About this plugin
php. It only helps if every request really passes through Cloudflare. Without Cloudflare Tunnel, anyone who knows the origin’s address can reach WordPress directly and skip Access entirely.
DIESIS JWT Auth for Cloudflare Access closes that gap. For the paths you choose, WordPress itself checks the Cf-Access-Jwt-Assertion header that Cloudflare Access adds to authenticated requests. A request without a valid token is answered with HTTP 403 before WordPress does anything else.
What it does
- Verifies the Access JWT signature (RS256) against the signing keys of your Cloudflare Access team.
- Checks expiry, issuer and the application audience of your Access application.
- Optionally restricts access to a list of email addresses as a second check at the origin.
- Protects the paths you configure, with prefix matching and explicit exclusions.
- Caches signing keys for 12 hours and refreshes them when Cloudflare rotates keys.
What it does not do
- It does not replace the WordPress login and does not create or log in users. Visitors pass Cloudflare Access first and then sign in to WordPress as usual.
- It does not accept Cloudflare Access service tokens. Those carry no email claim and are always denied. Keep machine-to-machine paths such as cron, XML-RPC or the REST API out of the protected paths, or leave them public in both WordPress and the matching Access destination.
Safe defaults
com URL. Incomplete or invalid settings disable enforcement instead of locking you out. If Cloudflare’s key endpoint is temporarily unreachable, a previously cached key set keeps working.
Third-party service
com/cdn-cgi/access/certs. No site data is sent; the request is a plain download of public keys, repeated at most every 12 hours or after a key rotation. Cloudflare’s terms and privacy policy apply to that endpoint: Terms, Privacy policy.
com/DiesisMedia/diesis-jwt-auth