There are six ways to answer a request with a redirect on Cloudflare, plus one feature that looks like a seventh and is not. They differ on where the rule lives, how many you get, what you can match on, and what quietly stops working at the edges.
Every number below was read off the Cloudflare documentation on 22 July 2026.
Pick by three questions
The comparison
| Method | Rule lives on | Free plan | Matching | The thing that bites |
|---|---|---|---|---|
| Single Redirects | the zone | 10 rules | wildcards; regex from Business | counted again for every zone you own |
| Bulk Redirects | the account | 10,000 URLs, 5 lists, 15 rules | list lookup, subpath, subdomains | query string is dropped by default |
| Snippets | the zone | none | any logic, 5 ms | not available on Free at all |
| Workers | the route | 100,000 requests/day, 10 ms CPU | any logic | you are writing and deploying code |
_redirects file |
the deployment | 2,000 static, 100 dynamic | path only | cannot match on query parameters |
| Origin | your server | whatever you run | anything | the request travels the whole way first |
Single Redirects, per zone
Ten rules on the free plan, twenty five on Pro, fifty on Business, three hundred on Enterprise. Wildcards work everywhere; regular expressions start at Business.
The word that matters is per zone. Ten rules is ten on each domain you own, not ten in total, which is more generous than it first reads. Six domains with four redirects each never touch another product.
Both this and Bulk Redirects need the domain’s DNS record proxied through Cloudflare. Cloudflare’s own wording: they “require that you proxy the DNS records of your domain (or subdomain) through Cloudflare”. On a domain you park rather than serve, that is the step people forget.
Bulk Redirects, per account
The opposite arrangement, and the reason to reach for it: Bulk Redirects “allow you to define a large number of URL redirects at the account level, which can apply across domains in your account”. One list, every zone.
The free plan holds 10,000 URL redirects across 5 lists and 15 rules. Pro raises the URLs to 25,000, Business to 50,000, Enterprise to a million across 25 lists and 50 rules.
Two things to know before you commit to it.
The documented allowance and the provisioned one are not always the same number. Accounts were still hitting the old cap of twenty in July 2026, and the fix is a support request: the docs say 10,000, your account may have 20.
And the query string is discarded unless you ask for it. preserve_query_string defaults to
false, and switching it on replaces rather than merges, so the target URL’s own parameters
are dropped instead. There is no position that keeps both, which is
its own investigation when advertising click IDs are involved.
Snippets, if you are paying
Small pieces of JavaScript that run before the request is served, so a redirect can depend on whatever you can compute. Twenty five on Pro, fifty on Business, three hundred on Enterprise, with 5 ms of execution, 2 MB of memory and a 32 KB package.
The availability table lists the free plan as No, with zero snippets. If you are on Free and looking for logic rather than a list, this is not the row for you.
Workers, when the rule is not a list
A Worker can redirect on anything it can read: header, country, cookie, time of day, the result of a lookup. The free plan allows 100,000 requests a day and 10 ms of CPU per invocation, which is a great deal of redirecting.
The cost is not the quota. It is that a redirect now lives in code, with a deploy, a rollback and someone who has to understand it in a year. For a fixed list of source and target URLs that is a poor trade against Bulk Redirects.
There is one thing only this row can do, though. A rule produces its response before anything downstream runs, so nothing can log that the redirect happened; counting the click requires the code that issues it.
The _redirects file, for a static deployment
If the site is deployed as static assets, redirects can ship with it. The file holds 2,000 static and 100 dynamic redirects, 2,100 in total. It understands 301, 302, 303, 307 and 308, and uses 302 when you do not name one, which surprises people expecting a permanent redirect by default.
Its real limit is matching: query parameter matching is unsupported. If the rule you need is “send this URL somewhere when it carries this parameter”, the file cannot express it.
The origin, still an option
A redirect from nginx, Apache or the application is not wrong. It just happens after the request has crossed the network to your server, which is the whole distance the edge exists to avoid. Worth it when the decision needs data only the application has. Wasteful when the answer is a fixed mapping known in advance.
Transform Rules are not redirects
This is the most common confusion in the whole subject, and the naming does nothing to help.
Transform Rules “allow you to adjust the URI path, query string, and HTTP headers of requests
and responses on the Cloudflare global network”. A URL rewrite changes the request as it
passes through. No status code is sent, no Location header, and the address in the browser
never changes. The visitor asked for one URL and gets a response for it; what happened behind
the edge is invisible.
That is the correct tool when you want a clean public URL over a messy internal one. It is the wrong tool when you want a search engine to learn a new address, because nothing tells it there is a new address.
Free gets 10 Transform Rules, Pro 25, Business 50, Enterprise 300, with regex from Business.
And Page Rules, for completeness
Page Rules did redirects through a setting called Forwarding URL. The documentation now titles that section “Page Rules (deprecated)” and publishes a mapping from every old setting to its replacement, which for redirects is Single Redirects. If you are still holding rules there, here is where each setting went, including the five that go nowhere.
Many domains, one destination
The case that does not fit the table: several hundred hostnames that should all answer, each needing a certificate. Cloudflare for SaaS covers custom hostnames rather than redirect logic, and includes 100 of them on Free, Pro and Business, then charges $0.10 per month for each additional one, up to 50,000.
Pair it with a Bulk Redirect list and a large portfolio has an answer. Whether it is a comfortable answer is a longer story: the runbook for pointing two hundred parked domains at one site covers the zones, the nameserver order and the checking, which is where the work actually is.
What to actually pick
One domain, a few rules: Single Redirects. Nothing else earns its complexity.
A list of source and target URLs, especially across several domains: Bulk Redirects, having checked that your account really has the quota the documentation promises.
A decision rather than a list: Snippets if you are paying for a plan that has them, a Worker if you are not, and neither if the decision turns out to be a lookup after all.
None of this needs a product on top for one zone. It starts to at the point where the rules outlive the person who wrote them, spread across domains nobody has looked at in a year, with no record of which domain was supposed to point where. That is the point 301.st is built for, and the honest place to mention it is here at the end rather than in the middle of a comparison.