Summary

  • Cloudflare gives a Workers Free account 100,000 requests per day, resetting at midnight UTC. At the cap, a route configured fail open bypasses its Worker; fail closed returns Error 1027.
  • If a Worker supplies a security check for a proxied origin, fail open shifts the check to whatever the origin itself enforces. Cloudflare recommends fail closed for security-critical Workers.

The gate after the free gate

A free quota sounds like a price ceiling. In this case it is also a traffic switch. Cloudflare's current Workers limits give Free accounts 100,000 requests each day. When the limit is exceeded, the route's fail mode determines what a visitor gets. Fail open sends the request onward as though no Worker had been configured. Fail closed serves Cloudflare's 1027 error page. Both are documented behaviors; neither is a footnote to a hypothetical invoice.

The distinction matters because a Route can put a Worker in front of an existing proxied host. The Worker might rewrite a response, route a request or check access before the application server sees it. If the Worker performs the only access check, bypass leaves the origin to decide whether to serve the request. The missing fact for any real site is the origin's own rule set. If it independently rejects unauthorised traffic, the bypass does not grant that traffic access. If it relies on the Worker, the configured fail mode is part of the security boundary.

Fail closed keeps that boundary by refusing the over-quota request with 1027. It also refuses the legitimate customer. Cloudflare explicitly recommends this setting for security-critical Workers; the operator still owes an availability plan. Fail open favors reachability of the underlying host, while dropping whatever work the Worker was supposed to do. Calling one mode simply 'reliable' and the other 'secure' hides who pays for the choice.

The counter resets at midnight UTC. That gives the team a known clock, not a rescue strategy: a busy route can hit the ceiling before the reset, and the chosen behavior then persists until the account has capacity again or its plan changes. Workers Paid removes this specific daily request cap in Cloudflare's limits table. The practical decision is to inspect the route mode and the origin's independent controls while there is still time to change either.

Sources