Description
Cloudflare Access can put a login in front of /wp-admin and /wp-login.php. It only helps if every request really passes through Cloudflare. Without Cloudflare Tunnel, anyone who knows the origin’s address can reach WordPress directly and skip Access entirely.
DIESIS JWT Auth for Cloudflare Access closes that gap. For the paths you choose, WordPress itself checks the Cf-Access-Jwt-Assertion header that Cloudflare Access adds to authenticated requests. A request without a valid token is answered with HTTP 403 before WordPress does anything else.
What it does
- Verifies the Access JWT signature (RS256) against the signing keys of your Cloudflare Access team.
- Checks expiry, issuer and the application audience of your Access application.
- Optionally restricts access to a list of email addresses as a second check at the origin.
- Protects the paths you configure, with prefix matching and explicit exclusions.
- Caches signing keys for 12 hours and refreshes them when Cloudflare rotates keys.
What it does not do
- It does not replace the WordPress login and does not create or log in users. Visitors pass Cloudflare Access first and then sign in to WordPress as usual.
- It does not accept Cloudflare Access service tokens. Those carry no email claim and are always denied. Keep machine-to-machine paths such as cron, XML-RPC or the REST API out of the protected paths, or leave them public in both WordPress and the matching Access destination.
Safe defaults
Enforcement only runs when the settings are complete and the issuer is an HTTPS cloudflareaccess.com URL. Incomplete or invalid settings disable enforcement instead of locking you out. If Cloudflare’s key endpoint is temporarily unreachable, a previously cached key set keeps working.
Third-party service
To verify tokens the plugin downloads the public signing keys of your Cloudflare Access team from the issuer you configure, for example https://your-team.cloudflareaccess.com/cdn-cgi/access/certs. No site data is sent; the request is a plain download of public keys, repeated at most every 12 hours or after a key rotation. Cloudflare’s terms and privacy policy apply to that endpoint: Terms, Privacy policy.
Source code, issues and support: github.com/DiesisMedia/diesis-jwt-auth
Screenshots
Installation
- Create a self-hosted application in Cloudflare Zero Trust that covers your WordPress login and admin paths, and note the team domain (the issuer) and the application audience tag.
- Install the plugin from the WordPress plugin directory or upload the ZIP under Plugins > Add New Plugin > Upload Plugin, then activate it.
- Open Settings > DIESIS JWT Auth.
- Enter the issuer, for example
https://your-team.cloudflareaccess.com, and the application audience. Save with enforcement still disabled. - Check that the protected paths match the paths your Access application covers. The defaults protect
/wp-login.phpand/wp-admin. - Enable enforcement and save.
- Test twice: once through your Cloudflare URL, which should work, and once directly against the origin, which should return 403.
FAQ
-
I excluded a path in WordPress, but Cloudflare still asks me to log in.
-
Exclusions in this plugin only stop the origin check. Cloudflare Access decides on its own which paths it intercepts. Leave the path public in the Access application as well.
-
Why does a request get a 403?
-
Any failed check ends in 403: no
Cf-Access-Jwt-Assertionheader, a token not signed with RS256, an invalid or expired signature, a wrong issuer or audience, a missing email claim, or an email that is not on the allowed list. WithWP_DEBUGenabled the reason is written to the PHP error log. -
I locked myself out. How do I get back in?
-
Make sure you are opening the site through Cloudflare, not through the origin’s own address, and that the Access application covers the same paths as the plugin. If you need to disable the plugin without admin access, rename or delete its folder under
wp-content/plugins/via SFTP or your host’s file manager. -
What happens when Cloudflare’s certificate endpoint is down?
-
A cached key set stays valid for 12 hours and keeps working. Only if there are no cached keys at all and Cloudflare cannot be reached are protected requests denied.
-
Does the plugin work with Cloudflare Access service tokens?
-
No. Service tokens carry a
common_nameinstead of an email and are always denied. Keep paths used by machines out of the protected paths. -
Does it work on multisite?
-
Yes. Settings are per site, and uninstalling cleans up every site of the network.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“DIESIS JWT Auth for Cloudflare Access” is open source software. The following people have contributed to this plugin.
Contributors
Translate “DIESIS JWT Auth for Cloudflare Access” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.3.0
- The plugin slug and text domain are now
diesis-jwt-auth; the option and cached key names follow it.
1.2.0
- Renamed to DIESIS JWT Auth for Cloudflare Access; first release in the WordPress plugin directory.
- The bundled JWT library is now namespaced to this plugin, so another plugin shipping a different version cannot replace it.
- Fixed the release build appending to an existing ZIP.
- The settings page and menu entry carry the plugin name.
- The release package contains only the files the plugin needs; development and agent files stay out.
1.1.0
- An issuer that is not an HTTPS cloudflareaccess.com URL, or settings missing the issuer or audience, now disable enforcement instead of denying access. A bad option row can no longer lock the site.
- During a Cloudflare outage without cached keys, a protected request makes one key fetch instead of two and is denied with the reason
keys_unavailable. - The key refresh throttle counts every fetch attempt, so an unknown key id costs at most one extra fetch per five minutes.
- Uninstall no longer depends on the vendor directory.
1.0.1
- Security: request paths are canonicalized before matching, so encoding and dot-segment tricks such as
/a/../wp-login.phpcan no longer dodge a protected path. - Uninstall removes the option from every site on a multisite network and clears cached keys from persistent object caches.
- Accept boolean and integer
truefor the enforcement flag on programmatic option updates.
1.0.0
- Initial release: validates Cloudflare Access JWTs at the WordPress origin, protects configurable login and admin paths, optional email allowlist.