Cloudflare is a powerful security and performance tool for WordPress sites, but overly strict firewall or Web Application Firewall (WAF) rules can sometimes prevent legitimate users from accessing the site’s backend. We recently worked with a client who kept encountering Cloudflare critical error screens when attempting to log in and edit their WordPress site, even though the site frontend was working normally.
Here’s how we identified and fixed the issue.
Issue Background
The client reported that multiple team members, using different devices, were being blocked when attempting to log into the WordPress admin.
Symptoms included:
- Cloudflare “critical error” page displayed instead of the dashboard.
- Errors persisted even after clearing caches, logging out, and testing in private/incognito mode.
- The issue was reproducible for more than one team member, ruling out a local browser problem.
Diagnosis
Our investigation revealed:
- The Cloudflare block was not due to WordPress itself, but Cloudflare’s Web Application Firewall (WAF) filtering requests.
- The affected users were connecting through a VPN. Cloudflare was flagging their VPN IP addresses as suspicious and blocking access.
- Other users without VPN enabled were able to access the backend without issues.
Resolution Steps
We took the following steps to restore access:
- Replicated the issue: Confirmed that the block only occurred for users connecting through specific VPN IP addresses.
- Cloudflare security settings: With access from the client’s CTO, we navigated to:
- Cloudflare Dashboard → Security → WAF
- Added the VPN IP addresses to the allowlist.
- Verified with multiple users: After whitelisting, we tested again with three different users on different connections. All were able to log into WordPress without encountering the Cloudflare block.
- Documented future-proofing: Advised the client to:
- Maintain an up-to-date list of VPN IP addresses.
- Use Cloudflare’s “Allow” rules instead of temporarily disabling protections.
- If issues persist, set up Cloudflare Access policies to define trusted networks for admin access.
Final Outcome
By adjusting the Cloudflare firewall settings, legitimate users regained consistent access to the WordPress backend without disabling important security features.
This fix balanced security (keeping Cloudflare’s protections in place) with usability (ensuring that authorized editors can always log in).
If your team is experiencing login issues or Cloudflare is blocking access to your WordPress site, contact Freshy for expert support in configuring Cloudflare for both security and usability.
