SSL is a solved problem
Automated certificate authorities turned TLS from a purchase into a background task. Every host in this directory issues and renews certificates automatically, at no cost, with no action from you beyond pointing DNS.
There is no longer any scenario in which a small site should pay for a standard certificate. If a host asks you to, that tells you something about the host.
DDoS protection is not the same thing
Free CDN tiers do give real protection, and it is not marketing — sitting behind a large network means volumetric floods are absorbed upstream of your origin, and that alone defeats the majority of low-effort attacks.
What the free tier does not give you is the configurable layer: rate limiting with useful granularity, bot management, and the application-layer rules that stop a flood which looks exactly like legitimate traffic. Those are the paid controls, and an application-layer attack is precisely the one a small site is most likely to meet.
Where the ceiling actually is
Network-layer floods are handled well by any serious free CDN. You will likely never notice them happening.
Application-layer attacks are different. A few thousand well-formed requests per second against your most expensive endpoint will exhaust a free compute tier long before the CDN considers it an attack, because from the CDN's perspective nothing anomalous is happening. Your quota absorbs it instead.
This is the moment free tiers stop being free, and it arrives without warning.
- Cache aggressively — anything served from cache never reaches your quota.
- Put expensive endpoints behind a rate limit, even a crude one.
- Know your quota reset window, so an incident does not become a month-long outage.
- Have a paid tier you could switch to in an hour, before you need it.
A realistic posture for a free site
Serve as much as possible statically, keep dynamic endpoints few and cheap, and accept that a determined attacker can take a free-tier site offline. For a portfolio or docs site that is an acceptable risk.
For anything where downtime costs money, the free tier is the wrong place to find out where the ceiling is.
