The Cloudflare features almost no school uses (and probably should)

The sidebar in a Cloudflare dashboard is long, and most accounts I get shown are running the top of it. DNS, SSL, a page rule somebody wrote in 2019 that nobody has read since. That is not a criticism I can make from a safe distance, because my own dashboard looked much the same for years, and I found half of what follows by opening a menu item I had assumed was meant for somebody else.

The district version of this has a price tag on it. Somebody upgraded a zone to a paid plan during an incident, or because a vendor said to, and three years later the plan is still being paid for and four settings are still being used. The features nobody opened aren’t hidden or secret, just sitting behind menu items that never came up in a meeting.

In short: Five Cloudflare features most districts already have access to and rarely switch on: Snippets, Argo Smart Routing, Cache Reserve, Waiting Room, and the client-side security tooling that used to be called Page Shield. One is free and I would turn it on this week. Two are Business tier or above. None of them suit every school.

Why these sit unused

Part of it is that the dashboard is built for every customer Cloudflare has, from a recipe blog to a bank, and nothing in it tells a school which rows are theirs.

Part of it is tiering. Several of the interesting features start at Business, so an IT director on Pro reads the row, sees an upgrade prompt, and closes the tab, a reasonable response that’s also how a district ends up unaware the same feature has a free version doing three quarters of the useful work.

And part of it is that two of these carry a per-gigabyte line item, which means somebody has to own a variable bill, a real obstacle in a school finance office.

So, expectations before the list starts. A single-campus school running Moodle on the same continent as its students probably needs one of these five. A twelve-campus district with an enrollment portal that falls over every August needs three. Reading a feature list as a to-do list is how people end up paying for things that solve problems they don’t have.

Snippets: edge logic without standing up a Workers project

Cloudflare Snippets are short pieces of JavaScript that run on a request as it passes through the network, before your server hears about it. Same idea as Workers, deliberately smaller: a maximum execution time of 5 milliseconds, 2 MB of memory, and a 32 KB package. You get 25 of them on Pro, 50 on Business, 300 on Enterprise, with subrequest limits of 2, 3 and 5 respectively. There is no free tier.

Think about the screwdriver in the kitchen drawer. It exists because walking to the garage for the toolbox is a real cost, and most of what needs a screwdriver is a loose cabinet hinge. Nobody suggests the drawer replaces the toolbox. It replaces the trip.

The school-shaped use for that drawer is a migration. When an institution moves off an old LMS, thousands of course URLs in old syllabi and emailed links stop resolving, and a redirect map that ages for two years is exactly the kind of thing nobody wants living in the application. The other use is headers: adding a Content-Security-Policy or Strict-Transport-Security header across every hostname, without a ticket against a vendor-hosted origin you don’t control, is a fifteen-line Snippet.

One correction before anyone opens the editor. If your redirect is a straight old-URL-to-new-URL mapping, Cloudflare’s Redirect Rules and Bulk Redirects do that natively, faster to configure and easier for the next person to read. Snippets earn their place when the logic has a condition in it, something that has to look at a header or a path pattern and decide. A Snippet nobody documented is a 2019 page rule with a better runtime, so write down what it does and who owns it the day you deploy it.

Argo Smart Routing: is it worth it for students far from campus?

Argo Smart Routing sends traffic across Cloudflare’s own backbone instead of the public internet, routing around congestion in real time. Cloudflare’s published claim is around 30% faster web application performance on average, and it says plainly that the benefit is largest for users furthest from your origin server. That second sentence is the one that decides this for a school.

Picture two ways of shipping a parcel. One carrier picks it up and carries it on its own trucks the whole way. The other hands it between three regional companies, each with its own depot and its own bad afternoon. Both parcels arrive. Only one of them has a single organisation deciding which road to take when the highway backs up.

Argo is priced as a usage-based add-on rather than a plan feature: a monthly base plus a per-gigabyte rate, quoted to you in the dashboard rather than published on the product page. Get your own number from there before it goes anywhere near a budget document, because a per-gigabyte line on an institution’s traffic volume is not a rounding error.

Two limits worth knowing before you price it. Argo does nothing for requests the edge already answered from cache, so if your static course files are being served properly, it’s the traffic that has to reach your origin it actually helps, precisely the authenticated LMS traffic that never gets cached in the first place. And it cannot fix a slow application. If Moodle takes four seconds to assemble a gradebook page, a better path delivers those same four seconds a fraction sooner.

The district this suits has one origin in one place and students who are not in that place: distance-education cohorts, international students writing at their own hours, a multi-campus board whose servers live at the biggest campus. If your students and your origin are in the same region, spend the money on the origin.

Cache Reserve: teaching the edge to stop asking your origin

Cache Reserve is a large persistent cache layer built on R2 that sits behind Cloudflare’s normal edge caches. When something falls out of the edge cache, the request checks the reserve before going back to your server. It requires a paid plan and prices as storage plus operations: USD $0.015 per GB-month, $4.50 per million write operations, $0.36 per million reads.

Most households have already built this. The fridge holds what gets used this week; a chest freezer in the basement holds what you buy once and reach for over months. Nobody keeps a year of food in the kitchen fridge, and nobody walks to the basement for the milk. Different turnover, and the point of the second store is that you stop going back to the store.

For a school the fit is a course library. Recorded lecture decks, PDF readings, SCORM packages and image-heavy course pages are large, identical for every student, and requested in bursts that follow the timetable rather than a smooth curve. A file requested hard in week three and again in week eleven falls out of a normal edge cache in between, and every one of those misses is your origin doing work and paying egress.

The eligibility rules are specific enough that it is worth checking your own headers first. Assets need a cacheable time-to-live of at least ten hours and a Content-Length header, resized image variants are not eligible, origin Range requests are unsupported, and the default retention is thirty days. Cloudflare recommends running Tiered Cache alongside it, which is free and worth turning on regardless.

The boundary here is the same one from the first piece in this series. Cache Reserve holds public files. It has nothing to do with authenticated pages, and if it ever appears to be holding one, you have a cache-rules problem that outranks this entire article. And if the bulk of your bytes is video, the conversation is object storage and Stream, not this.

Waiting Room: the registration-day problem

Every institution has one morning a year that behaves differently from the other three hundred and sixty-four. Course registration opens, several thousand students hit the portal inside ninety seconds because the good sections go first, and the SIS falls over. Then everybody refreshes, which is the part that turns a spike into an outage.

Waiting Room puts a virtual queue in front of that. Traffic above a threshold you set gets held on a Cloudflare-hosted page showing an estimated wait, and gets admitted as capacity frees up.

The deli counter figured this out a long time ago. Take a number, watch the display, and the counter serves the same people it was always going to serve, in a defensible order, without the crowd deciding the order by elbow. Nobody’s sandwich arrives faster. The difference is that the shop is still functioning at ten past.

That is the part worth being clear about, because it is where expectations go wrong. A waiting room does not make your SIS faster and does not raise its capacity. It decides who waits outside a working system rather than letting everyone inside a broken one. Setting the threshold means knowing what your registration path can carry, which means load testing it, which is the piece of homework most districts have never done and the reason a queue sometimes gets configured to a number somebody guessed.

Now the limitation that matters most for exactly this use case. Waiting Room starts at Business, and a Business plan includes one waiting room with the basic feature set. Scheduled events, multiple hostnames and paths, custom templates and the alternative queueing methods are Enterprise advanced add-on features. Registration day is a scheduled event by definition, so on Business you get one room and somebody switches it on by hand at half past seven in the morning and switches it off later, a workable arrangement, though a thinner one than the marketing page implies. It also requires proxied DNS and visitors with cookies enabled.

Client-side security: who else is running code on your fee-payment page

This is the one I would look at first, and it is the one with a free version.

The product used to be called Page Shield and is now branded client-side security, with the paid add-on named Client-Side Security Advanced. It watches what a browser actually loads on your pages, third-party scripts alongside outbound connections and cookies, and tells you when that inventory changes.

Schools accumulate third-party scripts the way a building accumulates equipment. A payment processor on the fees page, a chat widget somebody trialled, two analytics tools because the first one was never removed, an embedded video player, a donation form during the campaign. Each was added for a reason by somebody who no longer works there.

The lobby vending machine is the closest everyday version, sitting inside your building and taking money from your community while serviced by a company whose staff you wouldn’t recognize. If somebody swapped the card reader on it overnight, the only person who’d notice is someone keeping a list of what’s supposed to be in the lobby.

That is a supply-chain attack in one sentence. Nobody breaks into your server; they compromise a script you were already loading, and it quietly reads what a parent types into a payment form. Your origin is untouched, your firewall sees nothing wrong, and the code doing the skimming was invited.

The tiering here is more generous than people assume. Free and Pro get script monitoring, which is the inventory and the change alerts. Business adds connection monitoring, cookie monitoring and page attribution, so you can see which page pulled a given script in. The Advanced add-on is where malicious-script detection, code-change detection and up to five content security rules live, and it is the only tier that will block rather than report.

Two caveats. Monitoring tells you a script changed, not that the change was hostile, so somebody has to read the alerts and know what a normal week looks like. And an alert nobody has been assigned is worth what it costs. For most districts, though, the free tier hands you a written list of every third party executing code on pages where parents type card numbers, and I have yet to meet a school that already had that list.

Which of these does a school need?

Feature	Minimum plan	Cost beyond the plan	The district that needs it	The district that does not
Snippets	Pro (no free tier)	None, included in plan	Post-migration URL redirects with conditional logic; site-wide headers on a vendor-hosted origin	Anyone whose redirects are straight one-to-one mappings; Redirect Rules do that better
Argo Smart Routing	Any paid plan, add-on	Monthly base plus per-GB, quoted in dashboard	One origin, students far from it: distance ed, international cohorts, multi-campus boards	Students and origin in the same region, or a slow origin that should be fixed first
Cache Reserve	Any paid plan	$0.015/GB-month storage, $4.50/M writes, $0.36/M reads	Large public course libraries with bursty term-time demand and real origin egress cost	Small or mostly-dynamic sites; video-heavy sites (that is an object storage conversation)
Waiting Room	Business	Included at Business (1 basic room); advanced rooms are an Enterprise add-on	Registration or application windows that have taken the portal down before	Anyone whose peak is comfortably inside origin capacity
Client-side security	Free (script monitoring)	Free tier is real; Advanced is a paid add-on	Any school with third-party scripts on payment, donation or application pages	Nobody, at the free tier

As of 2026-08-24. Cloudflare plan tiers, feature placement and pricing all move; confirm each against the current documentation before a number reaches a budget document.

If you read one row, read the last one. It costs nothing, takes an afternoon, and answers a question most institutions currently can’t answer at all.

What the four pieces kept running into

Everything in this piece works for the same reason: Cloudflare is standing on the request path, and anything that travels it can be inspected, queued, cached, rerouted or rewritten before your server is involved. A real amount of power for the price, bounded in a way that’s easy to forget once the dashboard starts offering things.

The features here stay unused because they sit on a part of that path nobody thought to look at, while the problems that keep an IT director up are mostly somewhere else entirely. A DDoS mitigation tier doesn’t decide whether your district may hand records to a vendor, the first piece. No edge product makes an untagged PDF readable to a blind student, the second. And no routing intelligence tells you which endpoint your Artificial intelligence (AI) vendor calls or how long it keeps a fourteen-year-old’s essay, the third.

Four pieces, one boundary. What crosses the network path can be bought. What lives in your database, your documents, your contracts and your policies stays yours, and that has been true in every direction I have pushed on it.

Common questions

Do any of these need a developer?
Snippets do, since they’re code, and need a named owner and a note explaining what they do. Argo and Cache Reserve are switches with billing attached rather than engineering projects. Waiting Room is a switch plus a capacity number you shouldn’t guess. Client-side security is a switch plus somebody willing to read alerts.

We’re on the free plan. What can we use?
Script monitoring under client-side security, and that’s the list. Snippets, Cache Reserve, Waiting Room and Argo all need a paid plan, worth saying plainly rather than letting someone spend a morning looking for the toggle.

Our LMS is hosted by a vendor. Does any of this apply?
Only if you control the DNS for the hostname students visit and the contract permits a proxy in front of theirs. Some hosted vendors run their own edge and decline to troubleshoot when another one is present. Same conversation as the first piece: have it at renewal, not in the dashboard.

How do we keep this from becoming five more things nobody owns?
Write down what each one does, who turned it on, and what would go wrong if it were turned off, in the same place your team keeps runbooks. That single paragraph per feature is the gap a site and content audit exists to surface before a staffing change does.

Where to start on Monday

Open your Cloudflare dashboard, find client-side security, and read the list of third-party scripts loading on whichever of your pages takes money from parents. Then check which plan the zone is on, because that single fact rules four of the five features in this piece either in or out before you spend any time on them.

The most common outcome of that half hour is not a purchase order. It is somebody finding out what has been running on the fees page since the spring.