.htacces Folder Protection asking again and again due to CF cache

[fritex]

May I ask you to check what option have you got selected under the Browser Cache TTL at Cloudflare dashboard for your domain name?

You could check this by navigating to the Caching → Configuration
→ I’d suggest you to set it (if already not) to “Respect Existing Headers”

Similar topic:

.htpasswd doesn't apply to Cloudflare-protected websites

Hm, weird. Usually, it has no impact and works fine being served from the origin. Furthermore, there were users who have had 401 Authorization enabled and we saw it while using Cloudflare and the hostname was proxied . Are you sure you have correctly defined the directory path for protection with 401 auth and the is the .htaccess among .htpasswd file path containing correct credentials also located in the needed directory which you want to protect? Are you sure your Web server suppor…

Furthermore, I’d not suggest you to protect “wp-admin” with a password as far as some plugins, including WordPress core uses some of the resources like JS or CSS files on themes, JSON, REST API, etc.

Therefore, you’d be asking for “username & password” each of your visitor.

There are much better ways to protect your WordPress admin dashboard / WordPress login using Cloudflare, if so.

If interested, I am sharing my post here which contains a lot of useful information about this topics:

What Request to Block in Firewall for Wordpress and Normalize URLs

That is a good question out there. I would say it cannot be stated as a general rule of thumb, as far as some WordPress websites do not have to use like POST or PUT (WP REST API, wp-json, plugins etc.), while other have to - just an example. You could try to block TRACE & TRACK for example. Or, if you could for example, limit HEAD, GET and POST for some specific IP or some similar scenario, where you protect your Website from bad bots, possible attacks, etc. in terms of security measurements. …

I’d suggest you to take a look at Cloudflare Access / Zero Trust to protect your WP Login

Combining Cloudflare Access and Firewall Rules to protect WordPress

You shouldn’t need such blanket protection of the wp-admin directory. I spend a lot of time combing through WordPress logs and find the worst offenders seem to be targeting wp-login, xmlrpc, and admin-ajax. Plus other random fits of inspiration: vulnerable plugins, random config files. My approach is to use Access to protect wp-login, then Firewall Rules to Challenge or Block all the other noise.

Ideas:

Using Cloudflare Access to protect Wordpress Admin sites - msandbu.org