# Cloudflare Pages Password Protection with Access

> Learn how to protect Cloudflare Pages with Access, email one-time PINs, identity providers, or simpler protected hosting.

Cloudflare Pages does not offer a simple “set a site password” toggle. To restrict access to a site, configure Cloudflare Access to require an identity check, such as an email one-time PIN or a supported identity provider.

Access is stronger than a shared browser password because it checks who is allowed before serving the site. It requires more setup. **TL;DR:** For Cloudflare Pages password protection, use Cloudflare Access.

## Cloudflare Pages password protection options

| Option | How it works | Best use |
|---|---|---|
| Cloudflare Access | Identity- and policy-based | Team or approved-user access |
| Email one-time PIN | Sends a code to the visitor’s email | Lightweight verified-email login |
| Identity provider | Uses Google, Microsoft, Okta, or another provider | Organization access |
| Simple Pages password | No standard toggle | Use Access or another host |
| Revdoku protected hosting | Password or verified email on exported files | Client delivery |

Your Cloudflare account password does not protect a website. Changing it does not protect a `pages.dev` site.

## How to protect Cloudflare Pages with Access

Dashboard navigation may change, but the flow is:

1. Open the Cloudflare Zero Trust dashboard.
2. Add an Access application for the Pages domain or custom domain.
3. Define the hostname and paths that require protection.
4. Create an **Allow** policy for allowed people or email domains.
5. Choose a login method, such as email one-time PIN or an identity provider.
6. Save the application and policy.
7. Open the Pages URL in a private window.
8. Test with an allowed and a disallowed identity.

Cloudflare documents account-level enforcement in [Require Access protection](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/require-access-protection/) and the email flow in [One-time PIN login](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/).

To make a `pages.dev` site private, cover every hostname with Access. A custom domain may be protected while the default `pages.dev` address remains reachable, or vice versa, if the application and DNS configuration omit either.

## Why Cloudflare Pages password protection is not a shared password

With Access, visitors normally verify their identity or email address. There may be no single client password. This helps you revoke one person’s access without changing everyone’s secret.

If you need one password for one client link, Cloudflare Access may require unnecessary infrastructure.

## Use Revdoku for the exported static site

For a static website, prototype, PDF, report, or folder:

1. Build or export the browser-ready files.
2. Remove secrets, private notes, and development-only assets.
3. Upload the folder to Revdoku.
4. Choose **Password** for a shared secret or **Verified email** for identity-based entry.
5. Add email or domain allowlists if necessary.
6. Test the URL while signed out.

Revdoku hosts exports at a separate address. It does not lock the existing `pages.dev` URL.

The protected link sends visitor notifications and records page, click, and download activity. You can replace its files while the client keeps one address.

## Avoid Workers-only front-end tricks

Hiding content in browser JavaScript is not a security boundary. A custom Cloudflare Worker can authenticate users, but must validate requests before returning private assets. Review it as a security-sensitive application.

Use Cloudflare Access for Cloudflare-native identity policies. Use a protected publishing service for a shorter client-delivery workflow.

## Bottom line on Cloudflare Pages password protection

Protect Cloudflare Pages with an Access Allow policy and an email one-time PIN or identity provider. Pages has no standard shared-password toggle. Revdoku offers simpler separate hosting for exported client deliverables with password or verified-email access, allowlists, visitor activity, and stable updates.

Just ask to “publish to Revdoku” to
publish your HTML pages presentation dashboard app prototype game prototype
as a fast and secure website

from your Codex , Claude or another AI app publish files or folders

Connect
Skill
MCP

Paste this into your AI app.

Copy

Install the Revdoku skill in your AI app.

Copy
npx skills add revdoku/revdoku --skill revdoku -g

Choose your AI app to connect through MCP.

Codex CLI
Claude Code
Other

Copy codex mcp add revdoku --url https://app.revdoku.com/mcp
codex mcp login revdoku

Copy claude mcp add --transport http revdoku https://app.revdoku.com/mcp
claude mcp login revdoku

Transport Streamable HTTP Auth Browser OAuth

Copy https://app.revdoku.com/mcp

Open the MCP setup guide →

Free · Public or protected · Visitor analytics · Forms and email alerts Building websites for clients? Explore Revdoku for agencies →

## Frequently Asked Questions

### Can I protect a Cloudflare Pages site with one shared password?

Cloudflare Pages does not provide a standard shared-password setting. Cloudflare Access instead authenticates visitors through email one-time PINs or an identity provider. If a single client password is essential, a protected hosting service for the exported site may be simpler.

### Does changing my Cloudflare account password protect my Pages site?

No. Your account password controls access to the Cloudflare dashboard, not who can visit a `pages.dev` or custom-domain website. Visitor restrictions must be configured separately through Cloudflare Access.

### How can I restrict access to specific people or organizations?

Create an Access Allow policy for individual email addresses, approved email domains, or identities supplied by your organization’s login provider. Test the policy with both an authorized and an unauthorized account before sharing the site.

### Do I need to protect both the custom domain and the pages.dev address?

Yes, if both addresses can serve the site. An Access policy covering only one hostname may leave the other publicly reachable. Verify every active hostname and any sensitive paths in a private browsing session.

### When should I use an email one-time PIN instead of an identity provider?

An email one-time PIN works well for lightweight access when visitors do not share an organization login. An identity provider such as Google, Microsoft, or Okta is generally better for managed team access and centralized account control.

### Can JavaScript or a Cloudflare Worker hide private site content?

Client-side JavaScript cannot securely protect files because visitors may retrieve the underlying assets directly. A Worker can provide authentication only if it validates every request before returning protected content, making it a security-sensitive implementation. Cloudflare Access is usually the safer native choice.

### Does protecting an exported site elsewhere secure the original Pages URL?

No. Services such as Revdoku create a separate protected address for uploaded exports but do not change access to the existing Cloudflare Pages deployment. Remove sensitive material from the export and separately disable or protect any original public URL.

---

[View the canonical page](https://revdoku.com/blog/how-to-password-protect-a-cloudflare-pages-site/) · [Browse llms.txt](https://revdoku.com/llms.txt)