A package sets your price, your quotas, your sustained rate limit, how long your logs are kept, what support you get — and which layers are compiled into your request chain at all. A layer your plan does not include is not disabled: it is absent.
The perimeter and the delivery path for one site.
For growing sites — bot defense, captcha and room to scale.
The full stack — API Gateway, API Shield and AI Gateway.
Unlimited scale, dedicated capacity and an SLA.
The sustained figure is a token bucket, not a fixed window: a burst above it is absorbed from the bucket rather than refused, and a request that exceeds it gets a 429. That is why a spike at the top of the minute does not get double-counted the way a fixed window would.
Counted from the same per-layer events that feed your analytics, per node and reconciled centrally. Over quota, a plan with overage keeps serving and bills the excess; a plan without one stops. Free is the only plan without overage.
Not a feature flag checked per request — the layer is left out of the compiled chain entirely, so it costs nothing to be on a plan without it.
Request logs and per-layer events expire on your plan’s window — 7 days on Free, 30 on Basic, 90 on Pro, a year on Enterprise. Analytics roll-ups outlive the raw rows, so a trend stays readable after the individual requests have gone.
A change recompiles your configuration and rolls out like any other. Sites beyond a smaller plan’s allowance are disabled rather than deleted, and a later upgrade re-enables exactly those.
Your own HTML for a block, a rate limit or an origin failure, served from the edge. Available from Basic upward; Free serves the platform’s default pages.