For a long time, Cloudflare was primarily associated with protecting websites and improving page load times through its global CDN. While those web-focused services remain central, modern organizations depend on many protocols that operate outside standard HTTP and HTTPS. Protecting and optimizing these non-web protocols is now essential for businesses that run real-time services, legacy systems, and custom applications.
Cloudflare Spectrum extends Cloudflare’s security and performance features to any TCP or UDP-based application. Whether you operate custom game servers, VoIP and SIP communications, secure shell (SSH) connections, or proprietary industrial APIs, Spectrum lets you apply Cloudflare’s global network protections and acceleration beyond the website. This ensures mission-critical services stay available, responsive, and protected from attacks that could interrupt revenue or operations.
Securing the “invisible” protocols
The shift toward a web-first environment has left many vital services exposed. Traditional CDNs and web application firewalls are typically focused on HTTP(S) traffic and often do not inspect or filter other protocols. That gap can leave financial systems, industrial control APIs, and communication platforms vulnerable to direct attacks.
Spectrum functions as a global reverse proxy for any TCP or UDP protocol. Routing traffic through Cloudflare hides your origin IP addresses from the public internet, preventing attackers from bypassing defenses and targeting infrastructure directly. For industries like online gaming and real-time communications, where uptime directly impacts revenue and reputation, this extra layer of protection is crucial to maintaining continuous service and business continuity.
Magic Transit and the power of eBPF
Magic Transit is a foundational element of Cloudflare’s enterprise networking suite. It offers BGP-level protection for entire IP subnets by announcing your prefixes across Cloudflare’s global network. This allows massive DDoS attacks to be absorbed and filtered at the network edge before they reach your data centers, reducing dependency on expensive on-premises scrubbing hardware and lowering the risk of network-wide outages.
Enterprise customers can also use Programmable Flow Protection, a feature that leverages eBPF (extended Berkeley Packet Filter). eBPF allows custom packet-processing logic to run at the network edge. Instead of relying solely on standard firewall rules, you can deploy tailored C-based programs to inspect and filter specialized UDP or TCP traffic in real time.
This capability is especially valuable for organizations that use proprietary protocols or non-standard packet formats. By defining precise acceptance criteria for “good” packets, you can ensure that only legitimate traffic reaches your servers while malicious, malformed, or otherwise unwanted packets are dropped immediately. That level of control improves security for unique workloads such as custom gaming backends, industrial control systems, and specialized communication services.
Optimizing performance for legacy applications
Many legacy applications were not built for global use and can suffer from high latency, frequent disconnections, or poor reliability when accessed from remote offices. Public internet routing is often unpredictable, leading to long round-trip times and unstable connections for critical systems.
Spectrum combined with Cloudflare’s Argo Smart Routing can drastically improve performance for these applications. Instead of traversing congested and suboptimal public routes, TCP and UDP traffic can travel over Cloudflare’s private, high-speed backbone. This reduces the number of hops, avoids congested network segments, and results in lower latency and more consistent connection quality for end users.
For multinational organizations and distributed branch offices, these performance gains translate into more reliable access to legacy servers and smoother day-to-day operations. Applications previously deemed too slow or unreliable for remote use can become practical and productive when routed through Spectrum and Argo’s optimized paths.
The Enterprise advantage
Cloudflare Spectrum for custom TCP and UDP applications is offered as part of Cloudflare’s Enterprise plan. The Enterprise tier includes advanced networking capabilities, higher support levels, and the control needed to manage complex, network-level configurations across diverse services.
Working with an experienced provider can simplify adoption of these enterprise-grade features. If your organization depends on more than a single website to remain operational, moving to a unified network fabric can protect your entire infrastructure. Spectrum helps ensure that mission-critical APIs, legacy services, and specialized protocols receive the same level of security and performance that modern web services enjoy.