What is included in every Foundation Package?

All packages follow four structured phases: Assessment & Planning (reviewing your current environment and identifying gaps), Configuration & Implementation (deploying the relevant security or management controls), Testing & Validation (piloting changes with a small user group and refining configurations), and Knowledge Transfer & Rollout (full documentation, IT staff training, and operational runbooks before company-wide deployment).

What deliverables will I receive at the end?

Every engagement concludes with a full handover package: a detailed assessment report of your current environment, complete configuration documentation with step-by-step guides and screenshots, ready-to-use communication templates for notifying end users, an operational runbook for your IT team, and training materials for ongoing management.

How long does implementation take?

Timelines vary depending on the complexity of your environment, the size of your organization, and the availability of your IT staff and key stakeholders. Every engagement begins with an assessment phase that gives us a clear picture before committing to a delivery schedule.

Do you implement everything, or do you guide our team?

There are two engagement models. In the first, I deliver the full implementation plan, hands-on configuration guidance, and complete knowledge transfer — then hand everything over to your internal IT team to execute and maintain. In the second, we agree on a contracted engagement where I manage the end-to-end implementation. The right model depends on your team's capacity and preference.

What do we need in place before starting?

You will need an active Microsoft 365 subscription at the appropriate licensing tier for the chosen package, Global Administrator or equivalent access to your tenant, availability of key IT staff for workshop sessions, and 3–5 willing users for the pilot testing phase.

What is not covered by a Foundation Package?

Each package has a clearly defined scope. Generally out of scope are: features requiring higher license tiers than specified, third-party integrations, custom scripting beyond standard Microsoft 365 capabilities, formal compliance audits, and ongoing managed support. Post-engagement support and optimization services can be arranged under a separate agreement.

Who from our organization should be involved?

At minimum: an IT Administrator with tenant access, and an IT Manager or decision-maker who can approve configuration changes. Ideally also include security personnel and help desk leads who will manage the environment after handover. A group of 3–5 test users is needed for the validation phase.

Can we get ongoing support after the package is complete?

Foundation Packages are structured, time-bound engagements designed to end with a full handover to your team. Ongoing support, post-deployment optimization, and continuous managed services are available through separate agreements tailored to your organization's specific needs.

← Back to Blog

securityzero-trustbest-practiceshow-to

Cloudflare 1.1.1.1: One Small Change for a Safer Internet Experience

Cloudflare's free 1.1.1.1 app encrypts your DNS and internet traffic. Here's what it does, why it matters, and how to get started on any device.

17 March 2026By Marek Ratassepp

Cloudflare 1.1.1.1: One Small Change for a Safer Internet Experience

A few days ago, a friend asked me what he could do to be "more secure online." He's not technical. He doesn't run a company. He just reads the news, sees headlines about data breaches, and wonders if he should be worried.

My first answer surprised him: "Install the 1.1.1.1 app on your phone."

No subscription. No configuration. No account needed. Just install it, tap the button, and your internet connection gets meaningfully more private.

What problem does this actually solve?

Every time you open a website, your device first asks a DNS server to translate the domain name (like marera.eu) into an IP address. Think of it as looking up a phone number in a directory before making a call.

By default, your internet provider handles these lookups. And most of them can see every domain you visit. Some log it. Some sell that data. At a minimum, it's sitting on their servers somewhere.

On public WiFi, it gets worse. Coffee shop networks, hotel WiFi, airport hotspots - anyone on the same network with basic tools can watch these DNS requests go by in plain text. They can see which sites you're visiting, even if the sites themselves use HTTPS.

Cloudflare's 1.1.1.1 fixes this by replacing your default DNS with an encrypted one. Your DNS queries go to Cloudflare instead of your internet provider, and they travel encrypted, so nobody in between can read them.

What about WARP?

The 1.1.1.1 app includes a feature called WARP. This goes a step further than just DNS. When WARP is turned on, it creates an encrypted tunnel for your device's internet traffic - all your device's internet traffic, including the actual data going back and forth.

It works similarly to a VPN, but it's not quite the same thing. A traditional VPN routes all your traffic through a server in a specific location, which is useful if you want to appear to be browsing from another country. WARP doesn't do that. It encrypts your connection and routes it through Cloudflare's network (which has data centers in over 330 cities), but it doesn't hide your general location or let you bypass geo-restrictions.

What WARP does give you: protection from snooping on the network between you and the internet. On public WiFi, that's a real and practical benefit.

A real-life scenario

You're at an airport, waiting for a flight. You connect to the free WiFi to check your email and do some online banking.

Without any protection, your DNS queries are visible to anyone on that network. Someone sitting a few seats away with a laptop and freely available software could see which sites you're visiting. If any of your apps or services don't use encryption properly, they could see more than that.

With 1.1.1.1 and WARP turned on, your traffic is encrypted from your phone to Cloudflare's nearest data center. The person a few seats away sees encrypted noise. Your internet provider at the airport sees encrypted noise. The only one who knows which sites you're visiting is Cloudflare - and their published policy is that they don't log your browsing data or sell it.

Is this bulletproof? No. But it's a large step up from having no protection at all, and it costs you nothing.

Another scenario: your home network

Even at home, your internet provider sees your DNS queries by default. In some countries, providers are required to log this data. In others, they do it voluntarily and use it for analytics or advertising.

Switching your DNS to 1.1.1.1 means your provider can still see that you're sending data (they're carrying the packets, after all), but they can no longer easily read which specific domains you're visiting. It's not full anonymity, but it's a real improvement in everyday privacy.

You can set this up on your home router by changing the DNS settings to 1.1.1.1 and 1.0.0.1. If you set it on the router, every device in your home benefits without needing to install anything.

What it costs

The basic 1.1.1.1 app with WARP is free. There's a paid tier called WARP+ that uses optimized routing for faster performance, but the free version already covers the security and privacy basics. For most people, the free version is all you need.

Compare this to a commercial VPN, which typically runs 5-10 euros per month, and you start to see why I recommend 1.1.1.1 as a starting point. The security benefit per euro spent is hard to beat when the price is zero.

What it doesn't do

To be clear about the limitations:

It doesn't make you anonymous. Cloudflare can still see your traffic, and the websites you visit can still identify you through cookies, logins, and other tracking methods.
It doesn't replace antivirus or endpoint protection. Encrypting your connection doesn't stop you from clicking a phishing link or downloading malware.
It doesn't bypass geo-restrictions. If you need to watch content from another country, you need an actual VPN service.
It doesn't protect you from yourself. If you enter your password on a fake website, encrypted DNS won't save you.
Think of it as locking your front door. It won't stop a determined burglar, but it stops casual opportunists and keeps honest people honest.

For businesses: this is where it gets interesting

Everything I've described so far is consumer-level - good for individuals and small teams. But Cloudflare built the same technology into a much larger platform called Cloudflare One.

For businesses, the WARP client becomes part of a Zero Trust Network Access (ZTNA) setup. Instead of a traditional VPN that gives remote workers full network access once they connect, ZTNA lets you control exactly which internal applications each user can reach, based on their identity, device health, and location.

The same app your employees already use for basic security can be enrolled into your company's Cloudflare One account. From there, you can add DNS filtering (blocking malicious or unwanted domains), apply access policies, and route traffic to internal resources without exposing your entire network.

I won't go deep into the enterprise setup here - that's a separate conversation. But it's worth knowing that the simple free app and the advanced business platform share the same foundation. If your company grows and you need more control, you don't have to start from scratch.

What you can do right now

Install the app. Search for "1.1.1.1" in the App Store or Google Play. Install it. Turn it on. That's the whole process for basic protection.

Turn on WARP. Inside the app, make sure WARP mode is enabled, not just DNS mode. This encrypts your full connection, not just DNS lookups.

Use it on public WiFi. Make it a habit. Before you open your banking app or check email on a public network, check that the app is connected.

Set it on your home router. Change your router's DNS settings to 1.1.1.1 and 1.0.0.1 for the whole household. How to do this varies by router - search for your router model and "change DNS settings" and you'll find instructions.

Tell someone who needs it. If you have family members or colleagues who do a lot of work on their phones over public WiFi, this is worth passing along.

When to look beyond 1.1.1.1

If you run a business and need to manage how your employees access company resources remotely, or if you want to filter DNS traffic across your organization, the consumer app isn't enough. That's where Cloudflare's Zero Trust platform comes in, or where you combine it with tools like Microsoft Intune and Conditional Access for a more complete security setup.

If you're at that point and not sure where to start, that's exactly the kind of thing I help with.

1.1.1.1 is a free app by Cloudflare that encrypts your DNS queries and, with WARP, your internet traffic

On public WiFi, it prevents others on the network from seeing which sites you visit

At home, it stops your internet provider from easily logging your browsing

It's not a full VPN and doesn't provide anonymity, but it's a practical first step

For businesses, the same technology scales into Cloudflare's Zero Trust platform for managed access control

Interested in how this fits into a broader security setup for your business? Drop me a line — happy to point you in the right direction.