Securing the WordPress admin area is a critical step in protecting your site from brute force login attempts, bot scans, and other common exploits. While traditional security plugins help, using Cloudflare Access gives you a stronger, Zero Trust-based security perimeter. In this guide, we’ll show you how to lock down your WordPress admin area using Cloudflare Access without breaking essential frontend features.
Why Secure wp-admin and wp-login.php?
The WordPress admin area and login page are popular targets for automated attacks. Even if you have a strong password and two-factor authentication (2FA), exposing these endpoints to the public internet invites unnecessary risk. Cloudflare Access helps by requiring identity verification before allowing access to these URLs.
Step-by-Step: Protect WordPress Admin Using Cloudflare Access
- ### Define Access Policies
Before creating applications, you need to define at least two reusable Access policies in the Zero Trust dashboard → Access → Policies → Include section:
Organization: A policy that authenticates users. For example, allow users with emails ending in
@example.com, or identities from Google, GitHub, or SSO providers.Everyone: A policy that allows all users without authentication. This is used for public exceptions like AJAX requests.
After performing these steps, your policy list will look like this:
- ### Create a Restricted Access Application
Create a new Access Application for your domain.
Set the domain to your apex (e.g.,
example.com).Under Paths, add:
wp-login.phpwp-admin/*
Assign the "Organization" policy to this application.
This will restrict login attempts and direct access to the admin area unless the user is authenticated via Cloudflare Access.
- ### Create a Public Bypass Application
Many WordPress plugins (especially WooCommerce and others) use AJAX or post requests to endpoints like:
wp-admin/admin-ajax.phpwp-admin/admin-post.php
Blocking these paths will break essential features such as dynamic product views, contact forms, or custom actions.
To avoid this:
Create a second Access Application for the same domain.
Under Paths, add:
wp-admin/admin-ajax.phpwp-admin/admin-post.php
Assign the "Everyone" policy to this application.
After performing these steps, your application list will look like this:
- ### Test the Policies
To ensure everything is configured correctly, perform the following tests:
Restricted Access Test: Open a private/incognito browser window and try accessing
wp-login.phpor any URL underwp-admin/(e.g.,wp-admin/index.php). You should be redirected to a Cloudflare Access login prompt.Public Access Test: Still in incognito mode, try accessing
wp-admin/admin-ajax.phporwp-admin/admin-post.php. These should load without any authentication.Authenticated Access Test: Log in using an authorized identity through Cloudflare Access. Once authenticated, you should be able to access all restricted admin URLs normally.
If each of these tests behaves as expected, your Cloudflare Access configuration is working correctly.
wp-admin/* is restricted, these two specific paths will remain accessible to the public as long as they are declared separately.Security by Obscurity: Not the Answer
Some WordPress plugins allow you to change the URL of wp-admin or wp-login.php in an attempt to hide them from attackers. While this may reduce some bot noise, it's a form of security by obscurity. Determined attackers can still find those endpoints through fingerprinting, and it offers no real protection if the page is still publicly accessible. True security comes from enforcing authentication layers like Cloudflare Access, not hiding your login URL.
Plugin vs. Cloudflare Access: Which is Better?
Traditional WordPress security plugins can help with rate limiting, 2FA, and brute force protection. However, they operate at the application level, meaning your server still has to process malicious requests before rejecting them. Cloudflare Access, on the other hand, operates before the request ever reaches your server — it sits at the edge and enforces identity-based access.
Using both a plugin and Cloudflare Access is not overkill. In fact, it gives you defense in depth: Cloudflare blocks unauthorized requests at the edge, and plugins offer additional application-level protections and visibility. If you're choosing one, Cloudflare Access is more effective for protecting login and admin routes. But for full coverage, combining both approaches is ideal.
