Cloudflare Zero Trust and Access

Cloudflare Access (part of Zero Trust) puts an identity check in front of a URL — visitors must authenticate (e.g., with a Google login) before the request ever reaches your origin. Perfect for admin panels and edit routes.

#The idea

visitor → Cloudflare Access (login required) → [allowed] → origin app
                                              → [denied]  → blocked at the edge

This complements the app's own login — even the login page becomes invisible to the public.

#Setup (dashboard)

1. Zero Trust → Access → Applications → Add → Self-hosted.
2. Application domain: e.g. wiki.thelabsource.com with path /login and /edit*.
3. Policy: Allow → Emails → your Google address.
4. Identity provider: Google (or one-time PIN email).

#Why gate paths, not the whole site

Result: the wiki stays publicly readable, but the entire editing surface requires your identity at the Cloudflare edge — defense in depth on top of the app's single-admin login. Traffic reaches the origin via the tunnel.