Use Cloudflare Access to Protect Your Website/Service If You Don’t Bother to Build a Login Page

Table of Contents

If you're too lazy to build an authentication system (aka a login page) for your website or service, try Cloudflare Access.

With a few clicks, it can put a login page in front of your website or service as long as you host your domain on Cloudflare. Only the emails you allow can get in, everyone else is blocked at Cloudflare's edge before reaching your server.

I use it as an extra layer of security to protect my WordPress blog logins, which were getting thousands of brute-force attempts a day. For example, I have a blog at https://vinta.ws/code/:

Configuration

Go to the Cloudflare dashboard > Zero Trust:

Integrations > Identity providers > Add new identity provider
- Select One-time PIN or anything else you want to use as the login method
Access controls > Applications > Create new application > Self-hosted and private
- Destinations > Public hostnames:
  - Domain: vinta.ws, Path: code/wp-login.php
  - Domain: vinta.ws, Path: code/wp-admin
  - Or any path you want to protect
- Access policies > Create new policy:
  - Action: Allow
  - Include: Emails, your email
- Authentication > Identity:
  - Select One-time PIN
  - Turn on Apply instant authentication
- Details:
  - Name: Whatever you like
  - Session Duration: 24 hours

ref:
https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/

Open the protected page in your browser, you will see Cloudflare's login page asking for your email.

That's it. No code, no plugin, no installation, and free.