What Cloudflare Browser Isolation Actually Costs
Cloudflare Browser Isolation pricing is not a published number. Cloudflare sells isolation as a quote-based add-on to Cloudflare Zero Trust, whose Pay-as-you-go seat costs $7 per user per month and whose Contract tier is quoted annually per user. The Free plan covers up to 50 users but does not include isolation. Your real cost is the seat, plus the isolation line, plus log storage and whatever else you switch on.
📌 TL;DR Executive Summary
- Core Takeaway: Isolation has no list price. It rides on a Zero Trust seat — $7 per user per month on Pay-as-you-go, a custom annual rate on Contract — and is quoted as an add-on. Third-party calculators estimate the add-on near $10 per user per month; that is a planning figure, not a Cloudflare rate.
- Key Risk/Challenge: Seats are only the floor. Log Explorer bills on every plan including Free, DLP and Email Security are paid extras on Contract, and Gateway DNS-only traffic is averaged at 150,000 queries per seat per month, so heavy filtering can force extra seats.
- Recommended Solution: Isolate by Gateway policy instead of isolating everything, get the add-on line in writing before you sign base seats, and if your actual problem is running many client accounts as separate identities, buy a browser profile manager rather than endpoint isolation.
Cloudflare Browser Isolation Pricing, Defined
Browser Isolation is one component of Cloudflare One, next to Secure Web Gateway and Zero Trust Network Access. It executes active content — JavaScript, plugins, the parts of a page that can attack a machine — inside a remote isolated browser, then streams a safe rendering back to the user’s local browser. Malicious code never reaches the endpoint.
That architecture explains the billing model. Cloudflare sells isolation as an entitlement attached to a Zero Trust seat, not as metered traffic: there is no per-hour or per-gigabyte rate. You buy seats first, then the right to isolate traffic for those seats.
| Plan | Base price | Log retention | Browser Isolation | Notable limits |
|---|---|---|---|---|
| Free | $0, up to 50 users | 24 hours | Not included | ZTNA and SWG only, predefined DLP, 2 read-only CASB API integrations, community support |
| Pay-as-you-go | $7 per user/month, billed monthly, no term commitment | 30 days | Quote-based add-on | Unlimited users, 100% uptime SLA, 20 locations, roughly 150,000 DNS queries per seat per month |
| Contract (Zero Trust Enterprise in the docs) | Custom annual price per user | 6 months, SIEM export | Quote-based add-on | Custom DLP, Email Security, out-of-band CASB and dedicated egress IPs are paid add-ons |
Why there is no number on the pricing page
Cloudflare publishes $7 for the Pay-as-you-go seat and nothing for isolation, which is scoped during a sales conversation and priced per contract. That gap is the whole story of Cloudflare browser isolation pricing: two teams with identical headcount can receive different per-user numbers, and neither can check the figure against a public rate. Application connector and device client software are included on all three plans, so those never move the price — isolation, logging and DLP do.
Where the $10 per user estimate comes from
Cost trackers fill the gap. One calculator lists a Remote Browser Isolation add-on at $10 per user per month, which is an aggregator estimate rather than a Cloudflare list price. The same trackers count 13 documented hidden costs beyond list price, including implementation and training, and flag renewal increases of 10-15%. Use those numbers to size a budget envelope, not to forecast a purchase order. For a per-seat breakdown across vendors, see our browser isolation cost analysis.
How Isolation Is Switched On — and Why Scope Changes the Bill
Isolation is off until you configure it. Cloudflare drives it through Gateway HTTP policies: you write a policy with the Isolate action for traffic you want handled remotely, and a Do Not Isolate action for exceptions. Until an Isolate policy exists, no traffic is isolated at all. The Cloudflare One remote browser isolation docs document the behaviour and were updated on 12 October 2026.
Policy changes are governed by Gateway role-based access control — Zero Trust HTTP Policies Admin, or a resource-scoped equivalent. There is no separate Browser Isolation permission surface. That matters for cost in a dull way: whoever administers Gateway can widen isolation scope, so blanket coverage is one careless policy edit away.
In-line or clientless: two deployment paths, two cost profiles
In-line isolation covers traffic and DNS, Access, the Gateway proxy endpoints and Cloudflare WAN. Traffic is decrypted with the Cloudflare root CA, so that certificate has to be trusted on the device — in practice, the Cloudflare One Client is installed and managed. Users can spot isolation by the Cloudflare Root CA in the padlock or by the simplified right-click menu.
Clientless isolation skips the client. People open a prefixed URL of the form https://your-team-name.cloudflareaccess.com/browser/URL and browse remotely in that tab. It costs little to extend to contractors and BYOD machines because nothing installs, but it depends on people remembering the prefix, which is the opposite of enforcement. Sessions are ephemeral either way: close the isolated browser and the session is deleted, and One Client users can pause remote browsing by disconnecting the client. The setup guide covers both modes.
Why conditional isolation usually wins
Because the decision lives in HTTP policy, coverage is a dial rather than a switch. You can isolate every destination, isolate only uncategorised and newly registered domains, or isolate a short list of high-risk sites. Cloudflare bills for the entitlement; the scope you choose decides whether you bought a scalpel or a blanket. Blanket isolation carries costs that never appear on the quote — help-desk tickets, broken internal tools, and root CA trust conversations on every laptop.
Who Actually Needs Browser Isolation Seats
Zero Trust seats are bought per employee, so the buyer is usually IT or security, defending endpoints from web-delivered attacks and answering an auditor. For that buyer the sum is short: how many people need protected browsing, how much log history you must keep, and whether conditional isolation covers the risk.
A good share of searches for Cloudflare browser isolation pricing come from somewhere else. Agencies, sellers running several storefronts and QA teams do not want to protect a laptop from the web — they want to open several accounts side by side, each with its own cookies, storage, session and network exit. Remote browser isolation does not do that. It renders one browsing identity more safely; it does not give you twelve persistent, separate ones.
If you are weighing remote-access models more broadly, the same seat-plus-add-on arithmetic appears in desktop hosting, and our hosted Windows desktop cost comparison is a useful sanity check before you commit to per-seat anything.
Working Through a Bill at 50 and 250 Users
The base is public arithmetic. At $7 per user per month, 50 users cost $350 a month or $4,200 a year, 100 users cost $700 a month or $8,400 a year, and 250 users cost $1,750 a month or $21,000 a year. Per head that is $84 a year, against the $120-200 per user per year usually attached to a hardware VPN concentrator.
| Team size | Base seat, monthly | Base seat, annual | Isolation at the ~$10 estimate, monthly | Combined monthly estimate |
|---|---|---|---|---|
| 50 users | $350 | $4,200 | About $500 | About $850 |
| 100 users | $700 | $8,400 | About $1,000 | About $1,700 |
| 250 users | $1,750 | $21,000 | About $2,500 | About $4,250 |
The last two columns are a planning envelope, not a quote. The $10 figure is an aggregator estimate, so it is fine for arguing a business case and useless for a purchase order — and holding that line is most of what Cloudflare browser isolation pricing asks of you before a sales call.
The lines that are not in the headline
Log Explorer is paid on every plan including Free, with no free tier or trial; on Contract, storage can extend to two years at $0.10 per GB per month. Full DLP, unlimited out-of-band CASB integrations, Email Security and dedicated egress IPs are add-ons on Contract rather than inclusions. Implementation time, training and renewal uplifts sit outside the quote entirely.
When DNS usage outruns headcount
Gateway DNS-only traffic is contractually averaged at 150,000 queries per seat per month — roughly 5,000 per seat per day — and Cloudflare reserves the right to require additional seats above that average. Filter DNS for lab machines, servers or shared kiosks under one person’s seat and you can cross the line without hiring anyone. That is how a per-seat product quietly turns into a per-device bill.
Checklist: What to Nail Down Before You Sign
- Ask for isolation as a named line item — unit, quantity, term. “Included in the platform” is not a price.
- Confirm eligibility in writing. Some sources describe isolation as a Contract-tier add-on while Pay-as-you-go customers report using it, so get your own tier confirmed rather than assumed.
- Decide scope first. List the categories and hosts that get an Isolate policy, and write the Do Not Isolate exceptions in the same meeting.
- Choose in-line or clientless per population. Managed laptops get the One Client and the root CA; contractors and BYOD get the prefixed URL.
- Count seats by people, then check DNS averages per seat. The cheapest tier is the one where nobody’s filtering habits force a seat top-up.
- Price logging separately. Fixed retention decisions belong before signature, because Log Explorer has no free tier on any plan.
- Budget the Contract add-ons — custom DLP, out-of-band CASB, Email Security, dedicated egress IPs — only where your compliance scope actually needs them.
- Write renewal terms into the contract, since third-party trackers report 10-15% renewal increases; negotiate the uplift at year one, not year two.
- Pilot one department for a month and count the support tickets before rolling out the rest.
- Start the quote early. Quote-based pricing moves at the speed of a sales cycle, and budget approval queues behind it.
If your team also buys proxy bandwidth for regional testing, put those line items on the same spreadsheet — the residential proxy price comparison method stops you paying per gigabyte for traffic you never needed.
Common Mistakes That Inflate the Invoice
Confusing zone plans with Zero Trust. Cloudflare Pro at $20-25 a month and Business at $200-250 a month are website plans — caching, WAF, image resizing. They have nothing to do with Zero Trust seats or isolation pricing, and budget conversations go sideways when both numbers land on the same slide.
Assuming Free covers it. Free gives you up to 50 users at $0 with ZTNA and SWG, 24-hour logs, two read-only CASB API integrations, predefined DLP and community support. Browser Isolation is not part of the bundle.
Treating an estimate as a rate card. The $10 per user figure is a calculator output. Bring it as a question and you will get a straighter answer than bringing it as a demand.
Isolating everything on day one. Blanket policies break internal tools, complicate root CA trust on every device and bury the help desk. Conditional isolation by site is usually the better first year.
Mixing up isolation with browser rendering. Cloudflare launched Kitesurf, an agent-first browser on Workers, in beta through Browser Run in August 2026; it uses 3-7x less CPU and memory than Chromium and is slated for open sourcing. It meters through Workers Paid — $5 a month including 10 million requests and 30 million CPU milliseconds, then $0.30 per extra million requests — and has nothing to do with isolation seats.
Buying it for account management. If you are comparing per-profile browser tools on price instead, the discipline is the same as this BitBrowser pricing guide: find the unit you are actually billed on, then count how many of that unit you need.
When a Profile Manager Is the Better Buy
Send.win is not a remote browser isolation product and does not replace Cloudflare Zero Trust. The two solve different problems. Cloudflare isolates a person’s browsing so malicious code stays off the laptop. Send.win gives each work identity its own browser profile — its own cookies, storage, sessions, fingerprint settings and proxy — so you can run a dozen client accounts in parallel without them touching each other. That is the job when you manage accounts you own or are authorised to manage: client social profiles, several storefronts, QA and support testing as different users in different regions.
Profiles run either in the Sendwin Browser desktop app on Windows 10/11 64-bit, macOS 12+ or Linux, or in the cloud browser hosted in Helsinki, Finland, from any device with nothing to install. Residential proxies are included on Pro and Team with metered bandwidth, and you can bring your own HTTP or SOCKS5 proxy; timezone, locale, WebRTC and geolocation follow the proxy’s exit IP automatically. Sharing is built for teams rather than endpoints: share a profile with a paid teammate and it opens already signed in, share live cloud sessions, and cloud sync keeps logins with you across devices. Fingerprint protection is per profile, so each keeps a consistent browser fingerprint as a privacy measure instead of sharing one browser identity. There is no API, SDK, headless mode or automation interface on any plan — it is built for hands-on work.
🏆 Send.win Verdict
Cloudflare Browser Isolation is a sound control with an opaque price: a $7 seat you can budget, an isolation add-on you have to request, and a logging line you cannot avoid. Send.win answers a different question — how to keep many client identities separate without buying an endpoint security platform. If your team manages accounts it is authorised to manage, a published plan with a profile count and a bandwidth allowance is easier to forecast than a quote, and the cloud demo lets you test the profile isolation before you pay.
See Send.win plans — Pro from $19/mo with 150 profiles and 5 GB of proxy bandwidth, or start with the free cloud demo (10 minutes a day, nothing to install).
Frequently Asked Questions
How much does Cloudflare Browser Isolation cost per user?
Cloudflare does not publish a rate. Isolation is a quote-based add-on on top of a Zero Trust seat, which is $7 per user per month on Pay-as-you-go or a custom annual per-user price on Contract. Third-party calculators estimate the add-on around $10 per user per month, but that is an aggregator figure, not an official price.
Is Browser Isolation included in the free Cloudflare Zero Trust plan?
No. The Free plan covers up to 50 users at $0 with ZTNA and Secure Web Gateway, 24-hour log retention, two read-only CASB API integrations, predefined DLP only and community support. Isolation is not part of that bundle, and 24-hour logs are too short for real incident work.
Why does Cloudflare not publish a Remote Browser Isolation price?
Because it is scoped as an add-on during a sales conversation and priced per contract alongside seat count and selected add-ons. That structure lets Cloudflare price by volume and term, but it also means your budget cannot be approved from a web page — you need the line item in writing.
Can I isolate only suspicious sites instead of all browsing?
Yes, and you probably should. Gateway HTTP policies carry an Isolate action and a Do Not Isolate action, and nothing is isolated until an Isolate policy exists. That lets you start with uncategorised domains or high-risk destinations instead of sending all traffic through the remote browser.
What costs sit beyond the $7 per user rate?
Log Explorer is paid on every plan with no free tier, and on Contract you also pay separately for full DLP, unlimited out-of-band CASB integrations, Email Security and dedicated egress IPs. Cost trackers also flag implementation, training and renewal increases, so ask what the invoice looks like in year two.
How does the DNS-query seat limit raise my effective per-user price?
Cloudflare’s service terms average Gateway DNS-only usage at 150,000 queries per seat per month — about 5,000 per seat per day — and reserve the right to require additional seats above it. Filter DNS for devices or servers sharing one person’s seat and you can exceed the average without adding staff.
Do I need Log Explorer, and what does it cost?
You need it if you must investigate anything older than your plan’s retention: 24 hours on Free, 30 days on Pay-as-you-go, six months on Contract. It is a paid add-on everywhere, and Contract customers can extend storage to two years at $0.10 per GB per month.
Is Cloudflare Pro at $20-$25 a month the same thing?
No. Pro and Business are zone plans for websites — caching, WAF, performance features. Zero Trust, and therefore Browser Isolation, is a separate product line priced per seat, so those numbers should never share a budget line.
Run Cloudflare Browser Isolation Pricing in the Cloud With Send.win
Send.win’s cloud browser runs isolated browser profiles on a server in the EU — open a clean session from any device without installing anything:
- Instant cloud sessions – launch an isolated browser in seconds, no local install
- Isolated profiles – separate cookies, storage and fingerprint settings per session
- Cloud sync & profile sharing – pick up the same profiles on the desktop app (Windows, macOS, Linux) or share them with your team
- Residential proxies included – on Pro and Team, with timezone and locale matched to the proxy
You can try it right now: the Send.win demo browser opens an isolated cloud session directly in this browser tab. Paid plans start at $19/month, with a 7-day money-back guarantee on your first card purchase — see pricing.