Safe to Block wp-admin on Cloudflare?
The user dashboard on FluentCart doesn't use /wp-admin/ as the path, so is it safe to block it if my users will only be using the FluetnCart dashboard? Anyone done this before? And yes, obviously I'd have a skip rule for my ip. I already block it on sites where only admins login, but I haven't done it for sites where users can login.
I think you have the answer. I use Rule #1 for allowed users and good bots with a Skip rule. The other rules block wp-admin and some other URLs on my last rule. It takes some tweaking, but it's nice to look at the Cloudflare event logs and see all of those blocks working.
William Beem thanks! But your blocks should be second because any managed challenges in the middle will skip the remaining rules. At least that's been my experience.
Matt Zimmerman It all depends how you determine the flow from 1 to 5 (assuming the free plan). What do you allow and what do you prohibit?
If a criteria is met on a previous rule, it can skip for a user or block it (or managed challenge). Every visitor doesn't have to go through all five rules.
William Beem good point.
Blocking wo-admin access with the WAF rules is bad practice. Use Cloudflare‘s Zero Trust instead. That is particularly made for this.
André Daus That is a fair point and you are tapping into what is now considered a modern standard for web security. Using Cloudflare Zero Trust to protect an admin area is a very effective move because it removes the login page from the public internet entirely. It requires identity verification before a user can even reach the site, which is a significant upgrade over traditional methods.
However, calling WAF rules a bad practice might be a bit strong depending on the context. It is often a matter of choosing the right tool for a specific set of needs.
The Zero Trust approach is the professional choice for teams or anyone who travels frequently. Since it relies on identity rather than location, you do not have to manage changing IP addresses or manual whitelist rules. It also allows for an additional layer of authentication, such as a Google or GitHub login, making the backend nearly invisible to unauthorized users.
On the other hand, a well-configured WAF rule remains a pragmatic and useful tool. For a solo user or a simple project, setting up a full identity provider can be unnecessary over-engineering. A simple WAF rule or a Managed Challenge can be deployed in seconds and will still stop the vast majority of automated attacks. It also removes the risk of being locked out of a site if an external identity provider experiences an outage.
While Zero Trust is the more robust and future-proof method, WAF rules are still a solid line of defense that works well for many sites without adding extra configuration overhead. It really comes down to the level of complexity you are willing to manage.
William Beem Zero Trust and the WAF aren’t alternatives. They’re complementary, and they serve fundamentally different purposes. Swapping one for the other isn’t a modern upgrade, it’s a category error (or bad practice for that matter).
A firewall has one job: open the gate or close it. Cloudflare adds a third state, "challenge", which is basically a conditional open. The moment you start using WAF rules to both block and allow access to the same path, you’re fighting the tool rather than using it. Skip rules for your own IP in this case are just a workaround for misusing the layer.
Zero Trust operates before the request ever reaches your origin. It’s about identity, not traffic filtering. Those are different problems.
As for blocking /wp-admin/ specifically, it’s a worse idea than it looks. A blanket block on that path also kills admin-ajax.php, which many plugins depend on for legitimate front-end functionality. Meanwhile, wp-login.php sits outside that path entirely and stays wide open. You haven’t secured the attack surface, instead you’ve just created a new set of breakage while leaving the obvious entry point untouched.
Use the right tool for the right job: WAF for traffic you want to block outright (bots, ASNs, countries, known bad actors), Zero Trust for protecting authenticated access. Neither replaces the other.
André Daus I sense you're one of those folks who thinks he's always right and doesn't consider the impact of alternatives for people in different positions than you.
In other words, you don't understand why someone would choose an alternative, so you don't accept it.
William Beem no personal position here, just technical accuracy. The argument stands on its own: /wp-admin/ blocks admin-ajax.php and leaves wp-login.php untouched. That’s not a matter of preference or context, it’s just how WordPress routing works.
If someone finds WAF skip rules easier to manage than Zero Trust, that’s a valid practical trade-off. But a tool choice being convenient doesn’t make it correct, and pointing that out isn’t the same as dismissing the person making it.
André Daus That is precisely the response I expected from you. Take care.
FluentAuth has an option for this