Summary: I put an identity check in front of the WordPress login page of fastweb.com.ng using Cloudflare Access, so only verified users can reach it. I used GitHub as the login method and added a country-based rule on top.

Perquisite

  1. Cloudflare Account
  2. GitHub Account

The problem
WordPress login pages such as /wp-admin and /wp-login.php are public by default, so bots constantly try to guess passwords on them. I already had a WAF, bot protection, and Turnstile in place, but the login page was still visible to everyone. I wanted to reduce that exposure.

The solution: Zero Trust with Cloudflare Access
Zero Trust means never trust a request by default; verify it every time. Cloudflare Access puts a checkpoint in front of the login page. Visitors must prove who they are before they can even see the WordPress login form.

My layers, from outside to inside:

  1. Cloudflare WAF and bot mitigation filter malicious traffic.
  2. Cloudflare Access verifies identity with GitHub SSO.
  3. Turnstile checks that the visitor is human.
  4. The WordPress password is the final layer. This is defence-in-depth: if one layer fails, the others still protect the site

Step-by-step implementation

Step 1: Visit your Cloudflare account and Login
Step 2: Click on Access Controls—>Applications


Step 3: Click on Applications and create new applications


Fill in the details as shown in the fields above and click on save
Step 4: Click on Zero Trust in Cloudflare

Today we will be using https://github.com/login as our identity provider


Add GitHub as an identity provider.

In GitHub, I created an OAuth App under Developer settings. I set the callback URL to my Cloudflare team’s /cdn-cgi/access/callback address, then copied the Client ID and Client Secret into Cloudflare’s GitHub login method and used the Test button. [Screenshot: Login methods page. Never show the client secret.]

What this means: GitHub vouches for my identity, and Cloudflare trusts its answer. This is OAuth-based identity federation, the same idea as “Sign in with Google".

Now copy the client ID from GitHub and go back to Cloudflare past it, and also generate the secret key and paste it in the field below. Then copy the callback URL back to GitHub