--- title: "Lock the admin area with Cloudflare Access · Wi24rd" description: "Put login pages such as wp-admin behind Cloudflare Access, so only your own people can see them – with a one-time code by email. Free for up to 50 users, about 20 minutes – step by step." url: "https://wi24rd.com/en/security-tips/cloudflare-access/" lang: "en" alternates: da: "https://wi24rd.com/sikkerhedstips/cloudflare-access/" en: "https://wi24rd.com/en/security-tips/cloudflare-access/" --- Security tip 5 · Cloudflare Access # Lock the admin area. Login pages are the robots’ favourite target. With Cloudflare Access, the page does not even exist for anyone but you: people must first prove who they are with a one-time code by email. Free for up to 50 users. Last checked 1 November 2026 [Go to the steps](https://wi24rd.com/en/security-tips/cloudflare-access/#trin)[See the door on wi24rd.com](https://wi24rd.com/en/machine-room/the-door/) Time ~20 min Price Free up to 50 users Login One-time code by email Needs Domain behind Cloudflare [tip 3](https://wi24rd.com/en/security-tips/cloudflare-proxy/) Why ## A login page that does not exist cannot be attacked. WordPress’s `/wp-admin`, the webmail, the NAS, the router’s control panel: every login page is tried by robots around the clock with leaked passwords and known holes in the login software itself. A good password helps against the first – not against the second. With Cloudflare Access, the request never reaches the page until the person has proven who they are. For the robots there is nothing to attack – only Cloudflare’s own login page. _How it works: Someone opens the admin area. Cloudflare asks for an email address and sends a one-time code, but only to addresses on the list. Only with the right code does Cloudflare let the request through to the page._ 1. **Someone knocks**/admin 2. **Cloudflare asks**who are you? 3. **Code by email**only to your list 4. **The door opens**for you – nobody else Step by step · Cloudflare ## Six steps, about 20 minutes. 1. ### Open Zero Trust Log in to [dash.cloudflare.com](https://dash.cloudflare.com/) and choose **Zero Trust** in the menu – or open the domain, choose **Access** and press **Go to Access**. The first time, you choose a team name and the **Free** plan. [!\[The domain’s Access page with the Go to Access button\](https://wi24rd.com/assets/img/skaerm/access-zone.webp)](https://wi24rd.com/assets/img/skaerm/access-zone.webp) _From the domain: Access → Go to Access takes you into Zero Trust. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 2. ### Check the login method **One-time PIN** is on by default: Cloudflare sends a code by email. If you would rather log in with Google, Microsoft or GitHub, add them as login methods in Zero Trust – and each application has its own **Login methods** tab. 3. ### Add an application Go to **Zero Trust → Access controls → Applications**, press **Create new application** and choose **Self-hosted**. [!\[The list of Access applications with Wi24rd administration and the Create new application button\](https://wi24rd.com/assets/img/skaerm/access-apps.webp)](https://wi24rd.com/assets/img/skaerm/access-apps.webp) _The applications in Zero Trust. Other domains’ applications are blurred. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 4. ### Point it at the admin area Give it a name and enter the domain and the path to lock – e.g. `yourdomain.com` with the path `wp-admin`, or a whole subdomain like `admin.yourdomain.com`. Choose how long a login should last, e.g. 24 hours. [!\[The destination wi24rd.com with the path admin\](https://wi24rd.com/assets/img/skaerm/access-destination.webp)](https://wi24rd.com/assets/img/skaerm/access-destination.webp) _On wi24rd.com, the application locks the path /admin. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 5. ### Create the rule Create a _policy_ with the action **Allow**, and under **Include** choose **Emails** and enter your addresses. Prefer single addresses over the whole domain, so a new account on your mail does not get access automatically. [!\[The rule: Include Emails and Require Login Method GitHub\](https://wi24rd.com/assets/img/skaerm/access-politik.webp)](https://wi24rd.com/assets/img/skaerm/access-politik.webp) _The rule behind wi24rd.com: only two addresses (blurred), and a GitHub login is required. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 6. ### Try it in a private window Open the admin area in a private browser window. Cloudflare’s login page should now appear. Enter your address and type the six-digit code from the email. Also try with an address that is not on the list – it should not get in. Pitfalls ## Three things that can trip you up. 1. ### WordPress uses the admin path from the front page Some plugins call `/wp-admin/admin-ajax.php` when ordinary visitors use the site. If you lock all of `wp-admin`, check afterwards that forms and the like still work. Otherwise lock `wp-login.php` on its own. 2. ### Do not lock yourself out Put at least two people on the list, and check that the email with the code does not end up in spam. 3. ### The back door applies here too If the server can be reached directly around Cloudflare, so can Access. Close the back door as described in [tip 3](https://wi24rd.com/en/security-tips/cloudflare-proxy/). If you are technical, the server can also check the signed `Cf-Access-Jwt-Assertion` header that Cloudflare sends along. On wi24rd.com ## The door holds. The admin area on wi24rd.com sits behind Cloudflare Access, and the rule also requires a GitHub login (_Require → Login Method_), so an email code alone is not enough. [The door](https://wi24rd.com/en/machine-room/the-door/) in the machine room shows live how many have knocked and how many got in. You can see the same at the bottom of [Right now](https://wi24rd.com/en/right-now/). Without Cloudflare, you can get some of the same by limiting the login page to known IP addresses or putting it behind a VPN. **About this tip** The steps were checked in Cloudflare’s dashboard and documentation on 1 November 2026. Cloudflare regularly moves the Zero Trust menus around – if a button is somewhere else, search for its name in the dashboard. The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. Wi24rd has no financial interest in Cloudflare – no money, discounts or services. [All security tips](https://wi24rd.com/en/security-tips/) [See the figures live](https://wi24rd.com/en/right-now/) [Back to Security tips](https://wi24rd.com/en/security-tips/)[To the top](https://wi24rd.com/en/security-tips/cloudflare-access/#top) ## Missing a tip? Write what you would like explained. The next security tip could be yours. [Write to Wi24rd](https://wi24rd.com/en/contact/)[The site’s own defences](https://wi24rd.com/en/security/)