The complete free Cloudflare stack for a marketing site in 2026
Every Cloudflare free-tier feature we use on this site — Pages, Functions, KV, Workers AI, Turnstile, Web Analytics, Email Routing. Zero recurring cost.
This site runs on Cloudflare’s free tier — every feature, no upsell, no credit card required. Here’s the exact stack, what each piece costs (spoiler: $0), and where the ceilings are.
Hosting — Cloudflare Pages
Static output from Astro, deployed on push. Unlimited bandwidth. 500 builds per month. 20,000 files per deploy. This site has 184 pages and deploys in ~4 seconds.
Serverless — Pages Functions + Workers AI
Two Pages Functions running:
/api/contact— validates the form, verifies Turnstile, sends via Resend, rate-limits via KV./api/ask— runs the AI concierge (bottom-right chat button) using Cloudflare Workers AI. Model: Llama 3.1 Instruct Fast, free tier (10,000 neurons/day).
Free tier: 100,000 requests/day. This site currently uses about 30 per day.
Rate-limiting — Workers KV
One namespace (logicslevel-ratelimit) tracks per-IP request counts for both contact-form submissions (3/10min) and AI concierge questions (20/10min).
Free tier: 100k reads/day, 1k writes/day, 1 GB storage. Current usage: negligible.
Bot protection — Cloudflare Turnstile
Cookieless CAPTCHA on the contact form. No consent banner needed. No user-visible friction — most legitimate humans never see the challenge.
Free tier: unlimited requests, up to 20 widgets per account. This site uses 1.
Analytics — Cloudflare Web Analytics
Cookieless, GDPR-friendly, no consent banner required. Page views, referrers, top pages, browser breakdown — everything most SMBs actually look at. No Google Tag Manager, no third-party JS.
Free tier: unlimited.
Email — Email Routing
Once the domain is on Cloudflare, [email protected] and [email protected] route to our Gmail inbox transparently. Sending is via Resend (also free tier, 3k emails/month, 100/day).
Security — HTTP headers via _headers
A single public/_headers file at the site root sets Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cache rules for hashed static assets. No config, no plugin.
SSL, DDoS, DNS
All free. All automatic. All the reason nobody starts a new marketing site on anything else in 2026.
What we don’t use (yet)
- D1 (SQL database) — free tier is generous but overkill for our current lead-storage needs (Resend + Gmail is the record).
- R2 (object storage) — we don’t have user-uploaded content to store.
- Queues — no async workloads yet.
- AI Gateway — worth adding once Workers AI usage climbs, for observability.
- Vectorize — will add if we build a semantic search on the blog + service pages.
Total recurring cost
Zero. Not “zero-with-caveats”. Zero, with 10–100× headroom on every ceiling.
We build sites like this one for other people too — /services/website-build — from $897 with the same stack. Or if you have a specific automation to ship, book a call.