METRICKEEPER
Get Early Access //
← Back to Archive
// Guides2026-05-318 min read

How long does Cloudflare keep analytics data? (And how to extend it)

Abstract streams of blue light representing Cloudflare traffic data flowing over time

If you are running a fast-growing startup or managing production web traffic, metrics are your lifeline. You rely on them to track unique visitors, investigate security threats, and spot performance bottlenecks.

But Cloudflare’s analytics don’t stick around forever, and on Free, Pro, and Business plans some of the most useful data is gone within a day or two.

In this guide, we break down what Cloudflare actually documents about how long it keeps your data, why it disappears, what that costs you, and how to keep your history longer without an Enterprise upgrade.

The Short Answer: It Depends on the Dataset, Not Just the Plan

Cloudflare doesn’t publish a single retention number for “analytics”. Every dataset has its own limit, and most limits change with your plan. These are the ones Cloudflare documents:

Data Free Pro Business Enterprise
Security Events (WAF, rate limiting, bots) 24 hours 24 hours 3 days 30 days
Raw HTTP logs via Logpull — — — 3–7 days
Raw logs via Logpush — — — Sent to your own storage
Log Explorer — — — Up to 2 years, $0.10/GB-month (contract)
Instant Logs — — Live stream only Live stream only

Two product-specific limits are also documented:

  • Workers Analytics Engine (data you write from your own Workers) is stored for three months.
  • Network Analytics (Enterprise with Magic Transit, Spectrum, or Cloudflare WAN) keeps 16 weeks of data, and data older than eight weeks may have lower resolution when you query narrow time frames.

For the HTTP traffic charts most people look at (requests, bandwidth, visitors, cache), the limit varies by dataset and plan. Cloudflare exposes the exact numbers for your zone through the API. See how to check your exact Cloudflare analytics retention limits.

The Enterprise Catch: Raw, per-request logs (Logpull, Logpush, and Log Explorer) are Enterprise features. On Free, Pro, and Business plans you get aggregated and sampled analytics instead, and each dataset ages out on its own schedule.

What This Means for Each Plan

Free and Pro users lose Security Events after 24 hours. A WAF block on Friday night is gone by Sunday. There are no raw request logs to fall back on, so once the aggregated analytics age out, that history is unrecoverable.

Business users get 3 days of Security Events and access to Instant Logs. Instant Logs is a live stream with 60-minute sessions, not a way to look back. Quarterly reviews and year-over-year comparisons still need data Cloudflare may no longer hold.

Enterprise users get 30 days of Security Events and raw logs, but Logpull only buffers 3–7 days. Anything longer means paying for Log Explorer or running a Logpush pipeline to your own storage. Both are powerful, and both come with real costs.

Why Your Data Disappears: The Engineering Reality

Cloudflare is one of the largest networks on the internet, processing tens of millions of HTTP requests per second. Storing every single raw request line — with all its headers, IP addresses, payload metadata, geographic data, and timing information — for millions of websites across years of history is an extraordinarily expensive database engineering challenge.

To keep the dashboard fast and the lower tiers affordable, Cloudflare relies on aggregation and sampling:

Traffic is rolled up into hourly and daily summaries: total requests, bandwidth, unique visitors, top countries. Detailed datasets marked Adaptive in the API are sampled at progressively lower rates as volume grows, and every dataset has a limit on how far back it can be queried.

While this keeps the dashboard interface snappy and storage costs manageable for Cloudflare, it strips away your ability to drill down into historical anomalies. The aggregated summaries tell you that something happened, but not why, who, or how.

The Real-World Consequences of Short Retention Windows

Losing historical traffic data is not just an inconvenience. It has real operational, security, and business consequences.

Security Investigations

When a security incident occurs — a credential stuffing attack, a scraping campaign, an unusual spike in 404 errors — your first instinct is to look at the logs. If you are on a Free plan and the incident started 10 days ago, you have nothing to work with. You cannot identify which IPs were involved, which endpoints were targeted, or when the attack began. Your incident response is flying blind.

Compliance and Auditing

Compliance frameworks expect history. PCI DSS requires 12 months of audit log history, and SOC 2 auditors sample evidence from across a months-long observation period. Meanwhile, GDPR requires you to justify how long you keep IP addresses. A 24-hour default doesn’t fit any of those.

Growth Analysis and Business Intelligence

Understanding your traffic trends over time is fundamental to making good product and marketing decisions. Which blog posts drove traffic six months ago? Did that campaign last quarter actually move the needle? How has your geographic traffic distribution shifted since you launched in a new market? Without long-term data, these questions are unanswerable.

Capacity Planning

Engineers use historical traffic data to plan infrastructure scaling. Knowing your peak traffic patterns across seasons, product launches, and marketing campaigns allows you to provision resources intelligently. Without that history, capacity planning becomes guesswork.

The Technical Workaround: Extending Retention with Cloudflare Workers

You do not need an Enterprise contract to preserve your data. Because Cloudflare intercepts all your traffic at the edge, you can use Cloudflare Workers to tap into the live request stream, capture the analytics telemetry, and stream it to an external storage system in real time.

Here is a step-by-step setup to archive your traffic data automatically.

Step 1: Create a Workers Pipeline

Cloudflare Workers execute serverless code at the edge closest to your users. We can write a script that processes the visitor’s request normally, but simultaneously dispatches a background task to ship the request metadata to an external endpoint — without adding any latency to the user’s experience.

Step 2: Deploy the Telemetry Script

Deploy the following lightweight Worker script. It intercepts incoming traffic, extracts the critical data points, and ships them off to your external database using ctx.waitUntil so the logging happens asynchronously and never slows down the response.

// src/worker.js
export default {
  async fetch(request, env, ctx) {
    // 1. Process the request normally
    const response = await fetch(request);

    // 2. Gather telemetry data
    const logData = {
      timestamp: new Date().toISOString(),
      url: request.url,
      method: request.method,
      country: request.cf?.country || 'Unknown',
      colo: request.cf?.colo || 'Unknown',
      ip: request.headers.get('cf-connecting-ip'),
      userAgent: request.headers.get('user-agent'),
      status: response.status,
      referer: request.headers.get('referer') || null,
    };

    // 3. Stream to external storage asynchronously
    ctx.waitUntil(
      fetch(env.ANALYTICS_ENDPOINT, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(logData)
      }).catch(err => console.error('Telemetry stream failed:', err))
    );

    return response;
  }
};

Step 3: Choose Your Storage Backend

Once you are streaming data out of Cloudflare, you need somewhere to put it. Your options range from simple to sophisticated:

Cloudflare R2 is the simplest option if you want to stay in the Cloudflare ecosystem. You can write JSON log files directly to an R2 bucket and query them later. The downside is that R2 is object storage — not a database — so querying large volumes of logs becomes awkward quickly.

PostgreSQL is a solid general-purpose choice. A managed Postgres instance on Supabase, Railway, or Neon can ingest your log events as rows and let you query them with standard SQL. It works well up to tens of millions of rows, after which you may start hitting performance limits on complex analytical queries.

ClickHouse is the power-user option. It is a column-oriented database built specifically for high-volume analytics workloads. If you are handling millions of requests per day, ClickHouse will outperform Postgres significantly for time-series queries, aggregations, and large range scans. Managed ClickHouse is available via ClickHouse Cloud or Altinity.

Workers Analytics Engine is Cloudflare’s built-in option for writing analytics from a Worker and querying them with SQL. It’s convenient, but data is stored for three months, so it’s a buffer rather than a long-term archive.

TimescaleDB is a PostgreSQL extension that adds time-series optimizations. It is a good middle ground — you get the familiarity of SQL with better performance for time-ordered data.

Step 4: Build a Query Layer

Raw storage is only useful if you can query and visualize the data. You will need to build or integrate a dashboard to make the data actionable. Options include:

  • Grafana connected to your ClickHouse or Postgres instance for time-series dashboards
  • Metabase for a more business-friendly self-serve analytics interface
  • Custom dashboards built with your preferred frontend framework

This is where the DIY approach starts to show its true cost: you are not just writing a Worker script, you are maintaining an entire data pipeline, storage layer, and visualization stack.

DIY vs. Managed: What is the Real Cost?

Building and maintaining your own Cloudflare data archival pipeline is absolutely possible, but it is worth being honest about the ongoing cost:

  • You need to monitor the Worker for failures and gaps in data collection
  • You need to manage storage costs and retention policies on your backend
  • You need to handle schema migrations as your data needs evolve
  • You need to build and maintain the query and visualization layer
  • You need to ensure your pipeline handles traffic spikes without dropping events

For engineering teams with the bandwidth to own this infrastructure, the DIY approach is powerful and flexible. For everyone else, the operational overhead adds up fast.

The Easier Way: Let MetricKeeper Handle It

MetricKeeper was built specifically to solve this problem. It connects to your Cloudflare account with read-only access and automatically archives your traffic analytics indefinitely — no Workers scripts to write, no database to provision, no dashboard to build.

You get clean, queryable long-term traffic data from the moment you connect, with visualizations built for the questions that actually matter: year-over-year growth, geographic trends, top pages over time, and anomaly detection across your full history.

No Enterprise contract required. No infrastructure to maintain.

Get Early Access →

Sources