Free plan
Free Plan
Basic global connectivity, edge cache, universal SSL and access logs, within plan traffic and request quotas. For personal sites, test environments and light workloads.
— Priced by resources; contact sales
Contact sales Pricing
Pricing and billing
Open a free plan, then move to Pro, China-optimized shield or enterprise lines once traffic grows. CDN traffic, AI tokens, storage, compute and enterprise routes are metered separately, and each line shows up on its own on the bill instead of one blended rate.
No credit card required · Free plan stays available · Upgrade anytime
Plans
Pick a plan by workload
Every plan includes edge caching, HTTPS, baseline DDoS protection and access logs. Quotas for each capability follow the plan matrix; usage beyond the plan is billed by that plan's overage policy.
Billed by delivery
Pro Global
Steadier international routes, low-latency routing and origin optimization, billed by delivered traffic. For production websites, APIs and downloads.
— Priced by resources; contact sales
Contact sales China + DDoS
China Optimized Shield
Mainland China access optimization, DDoS scrubbing and stronger edge security, billed by protection and route resources. For IPv4 workloads with high protection needs.
— Priced by resources; contact sales
Contact sales Enterprise contract
Enterprise Lines
Custom contract covering regions, bandwidth, nodes, scrubbing capacity and SLA. For key-city access and dedicated network resources.
— Priced by resources; contact sales
Contact sales Capabilities
Capability and quota comparison
The table lists plan differences across content delivery, security, DNS, edge platform and log retention. Numbers are plan quotas; a dash means the plan does not include the capability.
Could not load live plan data. Contact sales to confirm capabilities and quotas.
| Capability | Free Plan | Pro Global | China Optimized Shield | Enterprise Lines |
|---|---|---|---|---|
| Content delivery | ||||
| URL rewrite Match ordered rules at the edge to rewrite request paths or query strings for migrations, directory changes and URL normalization; the number of rules is capped by the plan quota. | — | — | — | — |
| Edge redirects Return 301/302 redirects directly from the edge, matched by region, language or path, so the request skips the origin and the landing page responds faster. | — | — | — | — |
| Download throttling Cap download bandwidth per connection or per client so large files cannot saturate egress and crowd out the origin or other users. | — | — | — | — |
| Path-based rules Set separate cache TTL, origin rules and security policies per directory or path, so different content gets its own policy without splitting into more domains. | — | — | — | — |
| Custom headers Add or remove HTTP headers on requests or responses at the edge for CORS, cache control, security headers and debugging tags. | — | — | — | — |
| Brotli compression Compress text assets such as HTML, CSS and JS with Brotli, and serve the encoding the client supports when the object is cached, cutting bytes on the wire. | — | — | — | — |
| Multi-origin load balancing Spread origin fetches across multiple origins by weight and health check result, and fail over to the remaining origins when one goes down. | — | — | — | — |
| Origin regions Point origin fetches at different regional origins by visitor region to shorten the backhaul path and meet data residency or regional deployment rules. | — | — | — | — |
| L4 streams Provide TCP/UDP L4 forwarding and port ingress at the edge for game servers, custom protocols and other non-HTTP services. | — | — | — | — |
| Cross-node origin relay When an edge node cannot fetch from the origin directly, relay the fetch through another node to improve cross-region availability and origin fetch success rate. | — | — | — | — |
| Image optimization Convert to WebP or AVIF and resize or recompress per device, network and request parameters, reducing image weight while keeping visual quality. | — | — | — | — |
| DNS and routing | ||||
| Managed DNS Host authoritative DNS zones with record management in the same place as edge routing, so DNS and delivery configuration do not drift apart. | — | — | — | — |
| DNS records The number of records allowed per DNS zone, covering common types such as A, AAAA, CNAME and TXT. | — | — | — | — |
| GSLB routing Return a route based on visitor region, carrier and health check result, so users on different networks resolve to a healthy node nearby. | — | — | — | — |
| Security | ||||
| Custom WAF rules Write allow or block rules based on IP, path, header and request method; the number of rules is capped by the plan quota. | — | — | — | — |
| WAF block mode Switch WAF from observe mode to block mode, so requests that match a rule are rejected and still written to the log. | — | — | — | — |
| Managed WAF Use a platform-maintained ruleset to block common OWASP attacks; the rules are updated for you instead of being written and maintained one by one. | — | — | — | — |
| Geo blocking Allow or deny requests by country or region for compliance boundaries, staged regional launches and narrowing risky traffic sources. | — | — | — | — |
| Per-client rate limiting Limit request rate per client IP or session to stop CC attacks and abnormal scraping before requests reach the origin. | — | — | — | — |
| Custom CC rules Write CC protection rules from path, header and behavioral signals, with separate rate thresholds and deny conditions. | — | — | — | — |
| Automatic deny Automatically deny high-risk clients after traffic analysis, shortening the time from detection to response. | — | — | — | — |
| Browser challenge Use browser checks or a proof-of-work challenge to separate real users from automated traffic, and only pass requests that complete it. | — | — | — | — |
| Access control | ||||
| Signed URLs Sign asset URLs with an expiry so only requests carrying a valid signature get through, preventing hotlinking and unauthorized redistribution. | — | — | — | — |
| Dynamic tokens Issue a short-lived token per request and validate it at the edge to protect APIs, paid content and sensitive endpoints from replay and scraping. | — | — | — | — |
| Access control lists Maintain IP or CIDR allow and deny lists, with an entry count capped by the plan quota, commonly for admin panels and internal APIs. | — | — | — | — |
| Edge platform | ||||
| Custom certificate upload Upload your own certificate and private key to serve HTTPS, for domains that use an enterprise certificate or a specific CA. | — | — | — | — |
| Resumable uploads Upload large files in chunks over the TUS protocol and resume from the last chunk after a drop, for installers, video and site static assets. | — | — | — | — |
| Edge modules Enable platform-provided feature modules on edge nodes so common processing runs closer to users and fewer requests go back to the origin. | — | — | — | — |
| Bring-your-own modules Upload and run your own edge modules; each module must pass platform review and signing before it goes live, for custom logic and internal integrations. | — | — | — | — |
| Unbranded site Publish sites with your own header and footer instead of the platform branding shell, for brand sites and client projects. | — | — | — | — |
| Logs and usage | ||||
| Log retention How many days of access logs the console can query. Actual coverage is also bounded by the plan term and the underlying storage TTL. | — | — | — | — |
| Analytics panels View requests, bandwidth, cache hit ratio, status codes and regional distribution in the console, filtered by time range. | — | — | — | — |
| RUM / Web Vitals Collect real-user load timing and Core Web Vitals to locate page experience problems. | — | — | — | — |
| Edge analytics auto-inject Inject the analytics script into responses at the edge, so real-user monitoring starts without changing site code. | — | — | — | — |
| Analytics window How many days of analytics data the console can query for reviewing traffic and performance over time. | — | — | — | — |
| Enhanced logs & reconciliation Provide finer log search and usage reconciliation queries for troubleshooting, audit and splitting cost by workload. | — | — | — | — |
| Access log export Export access logs to external storage or an analytics system for long-term retention and your own BI. | — | — | — | — |
Billing
Billing rules
Billed by delivered traffic
Pro counts only traffic actually delivered to end users. Origin fetches and internal routing are not billed as delivered traffic, so nothing is counted twice.
Separate meters
CDN traffic, AI tokens, storage, compute and enterprise routes are metered on separate lines, so each item can be checked on its own.
Monthly or yearly
Subscriptions are priced per domain and billing cycle. Monthly and yearly quotes are listed on the console billing page; a cycle change applies from the next billing cycle.
No hidden fees
Prices and quotas follow the console and the public plan matrix; price or plan changes are announced 30 days in advance.
FAQ
Frequently asked questions
Is the free plan really free forever?
Yes. The free plan includes basic global connectivity, edge caching, a universal SSL certificate and access logs. It suits personal sites, testing and light traffic.
What happens if I exceed my plan traffic?
The excess is billed at that plan's overage rate. The console shows current usage and an estimated charge, and you can set traffic controls or upgrade the plan.
How do I upgrade or downgrade?
Pick the target plan on the console billing page. The change applies from the next billing cycle; the current cycle stays at the old plan and is not prorated.
What is included in enterprise lines?
Scope is set by region, bandwidth, node resources, scrubbing capacity and SLA, with dedicated response times and contract terms agreed in writing.
Does Pro include mainland China optimization?
Pro gives steadier international routes. Mainland China optimization and DDoS scrubbing sit in the China-optimized shield or enterprise lines.
Start free, upgrade as traffic grows
Go live in about 3 minutes with no prepayment. Check speed, security and billing first, then add more workloads.