# Cloudflare Pages Password Protection with Access

> Protect Cloudflare Pages previews, production URLs, and custom domains with Cloudflare Access, email one-time PINs, and identity policies.

Cloudflare Pages uses Cloudflare Access to restrict visitors through identity checks, such as an email one-time PIN or an organization login. It does not have a standard shared site-password setting.

Configure protection for each hostname that can serve your content. A protected preview does not mean the production site is private.

## Choose who can visit

| Login method | Suitable audience |
|---|---|
| Email one-time PIN | Named visitors who can receive an email code |
| Organization identity provider | People with an approved work account |

Create an Access **Allow** policy for the intended email addresses, domains, or identities. For email codes, follow Cloudflare’s [one-time PIN setup](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/). Your Cloudflare account password controls the dashboard, not access to the website.

## Protect preview deployments

1. Open the Pages project in Cloudflare.
2. Go to **Settings > General** and select **Enable access policy**.
3. Open the resulting Access application and review its Allow policy.
4. Test a preview URL with an approved and an unapproved account.

The Pages toggle protects preview hostnames such as ` . .pages.dev`. It does **not** protect ` .pages.dev` or a custom domain. Cloudflare describes this distinction in its [preview deployment documentation](https://developers.cloudflare.com/pages/configuration/preview-deployments/).

## Protect the production pages.dev address

Follow Cloudflare’s [production Access instructions](https://developers.cloudflare.com/pages/platform/known-issues/#enable-access-on-your-pagesdev-domain):

1. Enable the Pages access policy, then select **Manage Access policy**.
2. Find the project in **Access > Applications** and choose **Configure**.
3. In its public hostname, remove the wildcard `*` from the subdomain so the application covers ` .pages.dev`. Save.
4. Return to the Pages settings and enable the access policy again to restore preview protection.
5. Verify that both the production hostname and `*. .pages.dev` have Access coverage and the intended Allow policies.

The production address and the wildcard previews are separate entries. Check both after changing either application.

## Protect a custom domain

In the Zero Trust dashboard, open **Access controls > Applications**, create a **Self-hosted and private** application, add the custom domain as its public hostname, and configure the Allow policy. Cloudflare includes this flow in its [Pages Access instructions](https://developers.cloudflare.com/pages/platform/known-issues/#enable-access-on-your-pagesdev-domain).

Do not stop after protecting the custom domain: the original `pages.dev` addresses can still provide another route to the same content.

## Test every route to the site

Make a short list of production, preview, branch, and custom-domain URLs before testing. Use a private browser window without an existing Access session.

- An approved visitor should reach the site after signing in.
- An unapproved visitor should be denied.
- A direct link to a PDF, image, or other private asset should require the same access check.
- Old deployment links should follow the intended policy too.

If a URL opens without authentication, inspect the application’s hostname and path coverage before sharing it. Repeat the check after adding a domain or changing policies.

## Avoid browser-only password screens

A JavaScript prompt can hide a page visually while leaving its files downloadable. Authentication needs to happen before private content is served. A custom Worker can implement that check, but then you are responsible for protecting every request and maintaining the authentication code.

Give your AI agent
a free email address

Your AI agent or app gets a unique email address, like myagent@revdokumail.com . It can receive emails and attachments, send replies and store files.

Create your AI agent’s inbox

Connect AI…

Copy this setup prompt and paste it into ChatGPT, Claude or another AI app. It walks you through signup and connecting.

Copy setup prompt

Connect Revdoku so you can manage mailboxes for my AI agents, read emails and attachments, and store files. Follow https://revdoku.com/llms-install.md to set up access.

Developer options
Skill MCP cURL TS/JS Python

npx skills add revdoku/revdoku --skill revdoku -g

For Claude Code, Codex, Cursor and other coding agents.

https://mcp.revdoku.com

Add as a custom connector in Claude, ChatGPT or Cursor. Steps

curl https://api.revdoku.com/v1/mailboxes \
-H "Authorization: Bearer $REVDOKU_API_KEY"

Lists your mailboxes. A Read & write key also returns each email address. API reference

const key = process.env.REVDOKU_API_KEY;
const res = await fetch("https://api.revdoku.com/v1/mailboxes", {
headers: { Authorization: `Bearer ${key}` },
});
console.log(await res.json());

Lists your mailboxes. A Read & write key also returns each email address. API reference

import os, requests
key = os.environ["REVDOKU_API_KEY"]
res = requests.get(
"https://api.revdoku.com/v1/mailboxes",
headers={"Authorization": f"Bearer {key}"},
timeout=30,
)
print(res.json())

Lists your mailboxes. A Read & write key also returns each email address. API reference

## Frequently Asked Questions

### Can I protect a Cloudflare Pages site with one shared password?

Cloudflare Pages has no standard shared-password setting. Use Cloudflare Access with email one-time PINs or an identity provider, and define who is allowed to visit.

### Does Enable access policy also protect my production Pages site?

No. The Pages toggle protects preview hostnames. The production project.pages.dev address and custom domains need separate Access coverage. Test every hostname that can serve the site.

### Does changing my Cloudflare account password protect my Pages site?

No. Your account password controls access to the Cloudflare dashboard, not who can visit a `pages.dev` or custom-domain website. Visitor restrictions must be configured separately through Cloudflare Access.

### How can I restrict access to specific people or organizations?

Create an Access Allow policy for individual email addresses, approved email domains, or identities supplied by your organization’s login provider. Test the policy with both an authorized and an unauthorized account before sharing the site.

### Do I need to protect both the custom domain and the pages.dev address?

Yes, if both addresses can serve the site. An Access policy covering only one hostname may leave the other publicly reachable. Verify every active hostname and any sensitive paths in a private browsing session.

### When should I use an email one-time PIN instead of an identity provider?

An email one-time PIN works well for lightweight access when visitors do not share an organization login. An identity provider such as Google, Microsoft, or Okta is generally better for managed team access and centralized account control.

### Can JavaScript or a Cloudflare Worker hide private site content?

Client-side JavaScript cannot securely protect files because visitors may retrieve the underlying assets directly. A Worker can provide authentication only if it validates every request before returning protected content, making it a security-sensitive implementation. Cloudflare Access is usually the safer native choice.

---

[View the canonical page](https://revdoku.com/blog/how-to-password-protect-a-cloudflare-pages-site/) · [Browse llms.txt](https://revdoku.com/llms.txt)