Companies that use Cloudflare Enterprise

What this captures, and what it doesn't

We believe in being transparent about how we collect our data and what its limitations are, unlike most other data providers who operate as black boxes. This one is worth reading carefully, because detecting Cloudflare Enterprise plans is genuinely hard and our approach is a little unconventional.

This methodology captures companies whose marketing site is served through Cloudflare using a custom OV or EV SSL certificate, which is a feature only available on paid (Business and Enterprise) Cloudflare plans. Because the OV/EV issuance process requires a real organization-level vetting step from a certificate authority, almost no one bothers with one unless they are a sizeable company on a paid Cloudflare tier, and in practice the overwhelming majority of those companies are on Enterprise.

It does not capture a few important scenarios:

• Cloudflare Enterprise customers who use Cloudflare's free Universal SSL or an Advanced Certificate (which is Domain Validated only) on their public marketing site instead of bringing their own custom OV/EV certificate. These companies are real Enterprise customers but leave no certificate-level fingerprint we can read.
• Cloudflare Enterprise customers who only use Enterprise plans for internal applications, backend infrastructure, or non-marketing properties that are not part of our scanned domain universe.
• Companies on a Business plan that happen to upload a custom OV or EV certificate. Our signal narrows the field to "paid Cloudflare customer using a custom enterprise-grade cert," and while that population skews heavily toward Enterprise, a small slice of Business-plan customers can sneak in.

If you need a complete view of Cloudflare adoption beyond the Enterprise tier, our broader CDN dataset at Cloudflare covers every detectable usage pattern.

How we figured this out

Detecting Cloudflare Enterprise plans is harder than it sounds. The classic shortcut used to be checking for SSO configuration via TXT DNS records, since SSO was once an Enterprise-only feature. Cloudflare recently made SSO available to all plans, which killed that signal entirely. So we had to find a different fingerprint.

We start with the same universe of roughly 3 million company domains, ranked by headcount as reported on their LinkedIn profiles. For each domain, we run a two-step check.

1. Confirm the site is on Cloudflare. We look up the domain's A record, which is the DNS entry that maps a domain name (like example.com) to the IP address of the server actually serving its traffic. If that IP falls inside one of Cloudflare's published IP ranges, the site is being served through Cloudflare's edge. Domains that fail this check are dropped.

2. Inspect the SSL certificate type. For domains that pass step one, we then look at the SSL certificate Cloudflare is presenting on the connection, and specifically at its validation level. SSL certificates come in three flavors:

• DV (Domain Validated): The certificate authority only verified that whoever requested the certificate controls the domain. Free, automated, and the default for most sites. Cloudflare's free Universal SSL is DV.
• OV (Organization Validated): The certificate authority verified the legal organization behind the domain, not just the domain itself. Requires paperwork and a real vetting process.
• EV (Extended Validation): The most rigorous tier. The certificate authority performs a deep verification of the organization's legal existence, physical address, and operational legitimacy.

Cloudflare's standard certificate products (Universal SSL, Advanced Certificates) are DV only. The only way to put an OV or EV certificate in front of a site on Cloudflare's edge is to upload a custom certificate, and custom certificates are restricted to Business and Enterprise plans. So if a domain is on Cloudflare's edge and is presenting an OV or EV certificate, the company has to be on at least a Business plan, and in practice almost always Enterprise. That intersection is our fingerprint.