What Is Cloudflare WARP? Consumer App, Business Client, and How It Works (2026)

Cloudflare WARP is a device client that encrypts your internet traffic and sends it through Cloudflare's global network. There are two versions. The consumer version is a free privacy feature inside the 1.1.1.1 app. The business version, now officially called the Cloudflare One Client (formerly WARP), tunnels company devices into Cloudflare's Zero Trust platform for web filtering and inspection. This guide covers both. First the quick answers people search for, then what IT and security teams need to know before standardizing on it.

Updated for 2027. Facts current as of October 2026.

Cloudflare WARP in 30 seconds

• What it is: an app that encrypts traffic between your device and Cloudflare, using the same network behind the 1.1.1.1 DNS resolver.
• Who it's for: consumers who want a more private connection, and businesses that use Cloudflare Zero Trust.
• Cost: the consumer app is free. WARP+ is an optional paid upgrade. The business client is free to install, but the security features behind it depend on your Cloudflare plan.
• Is it a VPN? It works like one, but it isn't built for picking locations or unblocking content.

Consumer WARP: the 1.1.1.1 app

Cloudflare launched WARP inside its 1.1.1.1 app for phones and later brought it to macOS, Windows, and Linux. Cloudflare describes it as replacing "the connection between your device and the Internet with a modern, optimized, protocol." You install the app, flip one switch, and your traffic is encrypted to the nearest Cloudflare data center.

The app has three levels:

• 1.1.1.1 (DNS only): encrypts your DNS lookups so your internet provider can't see which sites you look up.
• WARP: encrypts more of the traffic leaving your device, not just DNS. Free.
• WARP+: a paid subscription that, per Cloudflare, gives access to a larger network of cities, so you're more likely to connect to a nearby data center. It's sold through the Apple App Store and Google Play.

Does Cloudflare WARP hide your IP address?

Mostly, yes. Cloudflare's FAQ says WARP replaces your original IP address with a Cloudflare IP that represents your approximate location. What it won't do is let you choose a country. WARP routes you through the Cloudflare data center closest to you, so it's not a tool for changing your apparent location or getting around geo-restrictions.

Is Cloudflare WARP safe?

WARP is published by Cloudflare, one of the largest network providers on the internet, and Cloudflare states it won't sell your data. Download it only from Cloudflare's site (1.1.1.1) or the official app stores. Avoid third-party "WARP+ key generators," which are not Cloudflare products.

Business WARP: the Cloudflare One Client

The corporate version enrolls a device into your organization's Cloudflare Zero Trust account. In 2026, Cloudflare renamed the client from Cloudflare WARP to the Cloudflare One Client, alongside a redesigned interface. Under the hood, the background service is still the WARP daemon, and the command-line tools are still warp-cli and warp-diag. That's why most admins still call it WARP.

Per Cloudflare's documentation, the client "securely and privately sends traffic from your devices to Cloudflare's global network, where Cloudflare Gateway can apply advanced web filtering." It also reports device health (OS version, disk encryption, specific apps) for posture checks in Access and Gateway policies. You deploy it through endpoint management tools like Intune, Jamf, or JumpCloud.

How the WARP client works

The client creates encrypted connections in two ways:

• Proxy tunnel: routes internet and private network traffic to Cloudflare using the WireGuard or MASQUE protocol.
• DNS proxy: sends DNS queries to Cloudflare over DNS-over-HTTPS, where Gateway DNS policies filter them.

The important part: the client doesn't inspect content itself. HTTP filtering, antivirus scanning, browser isolation, and DLP all run in Cloudflare Gateway, in Cloudflare's data centers. The client's job is to get your traffic there.

WARP client modes

The mode you pick decides which security features a device actually gets:

• Traffic and DNS (default): routes all traffic and DNS through Cloudflare. This unlocks HTTP policies, antivirus scanning, browser isolation, and posture checks.
• DNS-only: sends only DNS queries to Cloudflare. You get DNS filtering, and nothing that requires reading the web session.
• Traffic only, local proxy, and posture only: narrower modes for specific cases. Posture only reports device health without steering traffic.

Plenty of rollouts start in DNS-only to avoid breaking things. That quietly means no inspection of what users do after the lookup. We cover that gap in is DNS filtering enough.

Does Cloudflare WARP slow down your internet?

It adds a hop, and Cloudflare's hop is usually a short one. Its anycast network is very large, so the nearest data center is often close by. That's a real advantage over legacy proxies with thinner footprints.

But it's still a detour: device to Cloudflare, Cloudflare to the destination, and back, with decryption and inspection at the edge. Cloud-proxy latency typically runs 40 to 80 ms near a point of presence and 150 to 400 ms when users are far from one, and modern SaaS pages chain dozens of requests. The latency math behind cloud proxy SWGs breaks it down.

Split tunneling is the usual fix, with a cost: anything you exclude from the tunnel is traffic Gateway never sees. See split tunnel vs full tunnel.

How much is the detour costing you? Run the Fly-Direct Speed Test to measure your real round-trip latency and compare a cloud-proxy path with inspection on the device. Find it on the dope.SWG page, or book a 20-minute demo.

The tunnel dependency: when the edge has a bad day

Because WARP hands inspected traffic to Cloudflare's network, Cloudflare's bad days become yours. Two recent examples from Cloudflare's own post-incident reports:

• November 18, 2025: a configuration file that exceeded a size limit crashed core proxy services. Impact began at 11:20 UTC, the worst of it eased by 14:30 UTC, and full restoration came at 17:06 UTC. Services including ChatGPT and X were affected.
• December 5, 2025: a change to request-body parsing, made while mitigating a React Server Components vulnerability, affected about 28 percent of Cloudflare's HTTP traffic for roughly 25 minutes.

Cloudflare runs one of the most capable networks on the internet. The point is architectural: a uniform global control plane is a shared dependency, and when configuration goes wrong, it can go wrong everywhere at once. An on-device SWG enforces cached policy locally, so a cloud incident doesn't take web security down with it.

TLS inspection and the developer toolchain

To inspect HTTPS, Gateway decrypts it, which means installing a Cloudflare root certificate on every device. Many tools don't use the operating system's certificate store. Cloudflare's own documentation includes per-tool instructions for adding its certificate to Python, Java, Git, npm, Docker, the AWS and Azure CLIs, JetBrains IDEs, and more.

For engineering-heavy teams, that's most of the daily toolchain. The usual outcome is a growing bypass list, and every bypass is traffic nobody inspects. Certificate-pinned apps make it worse, since they never accept a third-party root.

This is a category problem. It affects every TLS-inspecting product, including ours. The difference is how fast you find out. dope.security surfaces an SSL error notification when pinned traffic breaks, so an admin can create a targeted bypass in a few clicks. More in certificate pinning and SSL inspection.

What WARP unlocks depends on your plan

The client is free. The capabilities behind it aren't uniform. Features like DLP and browser isolation are packaged differently across Cloudflare's Zero Trust plans, so confirm what your tier includes. For AI specifically, Cloudflare launched AI prompt protection in Gateway DLP as an open beta in August 2025. Cloudflare's AI Gateway is a different product: a developer proxy for LLM API traffic, not a control for what employees paste into chat tools. Our Cloudflare Zero Trust pricing guide lays out the tiers.

Cloudflare WARP vs. the dope.security agent

Both are endpoint agents that deploy through MDM and enforce policy on and off the corporate network. They do different jobs:

• What the agent does: WARP forwards traffic to Cloudflare Gateway, which inspects it in the cloud. The dope.security agent is itself an SSL inspection proxy on the device.
• Network path: WARP sends inspected requests through a Cloudflare data center first. dope.security sends traffic direct, with up to 4x performance over legacy proxy SWGs.
• Cloud dependency: WARP enforcement depends on Cloudflare's edge being healthy. dope.security enforces locally and keeps working in fallback mode with cached policies.
• AI data protection: Dopamine DLP intercepts file uploads and AI prompts on the device and classifies them with an LLM with zero data retention, across ChatGPT, Claude, Perplexity, Abacus, and Copilot.
• Corporate vs. personal AI accounts: dope.security Cloud Application Control allows enterprise ChatGPT, Claude, Google, and Microsoft 365 tenants and blocks personal logins on the same domain.
• Footprint: the dope.security agent runs on Mac and Windows in under 100 MB of RAM.

We ran the same analysis on the Netskope Client and the Zscaler Client Connector. The pattern repeats: the agent steers, and the engine lives somewhere else.

Should your company standardize on WARP?

WARP is a strong choice if you're already deep in Cloudflare, your users sit near Cloudflare edges, and your main need is ZTNA plus DNS or network filtering. The network is fast and the client is easy to push.

It's a weaker fit if you need full DLP and AI governance without a plan upgrade, if your developers live in Git, Docker, and cloud CLIs all day, or if you want web security to keep working through a cloud incident. If you're weighing the wider question, see our list of Cloudflare Zero Trust alternatives.

Frequently asked questions

Is Cloudflare WARP a VPN?

Sort of. Consumer WARP encrypts your device's traffic to Cloudflare like a VPN does, but you can't choose a server location, and it's not designed to unblock geo-restricted content. The business version, the Cloudflare One Client, is closer to an SSE agent that tunnels traffic to Cloudflare Gateway for filtering.

Is Cloudflare WARP free?

Yes. WARP in the 1.1.1.1 app is free. WARP+ is an optional paid subscription with access to a larger network. For businesses, the Cloudflare One Client is free to install, and Gateway features depend on your Cloudflare Zero Trust plan.

What is the difference between WARP and the Cloudflare One Client?

The Cloudflare One Client is the new name for the corporate WARP client. Cloudflare's documentation calls it "Cloudflare One Client (formerly WARP)," and the background service and CLI tools still use the WARP name. The consumer 1.1.1.1 app with WARP is a separate personal product.

Does Cloudflare WARP inspect HTTPS traffic?

The client itself doesn't. In Traffic and DNS mode it forwards traffic to Cloudflare Gateway, which decrypts and inspects HTTPS in Cloudflare's cloud using a root certificate installed on the device. In DNS-only mode there's no HTTPS inspection. dope.security inspects HTTPS on the endpoint.

Why does WARP break Git, Docker, or Python?

Gateway's TLS inspection replaces each site's certificate with one signed by Cloudflare's root. Tools with their own certificate stores reject it until you configure trust or add an exception. Cloudflare publishes per-tool instructions for exactly this reason.

What happens to WARP users during a Cloudflare outage?

Because enforcement happens in Cloudflare's cloud, a network or control-plane incident can disrupt filtering and access for connected users. The November 18, 2025 incident lasted several hours. An on-device SWG like dope.security enforces cached policy locally, so web security keeps working.

See on-device inspection live

WARP is an excellent on-ramp to a very good network. It's still an on-ramp. If you want inspection to live on the laptop, where the user and the data already are, book a 20-minute demo and we'll run the corporate-vs-personal ChatGPT test live, or start a free trial at dope.security/pricing.