DigitalOcean and Cloudflare get compared as if they were rivals, but for a small site they mostly do different jobs. A Droplet is a Linux server you rent by the month. Cloudflare Workers, Pages and R2 are an edge platform where you never see a server at all. The real question is which parts of your site belong on each, and where the bandwidth bill lands.
Short answer: Run anything stateful (a database, a CMS, a long-running process) on a DigitalOcean Droplet starting at $6 a month. Put Cloudflare's free plan in front of it for caching and DDoS protection. Serve static sites from Cloudflare Pages for free, and move large files to R2, where egress costs nothing. Use Workers for new stateless APIs. The combination usually beats either one alone.
Full disclosure: this site runs exactly that way, on a 2 GB Droplet behind Cloudflare's cache. Prices below come from DigitalOcean's Droplet pricing and Cloudflare's Workers pricing, checked on October 29, 2026.
DigitalOcean Droplets: a server with a bandwidth allowance
Basic Droplets (shared CPU) are the ones most small sites use:
| Droplet | vCPU | Memory | Disk | Outbound transfer | Price |
|---|---|---|---|---|---|
| Basic | 1 | 512 MiB | 10 GiB | 500 GiB | $4/mo |
| Basic | 1 | 1 GiB | 25 GiB | 1,000 GiB | $6/mo |
| Basic | 1 | 2 GiB | 50 GiB | 2,000 GiB | $12/mo |
| Basic | 2 | 4 GiB | 80 GiB | 4,000 GiB | $24/mo |
| Basic | 4 | 8 GiB | 160 GiB | 5,000 GiB | $48/mo |
Three details matter more than the sticker price:
- ▸Bandwidth overage is cheap. Extra outbound transfer costs $0.01 per GiB, inbound is free, and DigitalOcean's billing docs say the allowance is pooled across every Droplet on your team. Two $12 Droplets share 4,000 GiB.
- ▸Billing is per second since January 1, 2026, with a 60-second minimum and a cap of 672 hours a month on bundled plans. A Droplet you spin up for a test and destroy an hour later costs a cent or two.
- ▸Backups cost extra: 20% of the Droplet price for weekly, 30% for daily. A $12 Droplet with daily backups is $15.60.
The $4 Droplet is a trap for anything real. 512 MiB is enough for a static file server and not much else. Modern Node or Python apps, a database and a package update running at once will exhaust it. Start at $6, and plan on $12 for anything with a database.
I'll give you a lesson from running this site. Our 2 GB Droplet serves pages fine, but when we built the Next.js app on the same box, the build ate the memory and the kernel killed the live web server. Several days of short outages, all self-inflicted. We now build on GitHub Actions and ship the finished image to the Droplet. If you run a framework with a heavy build step, budget for that or buy more RAM than the running app needs.
Cloudflare: you pay for requests, not bandwidth
Cloudflare's developer platform prices the opposite way. There's no server and no bandwidth bill. You pay for requests and compute time.
Workers (serverless functions at the edge):
| Plan | Requests | CPU time | Price |
|---|---|---|---|
| Free | 100,000 per day | 10 ms per invocation | $0 |
| Paid | 10 million/month included, then $0.30 per million | 30 million CPU-ms included, then $0.02 per million CPU-ms | $5/month minimum |
Cloudflare states plainly that there are "no additional charges for data transfer (egress) or throughput (bandwidth)." Requests to static assets are free and unlimited, and so are subrequests your Worker makes to other services.
Pages hosts static sites. The free plan allows 500 builds a month, one build at a time, 100 custom domains per project and up to 20,000 files per site. Cloudflare's Pages pricing says requests to static assets are free and unlimited on both free and paid plans. For a marketing site or documentation, Pages on the free plan is the cheapest hosting there is.
R2 is object storage with no egress fees:
- ▸Storage: $0.015 per GB-month (Standard), $0.01 for Infrequent Access
- ▸Writes (Class A): $4.50 per million; reads (Class B): $0.36 per million
- ▸Free tier: 10 GB of storage, 1 million writes and 10 million reads a month
- ▸Egress to the internet: free
Four sites, four bills
Here's what each platform costs for common small-site workloads.
1. A static marketing site, 50,000 visits a month.
- ▸Cloudflare Pages: $0
- ▸DigitalOcean: App Platform's free tier allows three static sites but only 1 GiB of transfer per app, which a real marketing site can outgrow fast. A $6 Droplet running a web server costs $6 and you maintain it.
Cloudflare wins. No server to patch, no bill.
2. A WordPress or Rails app with a database, 2 TB of traffic a month.
- ▸DigitalOcean $12 Droplet: 2,000 GiB included, so $12, or $15.60 with daily backups.
- ▸Cloudflare: Workers can't run WordPress or a traditional database server. You'd be rewriting the app.
DigitalOcean wins, and Cloudflare's free CDN in front of it cuts the egress further by serving cached pages.
3. 500 GB of downloads or images, 10 TB of egress a month.
- ▸Cloudflare R2: 490 billable GB × $0.015 = about $7.35, egress free. Reads stay inside the 10 million free tier at this file size.
- ▸DigitalOcean Spaces: $5 base (250 GiB storage, 1 TiB transfer), plus about 250 GiB extra storage at $0.02 ($5), plus roughly 9,200 GiB of extra transfer at $0.01 ($92). About $102 a month.
R2 wins by a mile. This is the case where zero egress pricing matters most.
4. A JSON API, 50 million requests a month, 5 ms of CPU each.
- ▸Workers Paid: $5 + 40 million extra requests × $0.30 ($12) + 220 million extra CPU-ms × $0.02 ($4.40) = $21.40
- ▸DigitalOcean: a $12 or $24 Droplet handles that load comfortably for a lightweight API.
Roughly a tie on price. Workers wins on global latency and operations (nothing to patch). The Droplet wins if the API needs a local database or long-running jobs.
The security trade-off
This is the part buyers skip, and it's where the two platforms really differ.
A Droplet is your server. You own OS patching, SSH hardening, the firewall and the web server config. DigitalOcean gives you the tools, but if you don't apply security updates, nobody will. On the plus side, you control everything, and there's no platform-specific code locking you in.
Workers flip that. There's no operating system for you to patch and no SSH port to brute-force. The attack surface is your code and your secrets. The cost is lock-in: Workers use Cloudflare's runtime and bindings, and moving a Workers app to another host means rework.
If you run a Droplet, put it behind Cloudflare, and do it properly:
- ▸Proxy the DNS record through Cloudflare so visitors never see the Droplet's real IP address.
- ▸Restrict the Droplet's firewall so ports 80 and 443 only accept traffic from Cloudflare's published IP ranges. Otherwise an attacker who finds your origin IP goes straight around the CDN and its DDoS protection.
- ▸Close SSH to the internet or limit it to your own IPs, and use key-only login.
- ▸Turn on backups. $2.40 a month on a $12 Droplet is the cheapest insurance in this post.
Which one I'd use
- ▸Static site or docs: Cloudflare Pages, free. Don't run a server you don't need.
- ▸CMS, database-backed app or anything stateful: a DigitalOcean Droplet at $6 to $12, behind Cloudflare's free plan, with the origin locked to Cloudflare's IPs.
- ▸Heavy downloads, media or backups served to the public: R2. The egress savings over Spaces or S3 are large enough to justify a second vendor.
- ▸New stateless API: Workers on the $5 plan, unless it needs a local database.
Most small sites end up using both, and that's the right answer. For other options, see our Hetzner vs DigitalOcean vs AWS comparison for cheaper raw servers, and Vercel vs Netlify if you want managed hosting for a front-end framework.