Every Cloudflare plan, Free included, absorbs DDoS attacks. Pro goes further. Cloudflare's managed firewall rules and the OWASP ruleset block known attacks, image compression makes your pages lighter, and stronger bot controls turn away automated traffic. Run it on your real traffic, with Tremhost helping you set it up.
Free for 15 days. No card, no payment. On day 16 your site moves to Cloudflare Free and keeps working. Questions first? Talk to our team in Harare.
Many website owners only find out something is wrong when the site goes down or a customer complains. These are the usual causes, and they hit small sites as well as big ones.
Automated scripts try common usernames and passwords on WordPress and other login pages, day and night. Every attempt uses your server's resources, and one lucky guess is enough.
Automated scanners test websites for known weaknesses in themes, plugins and forms. A site that is one update behind is exactly what they are looking for.
Large photos and uncached pages load slowly on mobile data. Visitors who wait too long go back to the search results and pick someone else.
A sudden flood of requests, from an attack or a badly behaved bot, can overwhelm a hosting account. While the site is down, customers can't find you, buy from you or contact you.
Once your domain points to Cloudflare, every request to your website goes through Cloudflare's network first. Cloudflare checks the request, stops what matches an attack and passes real visitors on to your hosting. Files it has already stored are sent from a Cloudflare location near the visitor, so your server does less work.
You keep your hosting, your website and your email. What changes is the route your traffic takes to reach you.
Six things you get on Pro, and what each one means for your business.
Pro turns on the Cloudflare Managed Ruleset and the OWASP Core Ruleset, on top of the Free ruleset every plan gets. They match common attack patterns such as SQL injection and cross-site scripting.
Fewer attacks reach your plugins, forms and database.
SourcePolish compresses your images and strips hidden metadata as Cloudflare delivers them. You don't need to re-upload anything.
Pages weigh less on mobile data, so they can load faster.
SourceSuper Bot Fight Mode lets you allow, challenge or block traffic that Cloudflare identifies as definitely automated, while verified bots such as search engines still get through. It includes a setting for WordPress.
Less scraping, fewer junk sign-ups and less wasted server load.
SourceWrite up to 20 custom firewall rules (Free allows 5), for example to challenge visitors to your admin area. Two rate-limiting rules slow down anyone who requests a page too often, with timeouts of up to an hour.
You can fix specific problems without changing your website's code.
SourceAutomatic Platform Optimization (APO) caches your WordPress pages on Cloudflare's network, not just images and scripts, through the Cloudflare WordPress plugin. On Free it costs $5 a month. Pro includes it.
Visitors get your pages from a Cloudflare location instead of waiting on your server.
SourceCloudflare mitigates DDoS attacks at network and application layers on every plan, with no limit on attack size. Free has this too. Pro keeps it and adds everything above.
Large attacks hit Cloudflare's network instead of your hosting account.
SourceThree facts that matter for your website, taken from Cloudflare's own pages.
Cloudflare's network page lists 348 cities, including Harare. Requests are handled at a Cloudflare location instead of all travelling to your server.
Cloudflare network mapCloudflare describes its DDoS protection as “unmetered and unlimited” at layers 3, 4 and 7, on all plans.
Cloudflare DDoS protection docsThe managed rulesets are created and maintained by Cloudflare, so you don't have to write rules for known attack patterns yourself.
Cloudflare managed rules docsChecked on 1 November 2026. Cloudflare can change its plans and figures.
Cloudflare provides the network. Tremhost is the team you talk to, in Harare.
Tremhost is a Zimbabwean company based in Harare. You deal with a team in your time zone that supports Zimbabwean businesses every day.
Our team helps you with the DNS change. Open a support ticket and we'll take you through it.
You get your own Cloudflare dashboard, so you can see what is being blocked and change settings yourself.
Pay by Visa, Mastercard, EcoCash, InnBucks, ZimSwitch or Omari.
If your site is already compromised, Armor SOS triages it the same day, free, then quotes the cleanup.
Four steps from order to protection. The setup step is the only one that takes any real work.
Open the Cloudflare Pro trial in the Tremhost cart. It's free, and no card is needed.
Log in to your Tremhost client area, or create an account, and confirm the order. No payment is taken.
Our team helps you with the DNS change. For most sites that means checking the DNS records Cloudflare finds, turning off DNSSEC at your registrar if it is on, and changing your nameservers. Registrars can take up to 24 hours to update.
Log in to your own Cloudflare dashboard to see what is being blocked, test your forms and email, and compare page speed. On day 16 your site moves to Cloudflare Free.
Activation isn't instant. Pro starts protecting your site once your domain is active on Cloudflare.
Free is a solid start, and it already includes DDoS protection. Pro is for sites where a known attack, a bot problem or a slow page costs you money.
| Feature | Free | Pro |
|---|---|---|
| DDoS protection (layers 3, 4 and 7)Source | Unmetered | Unmetered |
| Managed WAF rulesSource | Cloudflare Free Managed Ruleset | Free ruleset, plus the Cloudflare Managed Ruleset and OWASP Core Ruleset |
| Custom WAF rulesSource | 5 | 20 |
| Rate-limiting rulesSource | 1 rule, 10-second window and timeout | 2 rules, windows up to 1 minute, timeouts up to 1 hour |
| Bot protectionSource | Bot Fight Mode: simple bots from cloud providers and headless browsers | Super Bot Fight Mode: allow, challenge or block definitely automated traffic, protect static files, JavaScript detections, WordPress setting |
| Block AI crawlersSource | Included | Included |
| Image optimisation (Polish)Source | Not included | Included |
| APO for WordPressSource | $5 a month add-on | Included |
| PriceSource | $0 | $9 a month or $90 a year through Tremhost ($20 a month billed annually, or $25 monthly, from Cloudflare) |
The main job is a DNS change. Cloudflare scans your existing DNS records, you check them, then you replace your nameservers at your domain registrar with the two Cloudflare gives you. Cloudflare says the scan isn't guaranteed to find every record, so the check matters. Our team helps you with the DNS change.
Visitors see the same website. Two things are worth testing during the trial. First, anything that relies on visitors' IP addresses, because your server sees Cloudflare's addresses unless it reads the forwarded visitor IP. Second, any page that should never be cached, such as a cart or account page.
Not if your DNS records are right. Email (MX) records can't go through Cloudflare's proxy and stay DNS-only. The risk is a mail record that is missed or changed during setup, so compare your MX and other mail records with your current DNS before you change nameservers.
You need access to the account where your domain is registered, or someone who has it. DDoS protection works as soon as your domain is active. Firewall rules and bot settings take some understanding, and our support team can talk you through them.
The trial is cancelled automatically on day 16. You aren't charged and nothing renews. Your domain moves to Cloudflare Free, so your site keeps working, with Free's DDoS protection and managed ruleset. If you want to keep Pro, order Armor Guard at $9 a month or $90 a year.
Yes. Pro includes APO, which caches WordPress pages on Cloudflare's network through the Cloudflare WordPress plugin, and Super Bot Fight Mode has a setting for WordPress sites.
Yes. Cloudflare sits in front of your hosting, so it works with cPanel hosting at Tremhost or anywhere else. Your files, databases and email accounts stay on your hosting.
Yes, and Pro is a sensible start for a small store. The managed rules help protect checkout and account forms, and Polish keeps product images light. Test your checkout and payment gateway during the trial. If you have heavy bot or fraud traffic, look at the Business trial.
Yes. You don't move your hosting to use Cloudflare. You only change where your domain's DNS is managed.
Do nothing. The trial ends on its own, you are never charged, and on day 16 your domain moves to Cloudflare Free, so your site keeps working. If you later want to leave Cloudflare altogether, our team will help you point your nameservers back.
Can't find your answer? Open a ticket or contact us.
Pro is Cloudflare's paid plan for professional websites. On top of everything in Free, it adds Cloudflare's managed WAF rulesets, Super Bot Fight Mode, Polish image compression, APO for WordPress, and more custom and rate-limiting rules.
Through Tremhost, Cloudflare Pro (Armor Guard) is $9 a month or $90 a year, billed in US dollars. Bought directly from Cloudflare, Pro is $20 a month billed annually, or $25 month to month (checked 1 November 2026).
Yes. The 15-day trial is free, needs no card and takes no payment. It is cancelled automatically on day 16, so you can't be charged by accident, and your site moves to Cloudflare Free and keeps working.
Both include unmetered DDoS protection. Pro adds the Cloudflare Managed and OWASP rulesets, 20 custom rules instead of 5, longer rate-limiting windows, Super Bot Fight Mode, Polish and APO. See the comparison table.
Yes. Pro runs three managed rulesets (the Free ruleset, the Cloudflare Managed Ruleset and the OWASP Core Ruleset) and lets you write up to 20 custom rules and 2 rate-limiting rules.
Yes. Cloudflare mitigates DDoS attacks at layers 3, 4 and 7 on every plan, with no cap on attack size. That's also true of Free. Pro adds application-layer controls such as the WAF rules and bot settings.
It can, but nobody can honestly promise a number. Speed gains come from caching, Polish and, on WordPress, APO, and they depend on how your site is built and where your visitors are. Measure a few key pages before the trial with PageSpeed Insights, then again during it.
No. Pro targets simple bots and headless browsers, and lets you act on traffic Cloudflare identifies as definitely automated. Detection of many sophisticated bots and of likely-automated traffic is part of the Business plan.
Cloudflare lists Harare among its network locations. Which location serves a visitor depends on how their internet provider routes traffic.
Tremhost accepts Visa, Mastercard, EcoCash, InnBucks, ZimSwitch and Omari, in US dollars. The payment options for your order are shown at checkout.
No. Cloudflare filters traffic before it reaches your site. It doesn't update your plugins, remove malware that's already there or back up your files. Keep doing those, or ask about managed security. If your site has already been hacked, Armor SOS can help.
Pro suits most business websites, blogs and small stores. Business is for sites where downtime or bot fraud has a real cost: it adds sophisticated bot detection, 100 custom rules, longer rate limits, partial DNS setup and a 100% uptime SLA. See the Business trial.
It's free and needs no card. On day 16 your site moves to Cloudflare Free and keeps working. Start the Pro trial, point your domain and judge Cloudflare Pro by what it does for your website.
Running an online store, or a site that can't go down? Look at the Cloudflare Business trial.
Cloudflare is a trademark of Cloudflare, Inc. This page is published by Tremhost, not by Cloudflare.
