Registration portals and football accounts are a favourite bot target — mass fake-account creation, credential stuffing against member logins. Turnstile + Bot Management block every automated attempt before it reaches your registration database — no AWS WAF rule authoring, no origin load.
Every asset on this page — the badge, the fonts, the JS — is cached at the Cloudflare edge nearest the visitor. No separate CDN to provision, no origin round-trip for a repeat request.
Registration portals, member accounts, and public marketing pages all sit behind the same Cloudflare WAF — no per-service security group sprawl. Managed Rules cover OWASP Top 10 (SQLi, XSS, RCE) out of the box; this zone's live ruleset is what we'll click through together in the dashboard.
Match photos from three years ago and yesterday's registration export sit in the same storage class, retrieved at the same speed — no lifecycle policy, no "cold tier" restore delay, and zero egress fees when you serve it back out.
| Need | AWS | Cloudflare |
|---|---|---|
| Compute | EC2 + Auto Scaling | Workers (no servers) |
| Load balancing | ELB / ALB | Included at the edge |
| CDN | CloudFront (separate config) | On by default |
| WAF | AWS WAF (per-app rules) | One ruleset, every property |
| Object storage | S3 + Glacier tiers | R2 — one class, no egress |
| DNS | Route 53 | Included |
A simple static site on AWS still needs a server, a load balancer, and separately-configured security and CDN before it's production-ready — each one is billed, patched, and secured on its own. Cloudflare collapses that stack into one platform that runs the same way regardless of where your other infrastructure lives, so migrating a property doesn't mean re-architecting it.
R2's API is S3-compatible — most tooling and SDKs already written against S3 point at R2 with a config change, not a rewrite.