Purple Shield vs Cloudflare Gateway for protective DNS
Cloudflare Gateway is the secure web gateway inside Cloudflare One, sold as part of Cloudflare's Zero Trust plans and priced per user. It filters DNS, network and HTTP traffic. Purple Shield focuses on protective DNS for every network you run, with a policy per SSID, VLAN and site, ad and tracker blocking, and guest WiFi standards built in.
- news.exampleGuestAllowed
- casino-bonus.exampleGuestBlocked
- ads.tracker.exampleGuestStripped
- c2-callback.exampleHQ LANBlocked
- bookings.exampleBranchAllowed
- phish-login.exampleBranchBlocked
- video.exampleBranchAllowed
- malware-cdn.exampleGuestBlocked
- news.exampleGuestAllowed
- casino-bonus.exampleGuestBlocked · Gambling
- ads.tracker.exampleGuestStripped · Ads
- c2-callback.exampleHQ LANBlocked · Command and control
- bookings.exampleBranchAllowed
- phish-login.exampleBranchBlocked · Phishing
- video.exampleBranchAllowed
- malware-cdn.exampleGuestBlocked · Malware
- 241k
- threats blocked a week at St George's
- 10 days
- earlier warning than standard blocklists
- 500%
- faster page loads with ads stripped
Why teams choose Shield
Why teams choose Shield instead of Gateway
Policy for every network you run
Shield applies policy per SSID, VLAN, site and time of day, so a guest network full of phones and IoT is covered with nothing to install.
Ads and trackers stripped out
Shield blocks ads and trackers at the lookup. Purple measured up to 62% fewer DNS queries and 20 to 40% less web traffic as a result.
Guest standards and UK support
Filtering meets the IWF bar and the Friendly WiFi standard for public networks, and a UK-based Purple team helps you set it up and run it.
Side by side
Purple Shield and Cloudflare Gateway, side by side
| What matters | Purple Shield | Cloudflare Gateway |
|---|---|---|
| How it is sold | Purple ShieldStandalone, or added to Purple Access, Purple's WiFi platform. | Cloudflare GatewayPart of Cloudflare One Zero Trust plans: Free, Pay-as-you-go and Contract. |
| Pricing and trial | Purple ShieldNo published price. 30-day free trial. | Cloudflare GatewayFree up to 50 users. Pay-as-you-go priced per user per month. Contract priced per user annually. |
| What it filters | Purple ShieldThe DNS layer: threats, content, apps, ads and trackers, before any connection starts. | Cloudflare GatewayDNS, network and HTTP policies. HTTP inspection needs a Cloudflare root certificate on each device. |
| Threat blocking | Purple ShieldPhishing, malware, ransomware, botnet and C2 domains, with new threats flagged up to 10 days before blocklists. | Cloudflare GatewaySecurity categories such as malware, phishing and DGA domains, applied in DNS or HTTP policies. |
| Content filtering | Purple Shield40+ categories, Safe Search on Google, Bing and YouTube, and one-click app blocking. | Cloudflare GatewayContent categories such as gambling, adult themes and social, with subcategories beneath them. |
| On-network deployment | Purple ShieldPoint the router, firewall or DHCP at Shield, with no hardware. A relay shows internal IPs on VLANs. | Cloudflare GatewayPoint a router or device at Gateway's resolver. Without the client, only DNS policies apply. |
| Policy by WiFi network | Purple ShieldPer SSID, VLAN, site and time of day, set from the platform that runs your WiFi. | Cloudflare GatewayPolicy by DNS location, matched by source IPv4, a unique IPv6 address or DoH and DoT hostnames. |
| Managed devices | Purple ShieldNo endpoint client. Shield covers managed and unmanaged devices alike on the networks you run, with nothing to install. | Cloudflare GatewayCloudflare One Client, formerly WARP, the on-ramp that carries DNS, network and HTTP policies. |
| Logs and support | Purple ShieldStreaming to Splunk, Sentinel, Elastic, QRadar, CrowdStrike, S3 or syslog. UK-based Purple support team. | Cloudflare GatewayVaries by plan. Free has community support and up to 24 hours of logs; Contract adds phone support. |
Competitor details from Cloudflare's public plans page and developer documentation, checked October 2026.
Switching
How moving from Gateway to Shield works
Run Shield beside Gateway
Point one site, SSID or VLAN at Shield while your other DNS locations stay on Gateway. Compare what each blocks on live traffic.
Mirror your DNS policies
Recreate your Gateway DNS rules in Shield: security and content categories, block and allow lists, and group rules from Entra ID or Active Directory.
Cut over site by site
Change the resolver on each router, firewall or DHCP scope from Gateway to Shield. Each site moves on its own, so you can switch one back quickly.
Retire the old resolver and client
Once every site points at Shield, delete the old DNS locations and remove the Cloudflare One Client where you used it for DNS. Shield needs no client, so devices away from your networks rely on your endpoint protection.
Questions about Shield and Cloudflare Gateway
Is Cloudflare Gateway free?
Cloudflare's Zero Trust Free plan covers up to 50 users, with community support and up to 24 hours of log retention. Above that, Pay-as-you-go is priced per user per month and Contract plans per user annually, according to Cloudflare's plans page. Shield has a 30-day free trial.
Do we need a client on every device?
No. Shield has no endpoint client. Point your router, firewall or DHCP at Shield and every device on that network is covered, including guest phones, smart TVs and IoT. The Cloudflare One Client can carry Gateway policy to devices off your networks; with Shield, those devices rely on the endpoint protection you already run.
Does Shield inspect HTTPS traffic like Gateway?
No. Shield works at the DNS layer, so it blocks a domain before any connection starts and needs no certificate on devices. Gateway's HTTP policies decrypt HTTPS, which needs a Cloudflare root certificate on each device. Shield is a layer behind your firewall, not a replacement for it.
Can each WiFi network get its own policy?
Yes. Shield sets a policy per SSID, VLAN, site and time of day from the same platform that runs your WiFi. A guest SSID can be family-safe to the IWF and Friendly WiFi bar, while staff and IoT networks run a threat-first policy.
Can we send Shield logs to our SIEM?
Yes. Shield streams logs to Splunk, Microsoft Sentinel, Elastic, IBM QRadar, CrowdStrike, Amazon S3 or syslog, and has an open API. Its dashboards let you drill down from a domain to every device that looked it up, and you can schedule PDF reports.
Other comparisons
Shield vs Cisco Umbrella
Moving off Cisco Umbrella? Compare Purple Shield first
Umbrella DNS is moving to Cisco Secure Access. See how Shield compares before you migrate.Shield vs Infoblox
Purple Shield vs Infoblox Threat Defense, formerly BloxOne
Threat Defense pairs with Infoblox DDI. See how Shield compares, starting with one resolver change.See how Shield compares
Shield against a firewall on its own
Not replacing a DNS filter? See what Shield adds behind the firewall you already run.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.