Website Design for Australian Small Business (2026)
What a small business website costs in Australia in 2026, with real published prices, plus .com.au rules, GST, hosting, privacy and a hiring checklist.
Website Security
Cloudflare WAF Free Plan: What You Get and What You Do Not
Cloudflare's Free plan includes a web application firewall, but with a smaller feature set than the paid plans. This page lists what Cloudflare's own documentation says, what needs a paid plan, and why a firewall in front of a site is a layer and not a patch for PHP. Sources read 22 October 2026.
Key takeaways
- Cloudflare lists a WAF on every plan, including Free. Its plans page shows the Free plan at $0 a month, read 22 October 2026.
- Free gets one managed ruleset. The Free Managed Ruleset is on all plans. The larger Cloudflare Managed Ruleset and the OWASP Core Ruleset need Pro or higher.
- Free gets 5 custom rules and 1 rate limiting rule. Pro, Business and Enterprise get more.
- A firewall in front is a layer. It filters requests before they reach your server. It does not change the PHP running on your server.
- php.net says the update is the complete fix. WordPress.org says hosts may add WAF rules and owners should still update.
- Prices and limits change. Everything here is as Cloudflare's pages read on 22 October 2026. Check the pages before you decide.
What the Free plan includes
Cloudflare's developer documentation sets out the WAF features and which plans have them. This table is built from the WAF overview, the managed rules page, the custom rules page and the rate limiting page, all read on 22 October 2026.
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Free Managed Ruleset | Yes | Yes | Yes | Yes |
| Cloudflare Managed Ruleset | No | Yes | Yes | Yes |
| Cloudflare OWASP Core Ruleset | No | Yes | Yes | Yes |
| Custom rules | 5 | 20 | 100 | 1,000 |
| Rate limiting rules | 1 | 2 | 5 | 100 (depends on contract) |
| Regex in custom rules | No | No | Yes | Yes |
| Security Events | Sampled logs only | Full access | Full access | Full access |
| Zone level analytics | Yes | Yes | Yes | Yes |
Cloudflare's overview page also lists attack score as available on Business and Enterprise, account level configuration as Enterprise only, and Sensitive Data Detection as Enterprise only in the managed rules table.
The plans page lists the monthly price as $0 for Free, $20 a month billed annually or $25 monthly for Pro, and $200 a month billed annually or $250 monthly for Business. Enterprise is custom and billed annually.
What the Free Managed Ruleset is
Cloudflare describes the Free Managed Ruleset as available on all plans and aimed at high impact, widely exploited vulnerabilities. It says the rules are considered safe for most applications. It also says that if you already use the larger Cloudflare Managed Ruleset, you do not need the free one, because the larger one has broader coverage.
On the Free plan, Cloudflare says managed rules inspect up to 1 MB of each request body, and content beyond that may not be fully analysed.
The pages we read do not list which specific attacks the Free Managed Ruleset covers, so we do not list them either. We also did not find a statement from Cloudflare tying a rule to the October 2026 PHP flaws in the pages we read. If that matters to you, ask Cloudflare or check its changelog.
What Free rate limiting looks like
Cloudflare's rate limiting page shows the Free plan with 1 rule, counting by IP address, over a 10 second period. Pro gets 2 rules with periods up to 1 minute, and Business gets 5 rules with periods up to 10 minutes. It is enough for a basic rule, such as slowing repeated requests to a login page, but it is small. This is one rule, so you pick the page that matters most.
What needs a paid plan
From the same documentation, things you do not get on Free include:
- The larger Cloudflare Managed Ruleset, with rules that Cloudflare says are grouped by tags such as
wordpress. - The Cloudflare OWASP Core Ruleset.
- More custom rules and more rate limiting rules.
- Regular expressions in custom rules.
- Full Security Events access. Free has sampled logs only.
- Attack score (Business and Enterprise).
A Pro plan costs $20 a month on annual billing, per Cloudflare's plans page. Whether that is worth it depends on the site. A small brochure site may do fine with the Free tier. A store or a busy login area may want more rules and fuller logs.
A firewall in front is a layer, not a patch
The PHP flaws of 21 October 2026 are in PHP itself. Our main guide to the PHP vulnerability covers the CVEs and the fixed versions. The short version is that PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fix. If your server runs an older build, a firewall in front of it does not change that.
| Layer | What it does | Does it fix PHP? |
|---|---|---|
| PHP update on the origin server | Replaces the vulnerable code | Yes |
| Firewall rules at Cloudflare | Filter requests before they arrive | No, it reduces some exposure |
| Plugin firewall in WordPress | Filters requests inside the site | No |
| php.net temporary settings | Reduce exposure if you cannot update | No, php.net says they do not make an install safe |
WordPress.org says hosts may already be adding WAF rules, and that owners should still check and update. php.net says the update is the full fix. Our comparison of plugin and network firewalls goes into the tradeoffs.
Two more points to keep in mind. First, Cloudflare only filters traffic that goes through it. If your real server address is known, requests aimed straight at that address are not filtered by Cloudflare. Second, you still need to check your host's PHP version. Use our guide to checking your PHP version and the questions for your web host.
How a site gets behind Cloudflare, at a high level
Cloudflare's documentation describes these steps for adding a site. We keep it short on purpose.
- Add your domain in the Cloudflare dashboard and choose a plan.
- Check the DNS records. Cloudflare lists your records, so make sure the main domain, the www version and your email records are all present.
- Choose proxied or DNS only for each A, AAAA or CNAME record. Proxied means web traffic goes through Cloudflare. Cloudflare says other record types, such as MX and TXT, are always DNS only, so mail records are never proxied.
- Change the nameservers at your domain registrar to the two that Cloudflare gives you. Cloudflare says to turn off DNSSEC at the registrar first if it is on.
- Check the SSL/TLS setting to avoid browser errors.
Changing nameservers affects the whole domain, including email, so do it with care and have someone who knows your DNS check it. A wrong move can take email or the site offline for a while.
For context, amariq.com is itself hosted on Cloudflare Pages. That is a static site with no PHP serving its pages, and it is a different setup from a WordPress site on a PHP server. See our post on moving amariq from Webflow to a static site on Cloudflare.
When Free is enough and when it is not
| Your situation | A reasonable reading |
|---|---|
| Small brochure site, little traffic, no login area | Free plan can be a sensible extra layer |
| WordPress site with a login or forms | Consider the managed rules on a paid plan, plus plugin care |
| Online store | Weigh a paid plan, plus updated PHP and plugins. See our post on WooCommerce and the PHP flaw |
| Site on PHP 8.1 or older | The firewall is not the fix. Move to a supported PHP |
This is general guidance, not a promise of protection.
How we help
If your site runs on WordPress, we can look at the PHP version, the host and the DNS with you, then help decide whether a firewall layer makes sense. WordPress development covers fixes and rebuilds. If you would like to move off PHP hosting altogether, Webflow migration is the route, and Webflow development builds the new site. Your domain, hosting and analytics accounts stay in your name.
Frequently asked questions
Is the Cloudflare WAF free?
Cloudflare's plans page, read on 22 October 2026, lists a WAF on every plan, including the Free plan at $0 a month. The Free plan has the Free Managed Ruleset, 5 custom rules and 1 rate limiting rule, according to Cloudflare's documentation. Larger rulesets need Pro or higher.
What is the difference between the Free and Pro WAF?
By Cloudflare's documentation, Pro adds the Cloudflare Managed Ruleset and the OWASP Core Ruleset, 20 custom rules instead of 5, and 2 rate limiting rules instead of 1. Pro also has full Security Events access, where Free has sampled logs only.
Does the Cloudflare Free plan protect against the PHP flaw?
We did not find a Cloudflare statement tying its Free rules to the October 2026 flaws. Even if a rule helps, php.net says the update is the complete fix. Update PHP on your server, and treat the firewall as an extra layer.
Will putting my site behind Cloudflare fix an old PHP version?
No. Cloudflare filters requests in front of your server. Your server's PHP stays the same until you or your host update it.
Does moving to Cloudflare affect my email?
It can, if the DNS records are not copied across. Cloudflare says MX and TXT records are always DNS only, and says to check that your email records are present before changing nameservers. Ask whoever manages your DNS to review it first.
Do I need a paid plan for a WordPress site?
Cloudflare's managed rules page says its larger ruleset is grouped by tags, including wordpress, and that ruleset needs Pro or higher. Whether you need it depends on your traffic and risk. A small site may start on Free and move up later.
Is amariq.com protected by a Cloudflare WAF?
We can say that amariq.com is on Cloudflare Pages, a static site with no PHP serving its pages. We make no other claim about firewall settings in this post.
Managed WordPress vs Shared Hosting: Who Patches PHP?
Who is responsible for PHP updates on shared hosting, managed WordPress hosting, VPS and cloud, and what to ask. Host pages read 22 October 2026.
Is Webflow Secure, and Does It Run PHP?
An honest answer for site owners who heard about the October 2026 PHP flaws. What Webflow says about hosting, SSL and backups, and what stays your job.