Cloudflare Pages Password Protection with Access

Written & reviewed by Updated
Table of Contents

Cloudflare Pages does not offer a simple “set a site password” toggle. To restrict access to a site, configure Cloudflare Access to require an identity check, such as an email one-time PIN or a supported identity provider.

Access is stronger than a shared browser password because it checks who is allowed before serving the site. It requires more setup. TL;DR: For Cloudflare Pages password protection, use Cloudflare Access.

Cloudflare Pages password protection options

Option How it works Best use
Cloudflare Access Identity- and policy-based Team or approved-user access
Email one-time PIN Sends a code to the visitor’s email Lightweight verified-email login
Identity provider Uses Google, Microsoft, Okta, or another provider Organization access
Simple Pages password No standard toggle Use Access or another host
Revdoku protected hosting Password or verified email on exported files Client delivery

Your Cloudflare account password does not protect a website. Changing it does not protect a pages.dev site.

How to protect Cloudflare Pages with Access

Dashboard navigation may change, but the flow is:

  1. Open the Cloudflare Zero Trust dashboard.
  2. Add an Access application for the Pages domain or custom domain.
  3. Define the hostname and paths that require protection.
  4. Create an Allow policy for allowed people or email domains.
  5. Choose a login method, such as email one-time PIN or an identity provider.
  6. Save the application and policy.
  7. Open the Pages URL in a private window.
  8. Test with an allowed and a disallowed identity.

Cloudflare documents account-level enforcement in Require Access protection and the email flow in One-time PIN login.

To make a pages.dev site private, cover every hostname with Access. A custom domain may be protected while the default pages.dev address remains reachable, or vice versa, if the application and DNS configuration omit either.

Why Cloudflare Pages password protection is not a shared password

With Access, visitors normally verify their identity or email address. There may be no single client password. This helps you revoke one person’s access without changing everyone’s secret.

If you need one password for one client link, Cloudflare Access may require unnecessary infrastructure.

Use Revdoku for the exported static site

For a static website, prototype, PDF, report, or folder:

  1. Build or export the browser-ready files.
  2. Remove secrets, private notes, and development-only assets.
  3. Upload the folder to Revdoku.
  4. Choose Password for a shared secret or Verified email for identity-based entry.
  5. Add email or domain allowlists if necessary.
  6. Test the URL while signed out.

Revdoku hosts exports at a separate address. It does not lock the existing pages.dev URL.

The protected link sends visitor notifications and records page, click, and download activity. You can replace its files while the client keeps one address.

Avoid Workers-only front-end tricks

Hiding content in browser JavaScript is not a security boundary. A custom Cloudflare Worker can authenticate users, but must validate requests before returning private assets. Review it as a security-sensitive application.

Use Cloudflare Access for Cloudflare-native identity policies. Use a protected publishing service for a shorter client-delivery workflow.

Bottom line on Cloudflare Pages password protection

Protect Cloudflare Pages with an Access Allow policy and an email one-time PIN or identity provider. Pages has no standard shared-password toggle. Revdoku offers simpler separate hosting for exported client deliverables with password or verified-email access, allowlists, visitor activity, and stable updates.

Just ask to “publish to Revdoku” to publish your as a fast and secure website

from your Codex, Claude or another AI apppublish files or folders

Paste this into your AI app.

Free · Public or protected · Visitor analytics · Forms and email alerts Building websites for clients? Explore Revdoku for agencies

Frequently Asked Questions

Can I protect a Cloudflare Pages site with one shared password?

Cloudflare Pages does not provide a standard shared-password setting. Cloudflare Access instead authenticates visitors through email one-time PINs or an identity provider. If a single client password is essential, a protected hosting service for the exported site may be simpler.

Does changing my Cloudflare account password protect my Pages site?

No. Your account password controls access to the Cloudflare dashboard, not who can visit a pages.dev or custom-domain website. Visitor restrictions must be configured separately through Cloudflare Access.

How can I restrict access to specific people or organizations?

Create an Access Allow policy for individual email addresses, approved email domains, or identities supplied by your organization’s login provider. Test the policy with both an authorized and an unauthorized account before sharing the site.

Do I need to protect both the custom domain and the pages.dev address?

Yes, if both addresses can serve the site. An Access policy covering only one hostname may leave the other publicly reachable. Verify every active hostname and any sensitive paths in a private browsing session.

When should I use an email one-time PIN instead of an identity provider?

An email one-time PIN works well for lightweight access when visitors do not share an organization login. An identity provider such as Google, Microsoft, or Okta is generally better for managed team access and centralized account control.

Can JavaScript or a Cloudflare Worker hide private site content?

Client-side JavaScript cannot securely protect files because visitors may retrieve the underlying assets directly. A Worker can provide authentication only if it validates every request before returning protected content, making it a security-sensitive implementation. Cloudflare Access is usually the safer native choice.

Does protecting an exported site elsewhere secure the original Pages URL?

No. Services such as Revdoku create a separate protected address for uploaded exports but do not change access to the existing Cloudflare Pages deployment. Remove sensitive material from the export and separately disable or protect any original public URL.

Share:
Markdown version
#Cloudflare Pages#Cloudflare Access#password protection#Zero Trust#Revdoku

History

  • August 11, 2026 — Published by Revdoku Content Team
  • August 1, 2026 — Reviewed by Eugene Mi
  • September 5, 2026 — Last updated by Revdoku Content Team.

Related Articles

↧
Loading PDF…