How to Secure Your Website Admin Page Using Cloudflare Access

When I made one of my websites public from my home lab, I was surprised by how quickly it became a target. Within 24 hours, attackers were already trying to get into the admin page using common usernames such as admin and even the website name itself. Fortunately, I had a login attempt limit configured, so they could not try more than three passwords at a time. However, they simply switched VPN locations and continued the attacks from different IP addresses. If you do not have protections such as two-factor authentication or CAPTCHA enabled, attackers can easily automate these login attempts with bots until they eventually find a way in. In this post, I will explain how to better protect your admin page using Cloudflare. One of the best methods is to hide the login page behind an email verification step. Before anyone can access the login page, they must enter their email address and verify a one-time passcode sent to their inbox. Without the verification code, they never even reach the login screen. The best part is that this can be done through Cloudflare at no additional cost. Since Cloudflare sits in front of your website and your origin server is already hidden behind a Cloudflare Tunnel, you can stop most brute force attacks at Cloudflare’s edge network before they ever reach your home lab or your server. This adds a powerful layer of protection and significantly reduces the chance of attackers reaching your admin portal.

If you’re running through Cloudflare, you have a massive advantage. You can completely block these brute-force attacks at Cloudflare’s edge data centers before they ever reach your home lab or touch your server. Because you are using a Cloudflare Tunnel, your origin IP is already hidden, which is a great start. Now, let’s configure Cloudflare’s WAF (Web Application Firewall) to lock down the admin panel (/login.php and /admin). Here are the step-by-step changes you should make in Cloudflare right now.

1. Block Non-Country Traffic to Admin Pages (WAF Rule)

Most brute-force botnets operate globally. If you only log in from your home country, you can block or challenge anyone else trying to access your login page.

1. Go to your main Cloudflare Dashboard and select your website (mine is packetflipper.com).
2. In the left sidebar, go to Security -> WAF (Web Application Firewall).
3. Under the Custom Rules tab, click Create rule.
4. Configure the rule:
   • Rule Name: Protect Login
   • Field: URI Path | Operator: contains | Value: /login.php
   • Click the “And” button to add another condition:
   • Field: URI Path | Operator: contains | Value: /admin
   • Click “And” again to exclude your country:
   • Field: Country | Operator: does not equal | Value: [Your Home Country]
5. Choose action: Select Block or Managed Challenge (Turnstile Captcha).
6. Click Deploy.

2. Add a Turnstile Challenge to Everyone on Login

If you travel or use a VPN, blocking by country might lock you out. Instead, you can force a mandatory Cloudflare Managed Challenge (a frictionless captcha) on the login page for everyone.

1. Create a new Custom Rule in the WAF settings.
2. Name it: Login Captcha
3. Set the expression:
   • Field: URI Path | Operator: equals | Value: /login.php
4. Choose action: Select Managed Challenge.
5. Click Deploy.

Now, before a bot can even attempt to guess a password, it has to pass Cloudflare’s security challenge. Automated scripts will fail this instantly and drop away.

3. Block Aggressive Brute Force (Rate Limiting)

If a bot somehow gets past the challenge, you can stop them from guessing dozens of passwords a minute by limiting how fast they can request the login page.

1. In the WAF menu, click on the Rate Limiting Rules tab.
2. Click Create rate limiting rule.
3. Name it: Login Rate Limit
4. Set the condition:
   • Field: URI Path | Operator: contains | Value: /login.php
5. Set the Rate Limiting parameters:
   • With characteristics: IP
   • When rate exceeds: 5 requests per 10 seconds (Adjust this based on how fast you accidentally type your password).
6. Choose action: Select Block or Block for 1 hour.
7. Click Deploy.

4. The Ultimate Lockdown: Zero Trust Access (Optional but Recommended)

Since you are already using Cloudflare Zero Trust for your tunnel, you can put your entire /admin area behind a Cloudflare Access Application. This means that to even see the login page, you must first authenticate with an email PIN code, your Google account, or a hardware key.

1. Go to your Zero Trust Dashboard.
2. Navigate to Access -> Applications and click Add an application.
3. Choose Self-hosted.
4. Application name: Admin Protect
5. Domain: Your domain name (such as packetflipper.com) | Path: login.php (Create a second one for admin).
6. Set up a policy that only allows your specific personal email address to access it.

Once deployed, if a bad actor goes to your website/admin (packetflipper.com/login.php), they won’t see login screen. They will see a secure Cloudflare login wall. Bots cannot bypass this.

Note: Make sure your website Username isn’t admin or your domain name (such as packetflipper). If it is, create a new administrator account with a unique name, transfer your posts to it, and delete the generic admin account entirely. Bots always target those common names first.