Small businesses face big threats with limited resources
Cyber attacks on large enterprises and governments dominate headlines, but the damage can be far more acute for small businesses operating on tight margins. Research from the Institute for Security and Technology indicates that 43% of cyber attacks target small businesses, and many of these organizations admit they lack the personnel to address IT security adequately, according to a Ponemon Institute report.
Local shops and service providers typically run on a patchwork of cloud-based SaaS tools — accounting software, booking systems, point-of-sale readers, inventory management, content management systems, and email providers. Each of these represents a potential entry point for attackers. A short outage or degraded service that a large enterprise could absorb can quickly become existential for a florist or café with little buffer for lost revenue.
Cloudflare's position is that protection shouldn't be gated by budget. The company has analyzed how small businesses use its services, particularly those on the free tier, to understand the real-world impact of its security and performance offerings.
Understanding the small business base
Cloudflare identified over 94,000 small customers using at least one of its services. These range from a clothing and apparel company in Central Europe to a popular coffee shop in Southeast Asia. Around 30% are based in the United States, with the remainder spread across North America, Europe, South America, Australia, and Asia.
| Location | Small Business Accounts* |
|---|---|
| United States | 28,558 |
| United Kingdom | 6,952 |
| Australia | 3,454 |
| Canada | 3,444 |
| Germany | 3,024 |
| Brazil | 2,822 |
| China | 2,777 |
| India | 2,214 |
| France | 1,793 |
| Vietnam | 1,666 |
In 2022, these small businesses generated over seven billion cached requests per day through Cloudflare's network. The company also helped mitigate more than 38,000 Layer 3 DDoS attacks targeting small customers during the same period — each one representing a potential business interruption that was prevented.
| Location | Layer 3 attacks on small business customers |
|---|---|
| United States | 18,738 |
| United Kingdom | 7,366 |
| China | 6,576 |
| Germany | 5,423 |
| Canada | 2,517 |
| Australia | 2,374 |
| Brazil | 1,871 |
| Hong Kong | 3,365 |
| Russia | 4,579 |
| Taiwan | 1,666 |
Free plan users: significant volume, real protection
As of December 2022, Cloudflare identified 4.2 million accounts using only services from its Free plan, a 40% year-over-year increase from 2021. Together, these accounts accounted for roughly 70 trillion requests over the Cloudflare network in 2022 — a volume of content delivery network services valued at approximately $7 million that users received at no cost. Over two million free Cloudflare Access seats are currently in use as well.
Aggregate numbers don't tell the full story, so Cloudflare spoke directly with a free plan user to understand the individual impact.
A hosting provider's perspective
A small local hosting company in the southern United States uses Cloudflare's free services to protect its clients: websites for florists, bakeries, and pet shops. Some properties include e-commerce functionality, others run WordPress, and some have custom development that needs protection from SQL injections, spoofing, bot scraping, and other malicious activity. These sites aren't specifically targeted but experience broad, less focused attacks across wide ranges of IP addresses — with the same consequences of reduced performance and downtime as larger properties.
The provider relies on Cloudflare's free WAF Managed Ruleset and Bot Fight Mode to block malicious traffic, particularly from overseas IPs. Since these businesses are local, foreign traffic is unlikely to represent legitimate customers. The provider reported that Cloudflare also cut bandwidth egress fees by $100 per month — a small figure for an enterprise, but meaningful for a smaller operation. Caching requests through Cloudflare reduces server load, freeing capacity to absorb attacks when they do occur. The provider also noted that Cloudflare was intuitive to deploy and easy to customize for the specific needs of the sites it protects.
The provider's concluding remark to Cloudflare: "I can't believe you're doing this for free!"
Protection for every property
Cloudflare's stance is that no business of any size should face cyber attacks alone, whether they are a paying customer or not. The Free plan provides a starting point for securing and accelerating a web presence, with setup possible in minutes for any organization looking to protect its operations.
