Cloudflare WARP protects everyday internet connections by routing device traffic through an encrypted tunnel to a nearby Cloudflare data center. This can help keep activity private from an internet provider and add protection when using public Wi-Fi. The app also provides access to Cloudflare’s 1.1.1.1 DNS resolver.
Its scope is narrower than that of a location-switching VPN. WARP does not let you choose a server country and is not designed to hide your location from websites or streaming services. Your traffic is routed through Cloudflare, so enabling the service changes which network provider handles that connection.
For a lighter option, the Cloudflare WARP app can operate in 1.1.1.1 mode, which encrypts DNS lookups without sending all device traffic through the WARP tunnel. In the full WARP mode, traffic travels through an encrypted connection using a modern encrypted protocol.
Modes and everyday controls
The Windows client is operated from the system tray with a one-switch control for turning protection on or off. After installing the MSI, open the 1.1.1.1 app from the tray, accept the terms, and switch the service on. Preferences provide the choice between full WARP protection and DNS-only 1.1.1.1 mode.
These modes suit different connection needs. DNS-only mode focuses on protecting DNS queries, while WARP extends the encrypted tunnel to the device’s traffic. Some company networks and online games may behave differently when WARP is active, so switching it off can help when a connection or service does not work as expected.
Free service and organizational use
The free WARP service has no monthly data limit and does not require an account. WARP+ is an optional paid subscription that provides access to a larger network for better speed. The same client can also be enrolled by organizations using Cloudflare Zero Trust to protect employee devices.
Cloudflare WARP is available for Windows 10, Windows 11, macOS, Linux, Android, and iOS. Its Windows setup follows the same practical pattern: install the MSI, open the tray app, accept the terms, and choose the desired protection mode.
What the protection does and does not provide
WARP is useful when the main goal is to encrypt traffic on public Wi-Fi or prevent an internet provider from seeing DNS lookups. The DNS-only setting can be selected when a full traffic tunnel is not wanted, while the full mode protects a broader share of the connection.
Neither mode provides country selection or makes the service a tool for concealing a user’s location from websites. The main trade-off is that device traffic passes through Cloudflare rather than directly through the internet provider. Those limits are important when deciding whether its connection protection matches a particular privacy need.