Cloudflare Zero Trust Not Working for WordPress Admin Pages

Zero Trust
1

Related to

I don’t know / other

What is the issue you’re encountering

Cloudflare Zero Trust is not working for my WordPress admin pages, even though my applications and policies are configured correctly. I can bypass Zero Trust entirely."

What steps have you taken to resolve the issue?

Option 1 (Short and Sweet):

“I’ve double-checked my configurations, cleared cache, used incognito mode, disabled all WAF rules, and tested with no VPN/proxy.”

Option 2 (Slightly More Detail):

“I’ve verified my Zero Trust application and policy settings. I’ve cleared browser cache, tested in incognito mode, disabled all custom WAF rules, and ensured no VPN/proxy interference.”

Option 3 (Focus on Configuration and Testing):

“I’ve reviewed my application and policy settings in Zero Trust. I have also performed standard troubleshooting steps, including browser cache clearing, incognito testing, disabling custom WAF rules, and no VPN/proxy use.”

What are the steps to reproduce the issue?

Option 1 (Most Concise):

“Simply attempt to access /wp-admin or /wp-login.php on my website. Zero Trust is not triggered.”

Option 2 (Slightly More Detail):

“Go to example.com/wp-admin or example.com/wp-login.php in a browser. You should be able to access the login page without any Zero Trust authentication challenge.”

Option 3 (Emphasizing Expected vs. Actual):

“The expected behavior is a Zero Trust authentication prompt when visiting /wp-admin or /wp-login.php. The actual behavior is the page loads directly without any authentication being required.”

Option 4 (Step-by-step approach):

Open a web browser.
Navigate to example.com/wp-admin or example.com/wp-login.php.
Observe that no Cloudflare Zero Trust authentication prompt appears.

2

How so? :thinking:

How does your Access Policy “allow” look like? Could you share a screenshot of it? Please mask the email address before sharing.

Did you authenticate already while testing?
What’s the session duration length set to? 24h or less?

Use this only, since if logged-out and you go to /wp-admin/ it will redirect you to wp-login.php.
Since Access policy is set on example.com/wp-login.php, you’d get Zero Trust login page to authenticate (PIN code or some other way if you have).
Make sure your DNS records are proxied :orange: and that you configure your Access Policy with “Include” Emails.

Helpful articles: