origin fetches free | WAF and Private Link included in Premium | Cache fill $0.01–$0.04/GiB |
Cloudflare does not appear in that table because it does not meter CDN bandwidth: Free $0, Pro $20/month annual ($25 monthly), Business $200/month annual ($250 monthly), Enterprise custom.
Modelled at two realistic traffic levels
Egress and requests together dominate CDN cost, so modelling one without the other gives the wrong answer. Both scenarios below assume a 250 KB average object, which gives 4 million requests per TB.
Scenario A — 10 TB/month, ~40 million requests. A busy content site or a mid-sized SaaS app.
| Provider | Working | Monthly |
|---|---|---|
| Cloudflare Pro | Flat plan fee | $20 |
| CloudFront Pro | Flat $15, but 40M requests exceeds the 10M cap | Not eligible |
| CloudFront Business | Flat plan fee; covers 50 TB and 125M requests | $200 |
| Cloudflare Business | Flat plan fee | $200 |
| CloudFront pay-as-you-go | 9,000 GB × $0.085 (after 1 TB free) + 30M billable requests at $0.0100/10k | ~$795 |
| Google Cloud CDN | 10,240 GiB × $0.08 + 4,000 lookup units × $0.0075 + ~5% cache fill | ~$860 + load balancer charges |
| Azure Front Door Standard | $35 base + 10,000 GB × $0.083 + 4,000 request units × $0.009 | ~$901 |
| Azure Front Door Premium | $330 base + $830 egress + 4,000 × $0.015 (WAF and Private Link included) | ~$1,220 |
Scenario B — 100 TB/month, ~400 million requests. A large media or e-commerce property.
| Provider | Working | Monthly |
|---|---|---|
| Cloudflare Business | Flat plan fee | $200 |
| Google Cloud CDN | 10,240 GiB × $0.08 + 92,160 GiB × $0.055 + 40,000 lookups × $0.0075 + cache fill | ~$6,290 + load balancer charges |
| Azure Front Door Standard | $35 + (10,000 × $0.083 + 40,000 × $0.066 + 50,000 × $0.057) + 40,000 × $0.009 | ~$6,715 |
| CloudFront pay-as-you-go | (9,000 × $0.085 + 40,000 × $0.080 + 50,000 × $0.060) + 390M requests at $0.0100/10k | ~$7,355 |
| CloudFront flat plans | 100 TB exceeds the 50 TB ceiling on every plan | Not eligible |
Three conclusions fall out of that, and none of them match the conventional wisdom:
- Below the 50 TB ceiling, CloudFront is now price-competitive with Cloudflare, not 40x more expensive. At 10 TB, CloudFront Business and Cloudflare Business are both $200 flat. The 2024-era framing is dead in this band.
- Above 50 TB the old story returns, and harder. CloudFront's flat plans stop at 50 TB, so a 100 TB workload drops back onto metered pricing at roughly $7,355 against Cloudflare's $200. The cliff at 50 TB is the most important number in CloudFront's new pricing and it is not in the plan names.
- Google is now the cheapest metered hyperscaler at volume, not AWS — but only if you remember to add Cloud Load Balancing data processing, which is billed separately and is not a rounding error. Google Cloud CDN's headline rates look best and its total is the hardest to quote honestly.
The wider point survives all of this: Cloudflare's flat-fee model removes traffic from the cost equation entirely, which is worth more than any per-GB discount when traffic is unpredictable. What changed in 2026 is that AWS partially copied the idea, capped it at 50 TB, and metered requests instead.
How Is Free Bandwidth Sustainable?
This is a legitimate question to ask. Cloudflare's business model does not depend on bandwidth revenue. Instead, Cloudflare monetizes:
- Security services: Pro ($20/mo billed annually, $25 monthly), Business ($200/mo annually, $250 monthly), Enterprise (custom) plans with advanced WAF, bot management, and DDoS features
- Compute: Workers, Workers KV, Durable Objects, D1, R2
- Zero Trust: Cloudflare Access, Gateway, WARP
- Enterprise features: Custom SSL, dedicated IPs, premium support, SLAs
Bandwidth is a cost of operating the network, and Cloudflare's architecture (single-tier, anycast, no tiered caching) is designed to be bandwidth-efficient. The more traffic on the network, the better their security ML models work, which makes their paid security products more valuable.
Total Cost Considerations
Raw bandwidth cost does not tell the full story. Here is the complete stack at Scenario A (10 TB, ~40 million requests), using the plan that actually fits rather than the cheapest one on the page.
| Component | Cloudflare (Pro) | CloudFront Business plan | Azure Front Door Premium | Google Cloud CDN + Armor Standard |
|---|---|---|---|---|
| CDN + 10 TB + 40M requests | $20/month | $200/month flat | ~$1,220/month | ~$860/month + load balancer charges |
| DDoS protection | Included, unmetered | Included ("Advanced DDoS Protection") | Included (platform basic); IP Protection $199/IP/mo | Cloud Armor Enterprise from ~$200/month |
| WAF | Included | Included, 50 rules | Included in Premium | ~$5/policy + $1/rule + $0.75 per million requests → ~$36/month at 40M |
| SSL/TLS | Included | Included | Included | Included |
| Bot management | Included (Super Bot Fight Mode, Pro+) | Bot Control $10/month + per-request above free allowances | CAPTCHA $0.40 per 1,000 sessions | Billed via reCAPTCHA pricing |
| Image optimization | Included (Polish, Mirage, Image Resizing) | DIY (Lambda@Edge) | Not available | In preview, currently free of charge |
The gap narrowed but did not close. What changed is the shape of the comparison: Cloudflare and CloudFront are now both flat-fee propositions in this band, and Cloudflare's advantage at $20 versus $200 is a 10x difference rather than a 40x one. Azure and Google remain metered, which means their totals move with your traffic and their security add-ons are priced per request — the pattern that punishes you exactly when a bad week happens.
When Hyperscaler CDN Pricing Makes Sense
The analysis above does not mean Cloudflare is always cheaper when you consider the full infrastructure picture:
- Under 50 TB a month: CloudFront's flat plans ($15 Pro, $200 Business, $1,000 Premium, no overage charges) are genuinely competitive, and the Free plan's 100 GB plus the pay-as-you-go always-free 1 TB and 10 million requests mean a small site can run on CloudFront at zero cost. Watch the request cap, not the data cap.
- AWS-native origins: Data transfer from S3/ALB to CloudFront is free. If your origin is on AWS, CloudFront avoids the egress cost that you would pay to send data to Cloudflare.
- Azure-native origins: Same principle — Azure CDN/Front Door eliminates internal data transfer costs for Azure origins.
- Google-native origins: Cloud CDN benefits from free internal networking within GCP.
- Existing enterprise agreements: Many enterprises have negotiated committed-use discounts with hyperscalers that significantly reduce published rates.
If your entire stack is on one hyperscaler and you have a negotiated enterprise agreement, the CDN from that provider may be cost-effective even before you factor in operational simplicity of a single vendor.
Calculate Your Costs
Use the calculator below to estimate costs for your specific workload:
Try the interactive Cdn calculatorRun it free on inventivehq.com →Developer Experience
Configuration Complexity
Cloudflare's dashboard is designed for a CDN-first workflow: you add a site, change nameservers, and the CDN is active with sensible defaults. Advanced configuration (Page Rules, Cache Rules, Transform Rules) uses a visual rule builder.
CloudFront configuration involves creating distributions with origin groups, cache behaviors, cache policies, origin request policies, and response headers policies. The mental model requires understanding how these layers interact. Infrastructure-as-code via CloudFormation or Terraform is almost essential for non-trivial setups.
Azure Front Door uses a routing architecture with front-end endpoints, routing rules, and backend pools. The configuration surface is smaller than CloudFront but still assumes familiarity with Azure networking concepts.
Google Cloud CDN is configured through the load balancer, meaning you must understand Google's networking model (VPCs, forwarding rules, target proxies, URL maps, backend services) before you can configure CDN caching. It is the most complex setup for CDN-only use cases.
Edge Compute
This is where Cloudflare pulls ahead dramatically:
| Capability | Cloudflare Workers | CloudFront Functions | Lambda@Edge |
|---|---|---|---|
| Runtime | V8 isolates | JavaScript (restricted) | Node.js, Python |
| Cold start | 0ms | 0ms | 100ms-5s |
| Execution location | Every PoP (337 cities) | Every PoP (750+) | Regional edge caches (15) |
| Max execution time | 30s (paid) | <1ms | 30s (viewer) / 60s (origin) |
| Memory | 128MB | 2MB | 128-10,240 MB |
| Network access | Full fetch API | No | Full |
| Languages | JS/TS, WASM (Rust, C, Go) | JavaScript | Node.js, Python |
Workers can run full applications at the edge. CloudFront Functions are limited to lightweight request/response manipulation (header modification, URL rewrites). Lambda@Edge is powerful but runs only at the 15 regional edge caches, with cold starts. Google Cloud CDN and Azure Front Door have no comparable edge compute.
Observability
Cloudflare provides real-time analytics in the dashboard with GraphQL API access for custom queries. Logpush streams logs to storage or analytics services. Workers Analytics Engine enables custom event tracking at the edge.
CloudFront integrates with CloudWatch for metrics and S3 access logs for detailed request-level data. Real-time logs are available via Kinesis Data Streams. The observability is comprehensive but requires assembling multiple AWS services.
Azure Front Door provides built-in analytics with Azure Monitor integration. Google Cloud CDN metrics flow through Cloud Monitoring with request-level logging available in Cloud Logging.
Decision Framework
Choose Cloudflare When:
- Security is a primary concern and you want DDoS, WAF, and bot protection without per-request charges
- Bandwidth costs are significant or unpredictable — a flat plan fee with no per-GB CDN charge removes traffic from the cost equation, and the advantage grows sharply above CloudFront's 50 TB flat-plan ceiling
- You need edge compute — Workers is the most capable and lowest-latency edge compute platform
- You are not locked into a single hyperscaler — Cloudflare works equally well in front of any origin
- You want operational simplicity — single dashboard for CDN + security + compute + DNS
Choose CloudFront When:
- You are under 50 TB a month — the flat Pro/Business/Premium plans with no overage charges are new in 2026 and change the arithmetic that older comparisons are built on
- Your origin is on AWS — free data transfer from S3, ALB, and other AWS services makes the economics compelling
- You need Lambda@Edge for server-side rendering, personalization, or A/B testing at the edge
- Deep AWS integration is required — IAM, ACM, WAF, Shield, and CloudWatch are tightly connected
- You have an existing AWS enterprise agreement with negotiated rates
Choose Azure Front Door When:
- Your infrastructure is on Azure — native integration with App Service, AKS, and Azure Storage
- You need Private Link origins for secure backend connectivity without public endpoints
- Enterprise Microsoft ecosystem — Azure AD integration, compliance certifications, Microsoft support contracts
- Hybrid cloud with on-premises — Azure Front Door works with Azure ExpressRoute and hybrid networking
Choose Google Cloud CDN When:
- Your origin is on GCP — tight integration with the global HTTP(S) load balancer
- Media and streaming workloads — Media CDN is purpose-built for high-throughput video delivery
- You are already using Google's load balancer — Cloud CDN is a checkbox, not a separate service to configure
- You do not need edge compute — if your workloads are region-based, the lack of edge compute is not a limitation
The Bigger Picture
The CDN market reflects a broader strategic divergence in cloud computing. Cloudflare is building a global network where every location is a full-capability node — the CDN, the compute platform, the security layer, and the database runtime are all the same thing. The hyperscalers are building regional data centers with edge locations that serve as lightweight cache proxies.
Neither approach is universally better. Cloudflare's model excels for latency-sensitive, globally distributed, security-critical workloads. The hyperscaler model excels for compute-heavy, region-specific workloads that benefit from deep ecosystem integration.
The honest assessment: if your entire stack is on one hyperscaler and your traffic is predictable, the CDN from that hyperscaler is likely the pragmatic choice. But if you are evaluating CDN capabilities independently — or if bandwidth costs, security, and edge compute matter — Cloudflare's architecture is genuinely differentiated in ways that go beyond pricing.
Understanding these architectural differences is more valuable than memorizing feature comparisons. The features change quarterly. The architectural philosophies change over decades.
The prices, though, change faster than either — and that is the practical lesson from re-checking this article. Between February and August 2026, AWS moved CloudFront onto flat-rate plans, which flipped the headline conclusion of nearly every CDN comparison online, and Azure stopped rendering its DDoS Network Protection price in plain text on the page that is supposed to publish it. Every figure above was read from the vendor's own pricing or documentation page on 13 August 2026, and the two numbers that could not be verified from a vendor source — Google's PoP count and Azure's Network Protection monthly fee — are labelled as unverified rather than repeated from elsewhere. Before you commit a budget, open the vendor's calculator and put your own traffic and request counts into it. The 50 TB cliff, the request caps, and Google's separate load balancer charges are all things a per-TB table will hide from you.