Tutorial - protect your admin login with CloudFlare Zero Trust

CyberCommander

CyberCommander

Power Member
Joined
Dec 30, 2019
Messages
637
Reaction score
735
Hi guys

Today I share with you a small "life hack" how to protect the admin login of your website/plattform with CloudFlare Zero Trust (it's free)

Requirement:
your domain uses the DNS of Cloudflare

Step 1:
Log in to cloudflare

Step 2:
click on Zero Trust
1689888462840.png


Step 3:
click on Access --> Access Groups
1689888526601.png


Step 4:
click on add a group
1689888631896.png


Step 5:
Type a Group Name & Group Configuration --> E-Mail --> Your E-Mail Address --> Save
1689888937639.png


Step 6:
click on Access --> Applications
1689888960982.png


Step 7:
click on Add an application
1689889007290.png


Step 8:
select self-hosted
1689889052229.png


Step 9:
type an app name & give the path to your admin login (my example is wp-login.php for the wordpress admin login)
1689889292826.png


Step 10:
scroll down and disable "Accept all available identity providers" and click next
1689889561883.png
 

Attachments

  • 1689888776433.png
    1689888776433.png
    39.6 KB · Views: 149
Last edited:
Advertise on BHW
Step 11:
type a policy name, select your access group and click on next
1689890536523.png


Step 12:
scroll down and click on add application

Step 13:
open in your browser your admin login URL
www.yoururl.com/wp-login.php

The URL should be now protected by Cloudflare Access
1689890585554.png


Step 14:
type your e-mail address from the access group and you should recive a 2FA code from Cloudflare^^


This is a quick tutorial how you can protect your admin login sites very fast.
You can try also other auth solutions. 2FA via E-Mail is only an example.

Give me a like and follow me for more tutorials in the future :)
 
Very nice tutorial, and this is applicable for any protected page, not only for wp login. I was using workers to do this before (well, kind of.. It was username/password based login, not otp based) but this is a much better alternative IMO.
 
Last edited:
awesome tutorial, didn't know about Zero Trust.

I've been using Security >> WAF >> Custom Rules, to do Block on a rule like (http.request.uri contains "/wp-login.php") that's an IP-based whitelist. Then under Tools tab, IPs could be Allowed.
 
Excellent share! But tried twice and can't get it to work, after going all steps, I try to access the protected pagebut only shows the normal wordpress login, maybe its because of the fact that I changed the default login address?
 
papanoel666 said:
Excellent share! But tried twice and can't get it to work, after going all steps, I try to access the protected pagebut only shows the normal wordpress login, maybe its because of the fact that I changed the default login address?
Click to expand...
if you have changed your login file wp-login.php you have to change the path to YourLoginFile.php

1696704403187.png
 
Great tutorial, thanks for sharing
 
That's cool. I didn't know cloudflare could do this. Cloudflare is pretty amazing. They are probably selling everyone's data on the free tier though lol but it's good enough for me not to care.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top