Cloudflare Workers, Pages and R2 for Small Business: A Plain-Language Guide
Cloudflare can host websites, run small automations and store backups without a server. Here is what Workers, Pages, R2, D1 and KV do, when traditional hosting is better, and how to avoid lock-in.
Cloudflare is best known for DNS and website security, but it also runs a developer platform where small businesses can host websites, run small automations and store files without managing a server. In plain terms: Workers runs code and now also serves static websites (Cloudflare tells new projects to start there instead of Pages), R2 stores files and backups with no egress bandwidth charges, and D1 and KV are lightweight databases. It fits fast marketing sites, simple web tools and off-site backup copies very well. It is not a drop-in home for WordPress, PHP applications, email or anything that needs a traditional database server. This guide explains each piece, when it fits, and how to avoid lock-in.
The pieces, in business language
| Product | What it is | Typical business use |
|---|---|---|
| Workers | Code that runs on Cloudflare's network, close to visitors, without a server to maintain | Form handlers, redirects, small APIs, scheduled checks, and hosting static websites |
| Pages | Cloudflare's earlier platform for websites and front-end apps | Existing sites; Cloudflare now points new projects to Workers |
| R2 | Object storage for files, compatible with the S3 API | Off-site backup copies, documents, images, downloads |
| D1 | A managed SQL database with SQLite semantics | Small apps: request forms, inventories, internal tools |
| KV | A global key-value store optimized for reads | Settings, allow-lists, cached content |
Websites: Workers static assets vs Pages
Cloudflare Pages is still documented and supported, and it remains a reasonable home for an existing site. But its documentation now says to start new projects with Workers and calls Workers "Cloudflare's primary platform for building applications." Cloudflare publishes a guide for migrating from Pages to Workers, which notes that Workers has a broader feature set, including Cron Triggers, Workers Logs and gradual deployments.
For a business owner, the practical point is this: a static marketing site (HTML, CSS, images, built with a site generator or a framework) can be served from Cloudflare's network with Workers static assets, deployed automatically from a Git repository. The migration guide states that static asset requests are free on both platforms. There is no server to patch, and the site is fast for visitors in Miami and anywhere else.
What it does not do: run WordPress or other PHP software. Workers supports JavaScript, TypeScript, Python and Rust, plus languages that compile to WebAssembly. If your site lives in WordPress, it belongs on proper hosting, and Cloudflare in front of it as CDN and firewall. See our comparison of a custom website vs WordPress for the bigger decision.
Workers for small automations
Many useful business automations are a few dozen lines of code:
- Contact form handler that validates input, checks a CAPTCHA token and forwards the lead to email or a CRM.
- Redirects and short links for marketing campaigns, kept in one place.
- Scheduled jobs using Cron Triggers: check that your website and portal respond, and alert someone if not.
- Webhook receivers that accept a notification from a payment or booking system and pass it on.
Limits matter. Cloudflare's documentation lists these for the Workers Free plan: 100,000 requests per day, 10 milliseconds of CPU time per invocation, and 5 Cron Triggers per account. Ten milliseconds of CPU sounds tiny, but Cloudflare states that waiting on network requests (fetch() calls, KV reads or database queries) does not count toward CPU time, so a simple form handler usually fits. The Workers Paid plan raises CPU time to 30 seconds per request by default, configurable up to 5 minutes. Heavier work (video processing, large reports, long-running jobs) belongs on a server.
R2 for backups and files
R2 is object storage, the same category as Amazon S3. Two details make it attractive for small businesses:
- No egress fees. Cloudflare's pricing documentation states that there are no charges for egress bandwidth for any storage class. Downloading your own backups during a restore does not add a bandwidth bill. Cloudflare also notes that other metered services you connect to a bucket may still bill you.
- S3 API compatibility. Cloudflare states that R2 implements the S3 API, so many backup tools that support S3-compatible storage can write to it. Cloudflare also documents differences, so test your specific tool.
R2 has two storage classes. Standard is the default and the only one covered by the monthly free allowance. Infrequent Access costs less to store but charges for data retrieval and has a 30-day minimum storage duration, so it suits archives you rarely read, not backups you restore from often.
Making R2 a safe backup destination
- Use a separate bucket for backups, and a token scoped to that bucket only.
- Turn on bucket locks. R2 bucket locks prevent objects from being deleted or overwritten for a set age, until a date, or indefinitely. A retention period helps protect backup copies if a server or a credential is compromised.
- Keep R2 as one copy, not the only copy. It fits the off-site part of the 3-2-1 backup strategy alongside local backups.
- Test restores on a schedule. A backup you have never restored is a hope, not a plan.
D1 and KV, briefly
D1 is a serverless SQL database for small apps built on Workers. Its Time Travel feature is always on and lets you restore a database to any minute within the last 30 days on Workers Paid, or 7 days on Workers Free. You can export a full SQL copy with wrangler d1 export, which is useful for your own off-platform backups.
KV is a key-value store built for read-heavy data. It is eventually consistent: Cloudflare says changes may take 60 seconds or more to be visible in other locations. That is fine for settings and cached content, but not for anything like stock counts or payments where every write must be seen immediately.
When a traditional server or hosting is the better choice
Cloudflare's platform is a strong tool, not a universal one. Choose traditional hosting, a VPS or a cloud or dedicated server when you need:
- WordPress, PHP or another CMS with plugins.
- MySQL, PostgreSQL or Microsoft SQL Server as your main database, or software that expects a normal Linux or Windows server.
- Email hosting, file shares or line-of-business applications.
- Long-running or heavy processing that exceeds Workers CPU limits.
- Full control of the operating system for compliance or vendor support requirements.
A common, sensible setup for a South Florida business is both: the main application on managed hosting, Cloudflare in front for DNS, CDN and security, and Workers or R2 for small jobs and off-site copies.
Vendor lock-in and exit planning
Every platform creates some dependency. Plan the exit before you need it:
- R2 is the most portable piece. Because it speaks the S3 API, moving data to another S3-compatible provider is a copy job.
- Workers code is partly portable. Plain JavaScript or TypeScript logic moves easily; code that depends on Cloudflare bindings (KV, D1, R2 inside a Worker) needs adapting.
- Keep your code in Git, in an account your business owns, and deploy from there.
- Export data regularly: D1 to SQL files, KV to JSON, R2 to a second destination.
- Own the Cloudflare account. The account should belong to the business, with MFA and at least two administrators, not to a former contractor.
If you want help deciding whether Cloudflare's platform, traditional hosting or a mix fits your website, tools and backups, request a free IT assessment. Core Florida IT is an independent IT provider that builds and manages these setups for businesses across Miami-Dade and South Florida, through our web hosting management and custom websites services.
Sources
- Cloudflare Pages overview: "Start new projects with Workers" (Cloudflare Docs)
- Migrate from Pages to Workers (Cloudflare Docs)
- Workers limits (Cloudflare Docs)
- Workers languages (Cloudflare Docs)
- R2 pricing and egress (Cloudflare Docs)
- R2 S3 API compatibility (Cloudflare Docs)
- R2 bucket locks (Cloudflare Docs)
- D1 Time Travel (Cloudflare Docs)
- D1 import and export (Cloudflare Docs)
- How KV works (Cloudflare Docs)
