What is the name of the domain?
custom subdomain connected to Cloudflare Pages (no domain shared here)
What is the error message?
There is no error shown; the problem is that the Access policy is not triggered at all on the custom domain.
What is the issue you’re encountering
I am trying to apply a Cloudflare Access policy on a custom subdomain connected to a Cloudflare Pages project, but the Access policy does not trigger at all — the site is publicly accessible without requiring authentication.
What steps have you taken to resolve the issue?
Enabled Access policy on the Pages project
Configured a Zero Trust → Self-hosted application for the custom subdomain
Set up One-time PIN authentication for specific emails
Verified DNS settings (CNAME, proxied)
Tested on incognito mode, different browsers, different devices
Checked Access authentication logs (no entries appearing)
I’m setting up Cloudflare Access protection on a custom subdomain connected to a Cloudflare Pages project, but the Access policy does not trigger — the site remains publicly accessible without requiring login.
Here’s what I’ve set up:
Custom domain → correctly connected to the Pages project (via CNAME, proxied)
DNS → CNAME record points to the correct .pages.dev target, proxied
Pages project → Access policy ENABLED
Access application → Self-hosted app bound to the custom subdomain
Policy → Allows only specific email addresses via One-time PIN
Authentication → One-time PIN configured
Access logs → no entries when testing the custom subdomain
Tested → incognito, different browsers, devices → no Access prompt
I also reviewed this topic:
Protect *.pages.dev with Access, but not custom domain
However, the solution there (matching what I’ve already set up) still does not work for me.
The Access policy never triggers on the custom domain.
Could this be a backend limitation or require additional configuration?
Thank you for any help or clarification!
What are the steps to reproduce the issue?
Visit the custom subdomain (over HTTPS) linked to the Cloudflare Pages project
Observe that the site loads immediately without triggering any Access login prompt