In July we wrote that Cloudflare still has no spending limit, and that SignalFlare was the smoke alarm, not the sprinkler. We alerted. You pulled the plug.

That changes today. SignalFlare caps are live. Set a monthly ceiling on a Cloudflare account or a single service, arm a cap, and when estimated spend reaches 100%, we cut the traffic that’s costing you money. No one has to be awake.

Why this needed to exist

Nothing about the problem has improved. Workers, R2, D1, KV and Durable Objects still bill per use with no ceiling on paid plans. Cloudflare’s Budget Alerts, launched in April, are a real improvement over silence, but they’re informational by design: one email, evaluated daily, sent the day after you cross the line, for pay-as-you-go accounts only. Cloudflare’s own docs say plainly that they don’t cap usage.

A day is a long time for a loop. The $4,868 D1 weekend took about two days. The bills that made the rounds this autumn ran into five figures. Every one of them had the same shape: something started spending, and the platform let it.

The case for not building a hard cap has always been that an automatic shutoff is its own kind of outage. That’s true, and it’s why we didn’t ship one as a single global off switch. We built it as a set of precise, reversible cuts that you choose in advance.

How a cap works

1. You pick what gets cut. A cap is one or more actions attached to a budget:

  • Remove a Worker route, so the flooded endpoint stops reaching your Worker.
  • Switch on a WAF rule you prepared, such as a block or rate limit on an expensive path.
  • Pause a Worker’s cron triggers, for the scheduled job that’s looping.
  • Turn off a script’s workers.dev URL, for the forgotten endpoint a crawler found.

Most teams don’t cut the whole site. They cut the expensive path.

2. You prove it before you arm it. Every action is born as a dry run. Press Test and we show the exact Cloudflare API calls we’d make, with Cloudflare’s responses. A missing scope or a renamed route shows up on a Tuesday afternoon, not at 3am. Then you arm it by typing a confirmation. Only owners and admins can.

3. At 100%, it runs. On the poll where estimated spend reaches the cap, each armed action runs once for the month, Cloudflare’s raw responses go into the audit log, and your Slack, Discord, email or webhook hears exactly what changed. If Cloudflare’s API hiccups, we retry on the next polls.

4. You can rehearse it. Mark a Cloudflare account as staging, deploy a demo app to it, and run a fire drill: the cut happens for real and restores itself after a few minutes.

5. One click puts it back. Restore re-creates the route with the same pattern and script, disables the WAF rule, puts the exact cron schedules back, or re-enables workers.dev. Restoring is logged and announced too.

It runs on a second Cloudflare token, separate from the read-only one you start with, scoped only to the actions you arm. Your monitoring token still can’t change anything, and we didn’t quietly widen it.

Where a cap stops

We said in July that we’d always tell you where this cuts against us. Here it is.

It acts on estimates, every few minutes. We check spend every 5 minutes on paid plans, from Cloudflare analytics that lag slightly. Expect a few minutes of overshoot. If $500 is the number you truly can’t exceed, cap at $450.

It cuts traffic, not storage. Data you already hold in R2, D1 or KV keeps billing per GB-month.

It can’t reach loops that never touch a route. A Durable Object alarm that reschedules itself forever, or a Queue consumer that retries without end, lives entirely inside Cloudflare. Removing the front door doesn’t stop it. For those, put a circuit breaker in the loop: read your budget level from our status API and stop rescheduling at critical. We’d rather say this than let you find out.

Custom Domains bypass routes. If a Worker is reached only through a Custom Domain, use a WAF rule on that hostname instead of a route cut.

The full list is in the docs: what caps can and can’t stop.

Who it’s for

If your Cloudflare bill can’t hurt you, keep Cloudflare’s free alerts and skip us. Caps are for the teams where it can: the side project on a personal card, the startup whose runway is a spreadsheet cell, the agency running twenty client accounts, and anyone who has already opened that email once.

There is one plan, $5 a month, the same as the Workers Paid fee that makes the surprise bill possible: five accounts, caps of any size, every channel, checks every 5 minutes. You can run a fire drill that restores itself, so you can watch a cut happen before you trust it. The trial is 14 days with no card.

And if you’ve already been burned, talk to us. A risk review is a one-off session where we go through your account with you, find what caused it, and set caps that fit how your app is actually built.

The honest summary

Cloudflare tells you about the fire the next day. SignalFlare now puts out the part of it that comes through the door, within minutes, and gives you the tools to fireproof the rest.

Set your first cap. It takes about ten minutes, and the quickstart walks you through it.

Every spend figure in SignalFlare is an estimate from Cloudflare analytics: an early warning, not your invoice.