# CloudFront vs Cloudflare decision worksheet (July 2026)

Re-quote both vendors before multi-year ROI. CloudFront POP counts move — current marketing cites **750+ POPs** in **100+ cities / 50+ countries** plus regional edge caches and embedded POPs ([CloudFront features](https://aws.amazon.com/cloudfront/features/)).

## Must-answer

1. Origin primarily AWS? (S3/ALB/API Gateway)
2. Need vendor-agnostic reverse proxy + DNS in one pane?
3. Bandwidth-heavy media (unmetered egress economics matter)?
4. Edge compute: lightweight JS (CloudFront Functions) vs Workers / Lambda@Edge?
5. WAF/DDoS already on AWS Shield + AWS WAF?

## Prefer CloudFront when

- [ ] Origins and IAM/WAF/Shield already on AWS
- [ ] OAC to private S3, Origin Shield, ACM, CloudWatch logs matter
- [ ] Single-bill FinOps preferred

## Prefer Cloudflare when

- [ ] Multi-cloud / hybrid origins
- [ ] Unmetered egress dominates TCO
- [ ] Workers / Tunnel / DNS+proxy packaging wins ops

## Prefer both (rare)

- [ ] Explicit defense-in-depth + named owners for two cache hierarchies
- [ ] Cost model includes double edge fees and debug complexity

## Smoke checks

| Check                   | CloudFront | Cloudflare |
| ----------------------- | ---------- | ---------- |
| Cache hit ratio last 7d |            |            |
| Origin request rate     |            |            |
| WAF false-positive rate |            |            |
| p95 TTFB key markets    |            |            |