Part IThe Story
The Morning of the Bad Mood
The email went out on Wednesday, August 16, 2017, and the most revealing thing about it may be a typo. Midway through the second paragraph the CEO of Cloudflare, a company that by its own count carried roughly a tenth of all requests on the internet, wrote that his decision "was different than what I'd talked talked with our senior team about yesterday." The doubled word survived into the version Gizmodo published that afternoon. Nobody had proofread it. It was the prose of a man who had already acted and was now, a little breathlessly, explaining.
What he had done was simple. "Earlier today Cloudflare terminated the account of the Daily Stormer," Matthew Prince wrote. "We've stopped proxying their traffic and stopped answering DNS requests for their sites." Four days earlier, white supremacists had marched in Charlottesville, Virginia, and a woman named Heather Heyer had been killed. The Daily Stormer, a neo-Nazi site, had mocked her death. GoDaddy dropped it, then Google's registrar. Cloudflare, which sat in front of the site and absorbed the floods of junk traffic aimed at knocking it offline, held out longer than anyone. Then, on its bulletin boards, the Stormer's people began claiming that the "senior echelons" of Cloudflare were "one of us."
Prince's account of what happened next has the flat, procedural cadence of a deposition:
"I woke up this morning in a bad mood and decided to kick them off the Internet. I called our legal team and told them what we were going to do. I called our Trust & Safety team and had them stop the service. It was a decision I could make because I'm the CEO of a major Internet infrastructure company."
And then, rather than closing the matter, he opened it. "Having made that decision we now need to talk about why it is so dangerous."
— Matthew Prince, internal email to Cloudflare staff, August 16, 2017Literally, I woke up in a bad mood and decided someone shouldn't be allowed on the Internet. No one should have that power.
It is an extraordinary document, and it has been read, mostly, as a confession. It is also an argument — a lawyer's argument, constructed in the knowledge that the client would be found guilty and that the only remaining question was the precedent. Prince had used his power and, in the same breath, indicted it. He had called his own act "arbitrary," a word executives generally pay counsel a great deal of money to keep out of the record. He had made himself Exhibit A.
There is a lobby in San Francisco, at Cloudflare's headquarters, where a wall of lava lamps glows and wobbles behind glass. A camera watches the wax rise and break apart, and the unpredictable images are fed into the systems that generate encryption keys. The company has engineered randomness into a security asset; double pendulums swing in London for the same reason, a Geiger counter clicks in Singapore. Unpredictability, harnessed, is protection. Unpredictability in a person who controls the pipes is the thing Prince spent that August morning — and much of the following decade — warning everyone about.
He was forty-two. He had grown up in a ski town in Utah, studied English, trained as a lawyer, practiced law for either one day or none (his biographies disagree), built a spam trap to have something to say at a conference, and turned it into a piece of infrastructure so ordinary that, as he liked to say, "When we're doing our job, you don't notice anything except for a slightly faster internet experience." The email made him noticeable. It also made him the most candid person in the room every time the room filled with people asking who, exactly, gets to decide what is on the internet.
That question — who holds the switch, and whether anyone should — runs underneath nearly everything he has built. It runs, too, through the mountains he came from, where the land was once open and is now, increasingly, his.
By the Numbers
The Network Behind the Network
$2.168BCloudflare revenue in 2025
21.3%Share of all websites using Cloudflare, January 2026 (W3Techs)
45MAverage HTTP requests handled per second (2023)
31.4 TbpsLargest DDoS attack Cloudflare reported mitigating, December 2025
$15NET's IPO price, September 13, 2019
2,900+Organizations protected free under Project Galileo by 2025
$5.5BPrince's net worth, February 2025 — the largest in Utah
Every Plot of Land Was Owned by Someone
Ask Prince where his politics come from and he does not talk about law school, or the First Amendment, or the Electronic Frontier Foundation. He talks about moose.
— Matthew Prince, to WIREDI grew up in the mountains in Utah and we'd go walking, looking for moose on these huge plots of land that were public and everyone could use. The freedom was absolute. Then I went east to college and every plot of land was owned by someone, and I realised freedom was worth protecting.
It is a nice line, and a slightly too-neat one, the kind of origin myth founders polish over hundreds of interviews. But the geography is real. Park City in the late 1970s and early 1980s was a former silver-mining town of a few thousand people, snowed in for much of the winter, not yet the luxury resort it became. Prince's family had been there for generations. His great-great-grandfather was John Browning, the Ogden gunsmith whose patents gave the world the Auto-5, the first semi-automatic shotgun, the M2 machine gun, and the M1911 pistol. The family name he carries in the middle — Matthew Browning Prince — belongs to the most consequential firearms designer in American history. His most famous early defense of a controversial customer would be the sentence "A website is speech. It is not a bomb." The descendant of the man who designed the .45 knew something about the difference.
His father, John Browning Prince, was the sort of man small towns produce in quantity and newspapers rarely profile: a journalist, then the drivetime host on local talk radio, then a stockbroker who started his own brokerage, then a restaurateur who would eventually own more than thirty restaurants across three states. His mother opened six stores — gifts, stationery, flowers, coffee, kitchenware — and had, her son said, "a really great eye for spotting the next trend." He worked for her in high school. "I didn't really know how to apply for a job," he told WIRED. "Both my parents were making it up as they went along."
The family built things around town — the Stein Eriksen Lodge at Deer Valley, the Yarrow Hotel, an Alpine Slide. His father and some friends owned the land under Parleys Summit, a small ski hill with, as Prince remembers, "two rickety old lifts." "It was a horrible business venture," he told the Park Record, "but it was a fun place to learn to ski."
At Christmas in 1980 his grandmother gave him an Apple II Plus. For years he said he was seven; his mother later corrected him — he was six. The University of Utah had a serious computer science department, and his mother enrolled in continuing-education courses there and brought the boy along. "She'd pretend to do the work," he told Ben Thompson, "but I'd really do all the homework." It is the first instance in his biography of a pattern that will recur: an institution's front door used, with some creativity, to let in someone the rules did not anticipate.
His first commercial venture, by his own telling, was selling illegal fireworks around the fourth grade. He did debate, a little theater. His graduating class, he told the New York Times, had about sixty people. On weekends he worked as an assistant ski instructor, and later he would list "certified ski instructor" and "former mountain guide" in his official bios, alongside the law degree and the Harvard MBA, as if they carried equal weight. To him they may have.
The day he really fell in love with skiing, he recalled, he was coming down a run called Hidden Splendor. "Skiing represents freedom, as a kid."
The Lawyer Who Practiced for One Day
He went east to Trinity College in Hartford, Connecticut, to study computer science and, as he put it, with "the hubris of an 18-year-old" walked into an introductory programming course that he found he did not need. He majored in English literature instead and minored in computer science. He became editor-in-chief of the student paper, The Trinity Tripod, and as a freshman co-created an online-only magazine, The Trincoll Journal, at a moment when "online-only" was closer to performance art than business plan. (The internet's own record of him has never quite settled where this happened; the World Economic Forum's biography places him at "Trinity College, Dublin," and several bios award him the "Dubliner Prize for Entrepreneurship" — the prize is the Dubilier. The man is forever being relocated to Ireland.)
He graduated in 1996, into the first great internet boom, and turned down offers from Microsoft, Yahoo, and Netscape to go to the University of Chicago Law School. Nearly three decades later, a billionaire, he would tell Business Insider that this was the thing he wished he had done differently: "The camaraderie and the rolodex and the interesting people that you will meet in that, is just such a huge accelerant to your career." He applied to Stanford, he once told David Rubenstein, five times, summer camp included, and was rejected five times. Stanford was later a small early investor in Cloudflare.
He summered at Latham & Watkins. He accepted a law-firm job. And then — the bios split here — he worked as an attorney for one day, or for none, before leaving for a Chicago startup run by the brother of a law professor. The University of Chicago, in a 2013 alumni profile, put the number of full days he had worked as a paid attorney at "none," and seemed delighted about it.
What law school gave him was not a profession but a habit of mind: the conviction, as he put it, that "it's very important to be unafraid of the law, to know what threats and potential legal challenges are baseless." And a particular irritation. In 2000, annoyed by email spam, he registered the domain unspam.com.
The story of what came next is the most improbable stretch of his life and the one he tells with the most relish. He began teaching cyberlaw as an adjunct at John Marshall Law School in Chicago. When Congress passed the CAN-SPAM Act in 2003, he co-wrote a law review article with Patrick Shea arguing that states could still protect children through a do-not-contact registry. He took the idea further — patented technology for registries that could keep registrants' email addresses secret while letting marketers scrub their lists — and pitched it at a Federal Trade Commission hearing. There a professor named Arthur Keller stood up and told him that he had already built essentially the same technical system. Prince did what any sensible entrepreneur would do with a competitor who had beaten him to the code: he hired one of Keller's students. The student was Lee Holloway.
Holloway moved to Utah. They worked out of a basement. Prince helped pass child-protection registry legislation in Utah, an anti-spammer who had turned state legislatures into a sales channel. The company, Unspam Technologies, made, by his own accounting, "all the possible start-up mistakes." He had started it with two close friends; they were "too similar and would have epic fights." They raised money from family and friends — "a colossal mistake." The pornography industry, whose emails the registries were designed to block, sued. The suit took three years to resolve. Unspam won. Prince did not speak to one of his co-founders for two years.
Project Honey Pot began as something to say. Paul Graham, not yet the Y Combinator patriarch, organized a spam conference, and Prince had been invited to speak about law and spam — a topic he had already covered elsewhere. "I'm a former lawyer," he told the Irish Times. "I created Project Honeypot to have something to talk about at the conference." With Holloway he built a system that let anyone with a website plant trap email addresses and record which bots came to harvest them. It was free, distributed, faintly subversive, and it grew without anyone pushing it: thousands of websites, from more than 185 countries, each one a sensor.
It is worth pausing on the shape of that thing, because Cloudflare is that thing, scaled. A network that gets smarter with every participant. A free tier that is not charity but instrumentation. A neighborhood watch. A pile of data whose value its creators did not understand until somebody from the government called.
Multiply It by Ten
The lawsuit pushed him back to school. His lawyer advised that he couldn't work at Unspam while it was pending; get an MBA, the lawyer suggested. Prince took a sabbatical and enrolled at Harvard Business School in 2007. The plan, he told the Irish Times, had been to finish and take over his dad's chain — the restaurants. "The hardest thing for entrepreneurs," he said, "is justifying what they do to their family."
Then the Department of Homeland Security called.
The version he told the BBC is the best one, because it is so unglamorous. The government wanted the Honey Pot data. "They said 'do you have any idea how valuable the data you have is? Is there any way you would sell us that data?'" Prince, a Harvard MBA candidate presumably fluent in discounted cash flows, did something rather more Park City. "I added up the cost of running it, multiplied it by ten, and said 'how about $20,000?' It felt like a lot of money. That cheque showed up so fast."
He told the story to a classmate. Michelle Zatlyn listened, and said the thing that turned an anecdote into a company: "if they'll pay for it, other people will pay for it." Users of Honey Pot had long been asking for the next step — not just track the bad guys, stop them. Zatlyn, by Prince's account, insisted they build the defensive service. Where Prince had been a collector, she was a closer. She would go on to sit on the Federal Communications Commission's Open Internet Advisory Committee, become Cloudflare's president in 2020, and serve as its co-chair; but in the spring of 2009 she was the person who saw a business in a check that had arrived suspiciously fast.
Three founders, three rhyming biographies. Prince, the ski-town kid who drifted through English and law and kept finding his way back to the network. Holloway, the young engineer pulled out of a professor's lab after a hearing at the FTC, who built the first Cloudflare prototype in his spare time from California — and whose later decline Wired would chronicle under the headline "The Devastating Decline of a Brilliant Young Coder," and whom the company's IPO filing would pause, a decade on, to thank as a third co-founder. Zatlyn, the classmate who heard a story at business school and asked the only question that mattered.
The first business plan was called "Project Web Wall." A friend of Prince's said they were building a "firewall in the cloud," and the name compressed itself into Cloudflare, which Prince has spent fifteen years conceding is hard to say. "The original name of Cloudflare was the only thing worse than Cloudflare," he told WIRED. In April 2009 the plan won Harvard's business plan competition and the Dubilier Prize — $50,000. Prince graduated a George F. Baker Scholar, the top tier of his class, and he and Zatlyn drove west.
In November 2009 they closed a Series A with Ray Rothrock of Venrock and Carl Ledbetter of Pelion. They took an office in Palo Alto above a nail salon; there were eight of them. Investors had one consistent worry: put a security layer between a website and its visitors and you add latency. The team became obsessive about stamping it out. In June 2010 they opened a private beta to members of the Honey Pot community and held their breath. The users wrote back that their sites were loading, on average, 30 percent faster. By filtering the garbage, caching the static, and sitting closer to visitors, the firewall had accidentally become an accelerator.
Cloudflare launched publicly on September 27, 2010, at TechCrunch Disrupt. A judge asked what the vision was. "Our vision," Prince answered, "is to run the internet." He has since described the moment, with a certain self-awareness, as a mic drop. Nobody in the audience took it literally. That was the point.
It's Absurd to Pay for Math
The founders' letter that accompanied Cloudflare's IPO in 2019 contains a sentence few companies could write honestly: "Many great startups pivot over time. We have not."
The plan, from the start, was to replace hardware. Firewalls, load balancers, network optimizers — the beige boxes that companies bought, racked, and depreciated — would become services, the way software had become SaaS and servers had become instances. That premise determined almost everything else, including the strange economics that made Cloudflare look, for years, like a charity with a sales team.
If you are competing with a box, you cannot charge like a utility. "In the on-premise hardware world," the founders wrote, "when you suffered more cyber attacks you didn't pay your firewall vendor more, and when you suffered fewer you didn't pay them less." So Cloudflare would not charge for bandwidth. Prince explained it in a 2014 Reddit AMA with characteristic directness: "People hate their cell phone providers because their bills are unpredictable. We don't want to be thought of like a cell phone provider." The deeper reason was the Honey Pot logic: "we get smarter about stopping threats with every request that routes through our network. If we charged for bandwidth then it would cause customers to potentially avoid routing traffic through us. That goes against the core value that we provide: effectively a neighborhood watch for the Internet."
The free tier followed from the same reasoning. Every free website was a sensor. Every attack on a hobbyist blog taught the network something that protected a bank. "Like an Internet-wide immune system," the founders called it. The cost discipline this required was severe — "Efficiency is in the DNA of Cloudflare because it had to be" — and it produced an architecture that is, in hindsight, the company's real moat: commodity hardware, a single server configuration deployed everywhere, every machine in every city able to run every service, paying customers routed through the best locations and free ones served from wherever there was spare capacity. Later, the servers shipped with two empty PCI slots. Years afterward, those slots filled with GPUs.
In 2014 Cloudflare made encryption free for every customer. It was, at the time, the most important thing they charged for. "We, in 2014, we made encryption free because it's absurd to pay for math," Prince told Corey Quinn. Lightspeed's account is that free SSL multiplied the customer base by ten.
There is a performative streak in all this, and Prince knows it. Every year, around September 27, Cloudflare holds a Birthday Week and releases products it describes as "our gift back to the Internet." Every April 1 it launches something for the general public, a tradition that produced, in 2018, a free DNS resolver at the address 1.1.1.1 — announced on April Fools' Day, with a blog post titled "Introducing DNS Resolver, 1.1.1.1 (not a joke)." The address had never been reserved, but routers and companies had been squatting on it for years for test pages and login screens, and the moment Cloudflare switched it on, gigabits per second of other people's garbage came pouring in. Cloudflare published a post called, a little wearily, "Fixing reachability to 1.1.1.1, GLOBALLY!"
The posture toward the hyperscalers became openly combative. In 2023, on the company's thirteenth birthday, Prince and Zatlyn rebranded Cloudflare as a "connectivity cloud" and named the alternative: "They optimize for hoarding your data. Locking it in. Making it difficult to move. They are captivity clouds." At a Fortune conference that December Prince claimed that "AWS, for example, marks up their transport costs 4,000 times what their underlying costs are," and added, to a room full of executives experimenting with generative AI, that most of them were "lighting money on fire."
Inside, he built a deliberate counterweight to his own discipline. "To operate an effective navy, you also need pirates," he told Lightspeed. Customer-driven R&D, he reasoned, will always be innovative and never disruptive, so he created an Emerging Technology and Incubation group, gave it 10 percent of the R&D budget, and put it 1,500 miles from headquarters. It began as one person, dispatched to Austin to open an office. Austin is now the company's largest.
A Website Is Speech. It Is Not a Bomb.
A network that lets anyone in eventually lets in everyone.
In June 2011, Cloudflare got its first real burst of attention because LulzSec, a hacking crew then on a public rampage, used it to stay online. Prince's AMA bio, three years later, listed customers in a deadpan row: "Fortune500 companies, Imgur, Wikileaks, the United States Government, the Internal Revenue Service of Pakistan, Lulzsec.... and millions more."
In 2013 a journalist at a British tech site called The Kernel questioned Cloudflare's service to Kavkaz Center, a Chechen separatist news site. Prince answered in a blog post with the sentence that would follow him for the rest of his career: "A website is speech. It is not a bomb. There is no imminent danger it creates and no provider has an affirmative obligation to monitor and make determinations about the theoretically harmful nature of speech a site may contain." In 2015, when Anonymous accused the company of protecting ISIS forums, he reached for plumbing. "We're the plumbers of the internet. We make the pipes work but it's not right for us to inspect what is or isn't going through the pipes."
The neutrality was not merely rhetorical; it had been tested where it cost something. When Cloudflare was a thirty-person company, it received a National Security Letter demanding customer records under a gag order. With the EFF representing it, the company sued the federal government, under seal, for years. "We could not have done that without the EFF support," Prince said later. In 2013, under the EFF's guidance, Cloudflare published a transparency report with a list of things it had never done, including that it had never taken down content due to political pressure.
That same year, a deal worth tens of millions of dollars was ready to be signed when the counterparty added a condition: fire one customer. It was a nonprofit the EFF had referred. Prince took it to the board. "We're playing this for the long term," the board said, as he recounted it. "We can't put ourselves in a position where any one organization can dictate who can and cannot use our service." Cloudflare walked away. He never named either party. "It'll be great for the book someday," he said.
The free tier, he discovered, had a moral side effect he had not designed. Every morning he got a list of free customers kicked off the network the night before, usually because they had come under attacks too large to absorb for nothing. One morning he looked down the list and recognized something. "It turned out it was a largest independent newspaper in Ukraine, covering the conflict in Crimea, almost certainly came under attack by either Russian sympathizers or the Russian government itself, and it got knocked offline. We've got some 20-year-old SRE on our team who has to make a decision of, is this politically important or not." His conclusion was institutional, not heroic: "We can't require everyone on our technical operations team to have a political science degree."
So he outsourced judgment. Project Galileo, launched in 2014, convened a committee of civil society groups — the EFF, the ACLU, the Center for Democracy and Technology, the Committee to Protect Journalists, eventually more than a hundred, deliberately recruited across the political spectrum. If any one of them vouched for an at-risk nonprofit or journalist, Cloudflare gave it full enterprise protection, free. The rule was asymmetric by design: one yes was enough to protect, and the committee was never asked to condemn. Prince tells the story of three African journalists who visited the office — one from Angola, one from Ethiopia, and a third who would not say where he was from because, Prince said, he was being hunted by death squads. One of them, with tears in his eyes, hugged him.
The other side of the ledger arrived in his own house. On June 1, 2012, a group called UGNazi bought his Social Security number for a few dollars, talked AT&T into forwarding his phone, intercepted the two-factor code for his personal Gmail — the backup for his corporate account — and used it to redirect 4chan through Cloudflare's systems to their Twitter account. "He was in my personal Gmail account for a while," Prince told the BBC. "He posted some stuff that was very personal and deeply embarrassing to me." Within a day Cloudflare had identified three members of the group. They were Cloudflare customers. In 2014, someone spoofed his number and called 911 to report a man with a gun in his house; a SWAT team searched every closet in the middle of the night. "It's something I have in common with Justin Timberlake," he said. He changed his number and moved.
Run a neighborhood watch for the whole internet and the whole internet learns your address.
Chief Coin Flipper
Which brings us back to August, and the bad mood, and the more complicated story under the confession.
The memo made it sound like a whim. The weeks around it suggest something else. "The pressure to take it down just kept building and building," Prince told Ars Technica that December. Customers were threatening to leave. "We reached out to various civil libertarian organizations and said we need some air cover here. People said 'we'd rather not stick our necks out on this issue.'" A CEO "whom I admire" had tweeted that Cloudflare should drop the site; Prince called him and found the argument "thoughtful, rational." And in September, on the company's rooftop in San Francisco, he told CNBC the part a memo would never include: Cloudflare wanted to be internally ready for an IPO by July 2018. "We were worried that people would say, 'We won't work with you anymore.' We had to have the conversation now because at some point we'll be a public company." Then: "We were stuck. We had this problem, [and] were very alone."
On Kara Swisher's podcast, sitting next to Cindy Cohn of the EFF — who had publicly opposed his decision while acknowledging the EFF had represented Cloudflare in its secret fight against the government — he quoted the former Oklahoma congressman J.C. Watts: "When you're explaining, you're losing." Every reporter who called would either write that Cloudflare supported Nazis or, persuaded, write nothing at all. The only way to have the argument he wanted was to remove the thing that made it impossible to have. "I am confident we made the right decision in the short term because we needed to have this conversation," he said. "It is the wrong decision in the long term."
He reached, as he would again and again, for the old phone company: "If you imagine that Ma Bell is listening in on your phone calls and decides at some point you're talking about something that doesn't serve either their political, moral or economic interests, and they unplug you from the phone network, that doesn't feel right." He described himself as "the son of a journalist" who believed deeply in free speech — "that's what we talked about around the dinner table" — and then, crucially, conceded that free speech was an American idea that "doesn't have the same force around the rest of the world." What does travel, he argued, is due process. "We didn't follow principles of due process in this case."
Swisher pressed: would he promise never to act unilaterally again? "No," he said. "That is why the board of CloudFlare appoints me... There is a point at which my job is chief coin flipper. Where really hard decisions come up to us and the team says, 'We don't know if the answer is A or B,' and somebody's got to make that call."
He also did something few executives do in public: he refused the easy exit. Some people inside Cloudflare, he said, argued they had dropped the Stormer for harassing staff and abusing the abuse process, not for its speech. "I totally reserve the right to not do business with jerks. I will say, though, I think that that's... I don't totally believe that argument. Had this been a blog about cute kittens, we would have cut them more slack."
The slippery slope he had predicted turned out to be, inconveniently, real. By early 2018 Cloudflare had received more than 7,000 takedown requests citing the Daily Stormer case. "It spanned the political spectrum," he told Newsweek. Neo-Nazi sites, far-left sites, and a cooking blog someone found incredibly offensive. "We looked at it and it's just a cooking blog... our internal theory is that the recipes are just so terrible." Then the line that a lawyer might frame: "I'm skeptical of slippery slope arguments but every once in a while they're really true."
That December he made a tour of Washington — the FCC, the Cato Institute, New America — trying to build what Ars called the "political cover" to say no next time. "I'm almost a free-speech absolutist," he said, the qualifier doing a lot of work.
Next time came anyway. In April 2018, days after FOSTA/SESTA weakened protections for infrastructure providers, Cloudflare dropped Switter, a Mastodon-based social network for sex workers, saying the move was "related to our attempts to understand FOSTA, which is a very bad law." On August 3, 2019, after a gunman in El Paso posted his manifesto to 8chan, Prince told the Guardian he felt a "moral obligation" to keep the site online. Two days later Cloudflare terminated it, writing that 8chan's operators "have proven themselves to be lawless and that lawlessness has caused multiple tragic deaths." At WIRED25 that November he described the shift: infrastructure should not be the first line of defense, but "maybe we need to in rare circumstances, be the last line of defense."
Ten days after the 8chan termination, on August 15, 2019, Cloudflare filed its S-1. It began trading on September 13 at $15 a share, with a dual-class structure that kept control with the founders. The coin flipper had secured his job.
In late August 2022, after a campaign led by the Twitch streamer and activist Clara Sorrenti, whom Kiwi Farms users had targeted, Cloudflare published a long post on its abuse policies, likening itself to a utility and declining to act. On September 3 it blocked Kiwi Farms anyway, citing "an unprecedented emergency and immediate threat to human life." Prince's explanation contained, again, an implicit indictment of the system he worked within: "the pace at which law enforcement is able to respond to those threats we don't think is fast enough to keep up."
And when Ukraine's vice prime minister asked Cloudflare in March 2022 to leave Russia, Prince refused, in terms that made the old principle newly useful: "Indiscriminately terminating service would do little to harm the Russian government but would both limit [Russian citizens'] access to information outside the country and make significantly more vulnerable those who have used us to shield themselves as they have criticized the government." The Russian government later sanctioned him personally.
Three terminations in five years, each announced with something like grief, each framed as an exception. You can read this as hypocrisy or as a man discovering, one crisis at a time, that a principle with no exceptions is a principle nobody can live inside. Prince's own answer, characteristically, was to publish the reasoning and let people decide.
Planes That Can't Land
Neutrality is a luxury of the invisible. The bigger Cloudflare got, the less invisible it could be.
From September 2016 to February 2017, a parser bug later nicknamed Cloudbleed caused Cloudflare's servers to spill fragments of memory — passwords, authentication tokens — into responses served to strangers. On April 1, 2020, the company launched 1.1.1.1 for Families, a filtered resolver, and within hours LGBTQIA+ sites were being blocked by the adult-content filter. Prince's post that evening began: "Today we made a mistake." The cause was banal — of two "Adult Content" categories in a licensed data feed, engineers had shipped the broader one — and Prince walked through it with the specificity of a postmortem, adding, in passing, that he personally blocks social media at the DNS level when he is trying to get work done.
The mistakes grew with the footprint. "If we go offline, there are planes that can't land," he told Lightspeed in 2023. "If we have a breach, the White House will call." On November 18, 2025, a change to a database configuration caused an invalid file to propagate to every server on the network. For hours, X, ChatGPT, Spotify, Uber, IKEA, Canva, League of Legends, and the outage-tracking site Downdetector returned errors. Cloudflare's CTO wrote, "we failed our customers and the broader internet." Seventeen days later, on December 5, it happened again.
The same month, Cloudflare absorbed a 31.4-terabit-per-second attack from a botnet it called "The Night Before Christmas," the largest ever recorded. The company that could withstand anything the internet threw at it had twice been taken down by itself. There is a version of the Daily Stormer argument buried in that — the danger of a single point of control — that nobody needed Prince to make out loud.
Eighteen Pages for One Visitor
When publishers first came to him worried about artificial intelligence, Prince did not believe them.
"I remember — distinctly — rolling my eyes and thinking, 'God, media companies. They're such Luddites. They're always complaining about the next technology,'" he told City AM. His first guess, when they said they had a new threat, was North Korea, or Iran. No, they said. AI. A customer finally told him: just pull the data.
Cloudflare had ten years of it. A decade ago, he found, Google's crawler copied two pages for every visitor it sent back to a publisher. By 2025 the ratio was eighteen to one. "What's changed? [Google] AI Overviews." For OpenAI, it was 1,500 pages for every visitor. For Anthropic, 40,000. By March 2026, on stage at South by Southwest, the numbers had moved again: fifty times harder to get traffic from Google than a decade earlier, 3,500 times harder from OpenAI, 65,000 times harder from Anthropic. "Google is the hero of the last 30 years of the internet," he said there. "They financed the entire thing. The problem is that AI breaks that."
The son of a journalist had discovered, with the force of a convert, that the business model underwriting journalism was dissolving — and that his network was the only place with a clear view of the dissolution. His diagnosis was not nostalgic. "The problem with traffic," he told Digiday, "is that the best way to get traffic is to appeal to humans' worst instincts — you know, fear, greed, lust. I don't think that made humanity better, I think it made it worse."
On July 1, 2025, Cloudflare began blocking AI crawlers by default for new customers and offered a mechanism called pay-per-crawl, by which AI companies could pay for access. "The AI companies are a piece of cake in terms of blocking," he said on Masters of Scale, compared with the Russian, Iranian, North Korean, and Chinese hackers Cloudflare fights every day. He has since argued for something like a Spotify for knowledge — compensation by scale and usage — and cites a detail he clearly loves: Reddit, he says, was paid seven times more than the New York Times for the same number of tokens in AI licensing deals, because original, quirky, local content is scarcer than commodity news. In January 2026 Cloudflare bought Human Native, an AI data marketplace. He gave a TED talk that April. He has predicted, with something close to glee, a golden age of content.
There is an irony here he has acknowledged only obliquely. In February 2015, the day the FCC voted to classify broadband providers as utilities, Prince wrote that "it's a miracle that the Internet has been as neutral as it has for as long as it has," because "throughout history, owners of networks — be they shipping channels, country clubs, Ivy League colleges, banks, roads, or actual telecommunications networks — have profited by charging tolls to access those networks." The plumber who once said it was not his place to inspect the pipes was now building a tollbooth in them — on behalf, he would say, of the people whose water was being drained. Ben Thompson pressed him on exactly this: was this a legitimate use of Cloudflare's power? Prince believed it was.
Inside the company, the same technology was rewriting the org chart. In May 2026, Cloudflare reported record quarterly revenue of $639.8 million, up 34 percent, and in the same announcement eliminated about 1,100 jobs, roughly 20 percent of its workforce. Prince said the roles had been made obsolete by AI, not cut for performance, and predicted the company would employ more people by the end of 2027 than at any point in 2026. In a Wall Street Journal op-ed he explained his reasoning through a book he said he had gone back to, "published in 1954, 20 years before I was born": Peter Drucker's The Practice of Management. Companies, he wrote, contain builders, sellers, and measurers. "AI isn't coming for builders or sellers, but it is coming for measurers." Henry Farrell, the political scientist, replied that Prince had misread Drucker, whose measurement was meant to empower managers' judgment, not to replace it. An operator who had built a crawler — he called it "the Canary" — to detect the moment a public-company CEO said plainly that he was laying people off because of AI wrote that the light had come on. Prince had, again, said the quiet part in writing. "When you're explaining, you're losing," but he kept explaining.
Bots, by his count, now outnumber humans online. "Welp, that happened faster than I predicted," he posted.
The Paper's Not Going Anywhere
He went home.
In March 2023, Matthew and Tatiana Prince bought the Park Record, a weekly founded in 1880, from Ogden Newspapers of West Virginia, returning it to local ownership for the first time since 2005. Tatiana grew up in Boston, double-majored in economics and music at Wellesley, went into investment banking, and first skied Park City at ten or eleven, visiting an aunt she describes as "a hippie ski bum" who had moved to Midway in the 1960s and built her house with her own hands. When the couple lived in San Francisco, she said, their friends sat seven hours in Tahoe traffic while they flew to Utah. "The paper's not going anywhere now," the headline in their own paper quoted them as saying. "I forever would get The Park Record and open it up and would know what was going on," Prince told its editors, "and be able to be a better participant in the community, a better citizen." That Christmas they made the paper free. They have talked of converting it to a nonprofit or public benefit corporation and adding Spanish-language coverage. The journalist's son now owns a newspaper and has stopped charging for it.
He also wanted to build a house.
In October 2022, his representatives asked Park City planners for permission to tear down a house and guest house he owned on King Road, in the historic Old Town district, and build a mansion with a pool and a parking garage in their place, near Treasure Hill — open space the town's taxpayers had bought for $64 million in 2019. In March 2023, language appeared in a bill in the Utah Senate that would have let him tear down the houses without the planning commission's involvement; the same day, he hired a lobbyist. The bill failed in the House. Mayor Nann Worel issued a statement about "special treatment of one resident over the community." The man who had written that no one should be able to bypass due process because he woke up in a bad mood had tried, briefly, to bypass the planning commission. He went back through the process.
At an appeal hearing that dragged on for six hours, almost until midnight, Prince stood and introduced himself. "I'm Matthew Prince. I — as has been reported — hate dogs. I also hate rainbows and kittens and long walks on the beach. But I did grow up in Park City." Nobody laughed. "That was supposed to be a joke, by the way," he said, smiling tiredly, "but it's 9 o'clock at night so nobody laughed." Tatiana, pregnant, sat in the front row.
He also bought Town Lift Plaza, in the middle of Old Town, and talks about how to help it thrive. He has spent months of recent years in Lisbon. He is the richest person in Utah, and he is, in the town where his family built the ski lodges and the hotel and the hill with two rickety lifts, a landowner of the kind he once marveled at back east — the kind whose plots, as he put it, were owned by someone.
In April 2024, he wrote a column for his newspaper. It begins in the spring of 1981, the year after the Apple II arrived.
"My dad loaded me into a snowcat at the base of some mountains about a mile from where we lived. We rumbled up freshly cut paths through the aspens and pines. This was Deer Valley before there were lifts. I remember skiing Nabob and Solid Muldoon and thinking both were funny names for ski runs. I still think they are, more than 43 years later."
A six-year-old in the cab of a snowcat, climbing through trees on a road someone had just cut, toward runs that had names but no lifts and no tickets — a mountain not yet anybody's to charge for.
Part IIThe Playbook
What follows are twelve principles drawn from Prince's career — less a philosophy than a set of habits, some admirable and some cautionary, that explain how a lawyer who barely practiced and a coder who once built a spam trap for a conference talk ended up operating a fifth of the web. They are grounded in what he did, which is not always what he said.
The principles
- 1.Build the side project that becomes the sensor network.
- 2.Price the way your customers wish they could pay.
- 3.Give away whatever makes the network smarter.
- 4.Make every machine able to do everything.
- 5.Fund pirates, far from the navy.
- 6.Write the hard call down in public.
- 7.Outsource legitimacy before you need it.
- 8.When you break your rule, call it a break.
- 9.Let the board put a price on principle.
- 10.Distinguish your layer from everyone else's.
- 11.Pull the data on your own skepticism.
- 12.Rehearse being public before you are.
Principle 1
Build the side project that becomes the sensor network
Project Honey Pot was not a startup. It was, by Prince's own admission, a reason to have something new to say at Paul Graham's spam conference. It was free, open source, and owned by no one in particular, which is precisely why thousands of webmasters in more than 185 countries planted its traps. What it produced was not revenue but a dataset — one so valuable that the Department of Homeland Security wrote a $20,000 check for it faster than Prince expected.
The lesson is not "start a side project." It is that distributed, voluntary participation generates a kind of asset — a live map of hostile behavior — that no single company could build by itself and that nobody notices until it is already large. Cloudflare is Honey Pot with a business model attached: every site is a sensor, and every attack on one becomes protection for all. Prince's own description, years later, was still the language of the trap: "a neighborhood watch for the Internet."
Tactic: Identify a problem where each new participant improves the system for every other participant, and build the free, open version first — then wait for someone to ask what the data is worth.
Principle 2
Price the way your customers wish they could pay
The most consequential pricing decision in Cloudflare's history was a refusal. Because the company was replacing hardware, it argued, it could not bill like a utility: "when you suffered more cyber attacks you didn't pay your firewall vendor more." Prince's shorthand was blunter — "We don't want to be thought of like a cell phone provider."
The refusal was not generosity. It was strategy dressed as empathy. Usage-based billing would have taxed exactly the behavior the network needed — routing more traffic through Cloudflare — and so the price structure protected the data flywheel. It also forced a discipline that became a competitive weapon: if you will not pass costs along, you must drive them toward zero. The company's fight with hyperscaler egress fees, and Prince's claim that AWS marks transport up "4,000 times," is the same principle turned outward.
$
Conventional Pricing vs. Cloudflare's Choices
Each departure served the same goal: more traffic through the network.
| Convention | Cloudflare's move | Effect |
|---|---|---|
| Bill for bandwidth consumed | Flat subscriptions; no bandwidth charges | Scale Customers route everything |
| Charge a premium for SSL | Free encryption for all, 2014 | Scale Customer base grew roughly tenfold |
| Free tier as loss leader | Free tier as sensor network | Scan Every attack trains the system |
| Lock data in with egress fees | Attack egress as a captivity cloud tax | Try Positions against hyperscalers |
| Let crawlers take content freely | Block AI crawlers by default; pay-per-crawl | Risk Cloudflare becomes a toll collector |
Tactic: Write down the bill your customer secretly wants to receive, then ask whether your cost structure can be engineered to make that bill profitable.
Principle 3
Give away whatever makes the network smarter
In 2014 Cloudflare made SSL free — "absurd to pay for math," Prince said — and in doing so eliminated the feature that had been driving its paid upgrades. In 2018 it launched a free public DNS resolver. In 2023 it promised post-quantum cryptography free, forever. Project Galileo gives enterprise-grade protection worth, Prince estimated, "hundreds of thousands or millions of dollars" to small nonprofits and journalists at no cost.
The pattern is consistent: Cloudflare gives away things that are either becoming commodities anyway or that increase the volume and diversity of traffic it can see. Prince named the hidden payoff in a 20VC interview: launching a free version without targeting anyone in particular "let civil society organizations with huge security risks but tiny budgets find us." The free tier turned out to be a reputation engine as well as a data engine — it is why the most hunted websites in the world used Cloudflare, and why the company had credibility when it argued for neutrality.
Tactic: Before you charge for something, ask whether it is about to become a commodity — and if it is, give it away first and capture the traffic it brings.
Principle 4
Make every machine able to do everything
Cloudflare's founders described a requirement that sounds mundane and turned out to be foundational: the platform "needed to be architected so any server in any city that made up Cloudflare's network could run every one of our services." One server configuration, everywhere, on commodity hardware. Lightspeed's account adds the detail that the servers were built with two empty PCI slots for future expansion; those slots were later filled with GPUs for AI inference.
Uniformity is what made the economics work — paying customers routed to the best locations, free customers to wherever there was slack — and it is what let the company ship new products to every city at once. It is also, as the outages of November and December 2025 demonstrated, what allows a single bad file to reach every machine simultaneously. The design that made Cloudflare cheap and fast made its failures global. That is the trade, and Prince has never pretended otherwise.
Tactic: Standardize your infrastructure so any node can run any service, and invest proportionately in the safeguards that keep one bad change from reaching all of them at once.
Prince's metaphor is better than most management literature on the subject: "The navy should get 90 percent of your R&D spend. It should get marketing resources, sales resources, and have a certain amount of discipline and structure. But pirates should be allowed to be pirates." His reasoning was that customer-driven engineering can be innovative but rarely disruptive, because customers ask for what they already understand.
What matters is the distance. Cloudflare's Emerging Technology and Incubation team began as one person sent 1,500 miles away to open an office in Austin, with a fixed 10 percent of R&D. Physical separation protected the pirates from the gravitational pull of the quarterly roadmap. Austin is now the company's largest office — which suggests the pirates eventually became part of the navy, as successful pirates do.
Tactic: Carve out a fixed slice of your R&D budget for a team that lives far enough from headquarters that it cannot be pulled into this quarter's customer requests.
Principle 6
Write the hard call down in public
Cloudflare's blog is not a marketing channel so much as a public docket. The Daily Stormer memo, the Kiwi Farms posts, "Terminating Service for 8Chan," the 1.1.1.1 for Families apology that began "Today we made a mistake," the detailed postmortem published within a day of the November 2025 outage — each exposes reasoning most companies would bury under "a violation of our terms of service. No comment."
Prince's argument for this, made at WIRED25, is that the tech industry would command more trust if it said, "Actually guys, this are really hard calls because, here's the consequence." The practice has a sharper strategic edge than that: by publishing first and in detail, Cloudflare frames the story before critics can. It also creates a record that binds future behavior — which is precisely the point. The same instinct produced his 2026 op-ed explaining AI-driven layoffs in plain terms, which critics saw as permission-granting for every other CEO. Transparency is not neutral; it sets norms.
Tactic: For every consequential decision, publish the reasoning — including what you were unsure of — within a day, before someone else writes the first draft for you.
Principle 7
Outsource legitimacy before you need it
The cleverest thing about Project Galileo is not the free protection. It is the committee. Faced with a 20-year-old site reliability engineer deciding whether a Ukrainian newspaper was politically important, Prince removed the decision from the company entirely and handed it to more than a hundred outside organizations spanning the political spectrum, with a rule that any single one of them could vouch for a site.
The same logic drove the 2013 transparency report's list of things Cloudflare had "never" done, and his December 2017 tour of the FCC, Cato, and New America to build what Ars called political cover for future refusals. Prince understood that a principle held by one company is a target, while a principle endorsed by institutions is a shield. His frustration in August 2017 — civil libertarian groups saying "we'd rather not stick our necks out" — is the evidence that he had not built enough of it before the crisis arrived.
Tactic: Identify the decisions your company is least legitimate to make alone, and recruit outside bodies to make or endorse them before the first emergency forces your hand.
Principle 8
When you break your rule, call it a break
Every company eventually violates its own stated principles. Most rewrite the principle afterward or claim the violation was consistent with it. Prince did neither. He wrote "Let me be clear: this was an arbitrary decision," refused his own staff's convenient rationale that the Stormer was dropped for harassment rather than speech — "I don't totally believe that argument" — and admitted that a cat blog would have gotten more slack.
This candor cost him something; the 7,000 subsequent takedown requests were partly a consequence of naming the precedent so vividly. But it preserved the rule. By labeling the act an exception, he kept neutrality as the default and forced every later termination — 8chan, Kiwi Farms — to clear an explicitly higher bar: lawlessness causing deaths, an imminent threat to life.
⚖
The Exceptions Ledger
Each departure from content neutrality was framed as an exception against a stated default.
2013
Defends serving Kavkaz Center: "A website is speech. It is not a bomb."
2013
Walks away from a deal worth tens of millions rather than drop a Galileo customer.
2015
Rejects calls to drop ISIS-linked sites: "We're the plumbers of the internet."
2017
Terminates the Daily Stormer; calls the decision "arbitrary" and "dangerous."
2018
Drops Switter after FOSTA, calling the law "a very bad law."
2019
Terminates 8chan two days after defending it, citing lawlessness causing deaths.
2022
Refuses to exit Russia; blocks Kiwi Farms citing an "immediate threat to human life."
Tactic: When you depart from a stated principle, say plainly that you are departing from it and why, so the principle survives the exception.
Principle 9
Let the board put a price on principle
In 2013, a deal worth tens of millions of dollars — "a lot of money still to us," Prince said — came with a condition: fire a Project Galileo customer the EFF had referred. Rather than decide alone, Prince took it to the board, which concluded: "We can't put ourselves in a position where any one organization can dictate who can and cannot use our service."
Two things are worth noting. First, Prince escalated a values question to governance rather than treating it as a CEO's prerogative — the inverse of the Daily Stormer morning, and a far more defensible procedure. Second, the board's reasoning was commercial as much as moral: a network whose customer list can be dictated by its largest buyer is a less valuable network. Principle, in this telling, was a long-term asset with a short-term price, and the board was the right body to decide whether to pay it.
Tactic: When a lucrative deal requires abandoning a commitment, put the trade-off to your board in explicit dollar terms and let them own the decision on the record.
Principle 10
Distinguish your layer from everyone else's
Prince's most durable intellectual contribution to the content-moderation debate is not neutrality; it is the idea that the answer depends on where you sit in the stack. "Just because a Facebook or a Twitter is making editorial determinations on what can and cannot use their platform, I'm not sure that a Level 3 or an AT&T or a CloudFlare should be doing that." Registrars make all-or-nothing global decisions; platforms can remove a single post. Infrastructure, he argued by 2019, should never be the first line of defense and only rarely the last.
The framework did practical work. It let Cloudflare explain why it would remain in Russia while dropping 8chan, and why a decision that might be appropriate for a social network would be dangerous for a DNS provider. It also gave him a vocabulary for regulators: comply with local law, keep the effects inside the borders of the jurisdiction that demands them. Positioning yourself precisely in a system is a way of defining which arguments apply to you.
Tactic: Map exactly which layer of your industry you occupy and articulate the responsibilities appropriate to that layer, so you are not judged by the standards of the layer above or below.
Principle 11
Pull the data on your own skepticism
Prince's first reaction to publishers worried about AI was contempt: "God, media companies. They're such Luddites." What changed his mind was not argument but data — a customer told him to look, and Cloudflare had a decade of crawl-to-referral ratios. Two-to-one for Google a decade earlier became eighteen-to-one; OpenAI was 1,500 to one; Anthropic, 40,000.
The principle is less about AI than about the asymmetry between opinion and instrumentation. Prince runs a company whose entire value is its view of internet traffic, and he still dismissed a structural shift until a customer forced him to query his own systems. Having looked, he reoriented the company — default blocking, pay-per-crawl, a data marketplace acquisition — within months. The willingness to be embarrassed by your own numbers is the precondition of acting on them.
Tactic: When a customer raises a concern you instinctively dismiss, assign someone to pull the relevant data from your own systems before you reply.
Principle 12
Rehearse being public before you are
Prince has described holding mock earnings calls before the IPO, practicing how to take hard questions. The Daily Stormer timing fits the same instinct. "We had to have the conversation now because at some point we'll be a public company," he told CNBC in 2017, with a target to be internally ready by July 2018. He wanted the defining controversy of the company's identity fought and documented while it was still private and he still had the latitude to be candid.
The dual-class structure Cloudflare adopted at its September 2019 IPO extended that latitude into public life. Prince told Kara Swisher that the board appoints him to be "chief coin flipper," and the share structure ensured the coin stayed in his hand. The lesson is double-edged: rehearsal and control let a founder make unpopular calls; they also concentrate exactly the kind of power Prince has spent years warning against.
Tactic: Before a liquidity event or major scrutiny, deliberately surface and settle the hardest question about your company's identity while you still control the forum.
Free playbook
Get The Business Model Playbook
58 business models, one visual page each: how the money flows, the metrics that matter, and who runs it. Free when you join the Faster Than Normal email.
Free. No spam. Unsubscribe anytime.
Part IIIQuotes and Maxims
In their words
— Matthew Prince, Cloudflare blog, 2013A website is speech. It is not a bomb. There is no imminent danger it creates and no provider has an affirmative obligation to monitor and make determinations about the theoretically harmful nature of speech a site may contain.
— Matthew Prince, Too Embarrassed to Ask, August 2017There is a point at which my job is chief coin flipper. Where really hard decisions come up to us and the team says, "We don't know if the answer is A or B," and somebody's got to make that call, I will make those calls and I think that people like Cindy should hold me accountable for the calls that I make.
— Matthew Prince, Reddit AMA, May 2014If we charged for bandwidth then it would cause customers to potentially avoid routing traffic through us. That goes against the core value that we provide: effectively a neighborhood watch for the Internet.
— Matthew Prince, to Digiday, 2026A lot of the criticisms of the internet, of social media, come back to this idea that the currency of the internet is traffic. And the problem with traffic is that the best way to get traffic is to appeal to humans' worst instincts – you know, fear, greed, lust.
— Matthew Prince, to Newsweek, 2018I'm skeptical of slippery slope arguments but every once in a while they're really true. And once you start to say 'we are the content police,' then it's hard to stop.
Maxims
- Build the trap before the business. The free, distributed tool that maps a problem is often worth more than the product that solves it.
- Multiply it by ten. When you first price something you made, add up the cost, multiply, and let the speed of the check tell you what it is really worth.
- Never tax the behavior you need. If more usage makes your product smarter, do not charge customers for using more.
- It's absurd to pay for math. Give away what is becoming a commodity before a competitor does.
- One configuration, everywhere. Uniform infrastructure buys speed and cost advantage — and demands that you guard against uniform failure.
- Keep the pirates far from the navy. Disruption needs a budget, a mandate, and a long enough distance from headquarters.
- When you're explaining, publish the explanation. Write the hard call down in public before critics draft it for you.
- Name the exception. If you break your own rule, say so in plain words, and the rule survives.
- Borrow legitimacy. Hand the decisions you are least entitled to make to institutions that can make them more credibly.
- Query your own contempt. When you roll your eyes at a customer's fear, pull the data before you dismiss it.
