Cloudflare Access can put a login in front of /wp-admin and /wp-login.php. It only helps if every request really passes through Cloudflare. Without Cloudflare Tunnel, anyone who knows the origin’s address can reach WordPress directly and skip Access entirely.
DIESIS JWT Auth for Cloudflare Access closes that gap. For the paths you choose, WordPress itself checks the Cf-Access-Jwt-Assertion header that Cloudflare Access adds to authenticated requests. A request without a valid token is answered with HTTP 403 before WordPress does anything else.
What it does
- Verifies the Access JWT signature (RS256) against the signing keys of your Cloudflare Access team.
- Checks expiry, issuer and the application audience of your Access application.
- Optionally restricts access to a list of email addresses as a second check at the origin.
- Protects the paths you configure, with prefix matching and explicit exclusions.
- Caches signing keys for 12 hours and refreshes them when Cloudflare rotates keys.
What it does not do
- It does not replace the WordPress login and does not create or log in users. Visitors pass Cloudflare Access first and then sign in to WordPress as usual.
- It does not accept Cloudflare Access service tokens. Those carry no email claim and are always denied. Keep machine-to-machine paths such as cron, XML-RPC or the REST API out of the protected paths, or leave them public in both WordPress and the matching Access destination.
Safe defaults
Enforcement only runs when the settings are complete and the issuer is an HTTPS cloudflareaccess.com URL. Incomplete or invalid settings disable enforcement instead of locking you out. If Cloudflare’s key endpoint is temporarily unreachable, a previously cached key set keeps working.
Third-party service
To verify tokens the plugin downloads the public signing keys of your Cloudflare Access team from the issuer you configure, for example https://your-team.cloudflareaccess.com/cdn-cgi/access/certs. No site data is sent; the request is a plain download of public keys, repeated at most every 12 hours or after a key rotation. Cloudflare’s terms and privacy policy apply to that endpoint: Terms, Privacy policy.
Source code, issues and support: github.com/DiesisMedia/diesis-jwt-auth
Screenshots
The settings page: enforcement toggle, issuer, application audience, optional allowed emails, protected and excluded paths.