Yes, some nonprofits can. Cloudflare runs Project Galileo, which gives free protection to eligible human rights, civil society, journalism and democracy organizations that are likely targets of attacks such as DDoS. It is not open to every charity, and you apply through a partner or a contact form.
What the program is
Project Galileo started in 2014. Cloudflare says it provides free security to more than 2,900 vulnerable internet properties that face DDoS and other attacks. Participants receive the features of a business plan, and the page lists unmetered DDoS mitigation, a web application firewall, a CDN, an SSL certificate and Zero Trust access among them.
A DDoS attack floods a site with junk traffic so real visitors cannot reach it. For an advocacy group that depends on its site to publish, take donations or reach people in a crisis, being knocked offline is the harm.
Who it is meant for
The program page names organizations working in human rights, civil society, journalism or democracy. It describes recipients as vulnerable public interest sites that operate on limited budgets and may face opponents with more resources. A local choir or a school parents' group is probably not the target audience, and that is fine, because ordinary free tiers of hosting and CDN services may still help you.
How to apply
The page lists these steps:
- Ask one of the listed partner organizations to sponsor you, or
- If you have no partner, fill out the contact form.
- Give the domain you want protected. It must be a live website.
- Describe your mission, activities and nonprofit status.
- Explain how you serve the public interest.
- Describe the factors that make you a vulnerable target.
The page also says Cloudflare will not reveal participating sites without explicit permission, which matters for groups that could face backlash.
What free protection does not fix
Traffic filtering protects availability. It does not fix a weak admin password, an unpatched plugin or an exposed donor spreadsheet. Treat it as one layer.
| Risk | Does DDoS protection help? | What does |
|---|---|---|
| Site knocked offline by traffic flood | Yes | The protection itself |
| Stolen admin login | No | Unique passwords and MFA |
| Outdated website software | Partly, via a firewall | Updates and patching |
| Defaced page after a plugin flaw | Not reliably | Patching, backups, least privilege |
Also keep a plain offline copy of your site content and know who holds your DNS login. If DNS is controlled by a former volunteer, you cannot switch protection on in a hurry.
Quick check
Does my nonprofit status alone qualify?
The program page asks about your mission and why you are a vulnerable target, not only your status. Eligibility is judged by Cloudflare and its partners, so apply and let them decide.
Will I need to move my website to apply?
The page says the domain must be a live website. It does not require rebuilding your site, but check the current terms on the program page before you plan any migration.
If I get accepted, am I finished with security?
No. DDoS filtering covers one threat. Account security, updates and backups still need an owner.
Sources
Last reviewed: 19 October 2026.
