Blocked wp-admin and can't allow my ip address

[fritex]

Greetings,

Thank you for asking.

@caspooor11

I blocked access to my website’s wp-admin,wp-login, etc on Cloudflare’s WAF rules

I’d just like to add, blocking anything inside “wp-admin” for end-visitor might result in some issues with theme and plugins for normal website visitors as far as some are using scripts and similar stuff from “wp-admin” folder.

Also, you might be blocking a WP cron like that. Kindly, check on the Security tab → Firewall overview for any of the possible Firewall events being challenged or blocked for your web hosting / server IP.
If you experience that, I’d suggest you to allowlist the origin host/server IP at Cloudflare → Security → Tools → IP Access Rules with the action “allow”.

@caspooor11

wp-login

You’d want to create a Firewall Rule with a JS Challenge or Managed Challenge for like, if URI path contains wp-login.php.

@caspooor11

to exclude myself from being blocked as well

@caspooor11

only allow myself

Otherwise, there are few topics around about the similar thing to protect WordPress, but still being able to login yourself in using a method with Cloudflare Access / Teams.

I’d suggest you to use a search button to find more on how to configure that kind of setup. Or, below article could help you:
https://www.tuonetti.fi/en/cloudflare-access-guide/

Using Cloudflare Access / Teams, this can be done, and I know enough people already using it and working fine

Combining Cloudflare Access and Firewall Rules to protect WordPress

You shouldn’t need such blanket protection of the wp-admin directory. I spend a lot of time combing through WordPress logs and find the worst offenders seem to be targeting wp-login, xmlrpc, and admin-ajax. Plus other random fits of inspiration: vulnerable plugins, random config files. My approach is to use Access to protect wp-login, then Firewall Rules to Challenge or Block all the other noise.

Furthermore, regarding WordPress Security & Cloudflare, below might be of help:

What Request to Block in Firewall for Wordpress and Normalize URLs

That is a good question out there. I would say it cannot be stated as a general rule of thumb, as far as some WordPress websites do not have to use like POST or PUT (WP REST API, wp-json, plugins etc.), while other have to - just an example. You could try to block TRACE & TRACK for example. Or, if you could for example, limit HEAD, GET and POST for some specific IP or some similar scenario, where you protect your Website from bad bots, possible attacks, etc. in terms of security measurements. …