Restricting only specific pages with Zero Trust

[mcgill.choral]

What is the name of the domain?

mcgillchoral.ca

What is the issue you’re encountering

Putting specific pages behind Zero Trust doesn’t work. If I setup ZT for 5 pages (mcgillchoral.ca/internal, mcgillchoral.ca/sales etc) and then navigate to them from a fresh device, I get the Cloudflare email challenge corresponding to my Allow policy. However, if I browse the website first and then go to /internal, I can see the content of the page without any authentication.

What steps have you taken to resolve the issue?

Temporarily put a site-level password in Wordpress on the affected 5 sites.

What are the steps to reproduce the issue?

Create an application and policy for domain/path. Go to example.com/secretsite (you should see cloudflare challenge). Then go to example.com first, browse the website and then go back to example.com/secretsite. You can see the contents of secretsite without cloudflare challenge.

Screenshot of the error

[cscharff]

Your site redirects to www and https://www.mcgillchoral.ca/internal/ doesn’t match https://mcgillchoral.ca/internal/ for the Access policy.

[mcgill.choral]

Thank you, you are 100% correct, I totally forgot about the redirect rule.