How to Lockdown WordPress Login Page with Cloudflare

Keeping your WordPress site secure is crucial. A common target for attackers is the login page, specifically /wp-login.php. Fortunately, with Cloudflare, you can add an extra layer of security to lockdown the WordPress login page.

This article explores how to create a web rule inside Cloudflare to lock down your WordPress login.

Tutorial: How to Lockdown Your WordPress Login with Cloudflare

Watch the video tutorial on how to protect your WordPress Login with Cloudflare.

Steps on How to Lockdown WordPress Login Cloudflare

Follow the steps below to block your WordPress login page (/wp-login.php).

Access the Website inside Cloudflare

• Log in to your Cloudflare Dashboard: Visit Cloudflare and sign in to your account.
• Select Your Website: From the Website view, select the site whose login page you want to protect.

Create the Firewall Rule

1. Navigate to Firewall Settings: Go to the “Security” section in the Cloudflare website settings.
2. Proceed to WAF: Under the security dropdown, select “WAF (Web Application Firewall).”
3. Select Firewall Rule Template: Within the WAF settings, find the Rules Templates section and select the Zone lockdown template.

Define the WordPress Login Lockdown Cloudflare Rule

Now, you will set up a rule to block anyone who isn’t on your allowed IP list from reaching your login page. Here is how you can define the web rule.

1. Rule Name: Rename the rule template with a descriptive name.
2. Allowed IP Address: Next, specify which IP addresses can access the login page. Here, we will reference a list of allowed IPs “admin_ip.” We will look into this list later. Hence, this rule basically blocks any IP address that isn’t on your “admins_ip” list.
3. URI Path for Login Page: In the “URI path” field, enter /wp-login.php. This targets the specific path of your WordPress login page. We tell the rule to only block access to the login page (/wp-login.php) for visitors not on your allowed list.
4. Action: From the “Action” dropdown menu, choose “Block.” This action denies access to the login page for unauthorized IP addresses. You can also choose other actions such as Managed Challenge, JS Challenge, Interactive Challenge, etc.
5. Deployment: Click the Deploy button to implement the web rule.

Allowed IP Addresses List

In previous steps, we mentioned an “admin_ip list.” This is where you add the IP addresses you want to allow access to the login page.

You can create lists like allowed IPs inside Cloudflare and use them for different security settings. To access this feature,

• Go to your website Cloudflare settings.
• Via the sidebar menu, go to Manage Account.
• Under the Manage Account submenu, proceed to Configurations.
• In the “Configurations” area, you can create or edit your custom list IP address lists.

Test Your Rule

Once you’ve saved the rule, try accessing the wp-login.php page.

• Success: If you use an IP address you listed as allowed, you should be able to access the login page normally.
• Blocked: If you try logging in with a different IP address (not on your list), you should not access the login page.

Conclusion

Keeping your WordPress login safe is the most important thing to stop hackers from getting in and messing with your site.

Follow these steps to lock down your WordPress login! This will prevent random IP addresses from accessing your website’s login page.

Frequently Asked Questions