Cloudflare Errors

Cloudflare Blocking wp-admin (WordPress Repair)

Intermediate Risk: medium

Last reviewed August 8, 2026

Hosting access may not be needed Database access usually not needed

Direct answer

When Cloudflare is blocking wp-admin, check Security Events for a WAF, custom rule, rate limit, or Bot Fight action on /wp-admin/ and /wp-login.php, then allowlist your IP or skip the false-positive rule for those paths—without turning off protection for the whole site.

WordPress Repair for a Cloudflare-blocked admin starts at the edge, not in the WordPress users table. Custom WAF rules, managed rulesets, Under Attack Mode, and Zero Trust Access can return 403, 1020, challenges, or endless interstitial pages on login while the public site still loads. This guide shows how to read the block, restore admin access safely, and keep sane protection for everyone else.

Intermediate

Key facts

Verifiable numbers and definitions — each claim links to its source.

Cloudflare WAF custom rules can block requests to admin paths such as /wp-admin/ unless they come from specified IP addresses. (Cloudflare — site admin known IPs)
Security Events lists requests Cloudflare security products acted on or flagged so you can identify false positives. (Cloudflare — Security Events)
Cloudflare documents hardening CMS admin areas (including WordPress /wp-admin/) with WAF managed rules and scoped exceptions. (Cloudflare — CMS web security)

What the error means

Orange-cloud traffic hits Cloudflare before WordPress. Rules aimed at `/wp-admin/*` and `/wp-login.php`—IP allowlists, managed challenges, rate limits, Bot Fight Mode, or Access applications—can deny or challenge your browser even when the password is correct. Visitors may still browse the front end because those paths are not covered by the same rule. Cloudflare’s own WAF examples show blocking admin paths unless the source IP is known; that pattern is great until your home IP changes, you travel, or a teammate works from a new network. Security Events (firewall events) list which product acted and which action fired. This is distinct from a WordPress security-plugin lockout or a login redirect loop: if Security Events show a Cloudflare block/challenge on the admin URL, fix the edge rule first. Also watch for overly broad rules that catch `/wp-admin/admin-ajax.php`, which many front-end features need.

Common symptoms

wp-admin or wp-login.php returns Cloudflare 403, 1020, or “Access denied” while the public site loads
Cloudflare challenge or CAPTCHA loops when opening the WordPress dashboard
Login works on a phone hotspot but fails on office Wi-Fi (or the reverse)
Security Events show Block, Challenge, or Managed Challenge on /wp-admin/ or /wp-login.php
Direct origin access (hosts file or grey-cloud) reaches wp-admin when the proxied hostname does not
Teammates on allowlisted IPs can log in; new or traveling editors cannot
Front-end AJAX features break if admin-ajax.php was swept into an admin-only block rule

Most likely causes

01 WAF custom rule allowing wp-admin only from a stale IP allowlist
02 Managed ruleset or OWASP rule false-positive on login or admin POST bodies
03 Rate limiting on wp-login.php blocking legitimate editors after bot noise
04 Bot Fight Mode or Super Bot Fight Mode challenging admin browsers aggressively
05 Under Attack Mode or a high Security Level interfering with dashboard cookies/JS
06 Cloudflare Access / Zero Trust application covering wp-admin without your identity provider login
07 Country, ASN, or VPN blocks that include your current network

What changed before the problem started

New WAF custom rule or IP allowlist for /wp-admin/ went live
Managed ruleset sensitivity increased or a previously skipped rule was re-enabled
Your public IP changed (ISP, travel, VPN, mobile network)
Under Attack Mode or Bot Fight Mode toggled on during an incident
Cloudflare Access application added for WordPress admin paths
Security plugin plus Cloudflare both started challenging the same login URL

Troubleshooting steps

01
Confirm the block is Cloudflare, not WordPress
Note the exact error: Cloudflare branding, Ray ID, Error 1020, or challenge page means the edge acted. A Wordfence/Solid Security lockout page without Cloudflare chrome points at the plugin instead. Copy the Ray ID and failing URL before changing rules.
02
Read Security Events for the admin path
In Cloudflare, open Security → Events (Security Events) and filter for `/wp-admin` or `/wp-login.php` around the failure time. Identify the service (WAF custom, managed rules, rate limit, BIC, bot management) and the action (block, challenge, jschallenge). That name is what you adjust—not random Speed settings.
03
Allowlist your current IP on the admin rule
If a custom rule requires known IPs for `/wp-admin/*`, add your current public IP (and office VPN ranges) to the allowlist, or temporarily skip the rule for your IP while you regain access. Prefer tightening the expression over deleting the whole rule.
04
Create a narrow skip/exception for false-positive managed rules
When a managed rule blocks legitimate admin POSTs, add a WAF exception/skip for that rule ID limited to wp-admin/wp-login paths—or to your IP—rather than disabling the entire managed ruleset for the zone.
05
Ease Bot Fight / Under Attack Mode enough to finish login
If challenges never complete on wp-login, temporarily lower Under Attack Mode or adjust Bot Fight settings, complete authentication, then restore an admin-focused challenge that still allows your team. Do not leave the zone unprotected for days.
06
Verify wp-admin and admin-ajax.php after the change
Log in, load the dashboard, and spot-check front-end features that use admin-ajax. If AJAX broke, ensure block rules exclude `/wp-admin/admin-ajax.php` when they target admin paths.

Confirm the block is Cloudflare, not WordPress

Note the exact error: Cloudflare branding, Ray ID, Error 1020, or challenge page means the edge acted. A Wordfence/Solid Security lockout page without Cloudflare chrome points at the plugin instead. Copy the Ray ID and failing URL before changing rules.

Read Security Events for the admin path

In Cloudflare, open Security → Events (Security Events) and filter for `/wp-admin` or `/wp-login.php` around the failure time. Identify the service (WAF custom, managed rules, rate limit, BIC, bot management) and the action (block, challenge, jschallenge). That name is what you adjust—not random Speed settings.

Allowlist your current IP on the admin rule

If a custom rule requires known IPs for `/wp-admin/*`, add your current public IP (and office VPN ranges) to the allowlist, or temporarily skip the rule for your IP while you regain access. Prefer tightening the expression over deleting the whole rule.

Create a narrow skip/exception for false-positive managed rules

When a managed rule blocks legitimate admin POSTs, add a WAF exception/skip for that rule ID limited to wp-admin/wp-login paths—or to your IP—rather than disabling the entire managed ruleset for the zone.

Ease Bot Fight / Under Attack Mode enough to finish login

If challenges never complete on wp-login, temporarily lower Under Attack Mode or adjust Bot Fight settings, complete authentication, then restore an admin-focused challenge that still allows your team. Do not leave the zone unprotected for days.

Verify wp-admin and admin-ajax.php after the change

Log in, load the dashboard, and spot-check front-end features that use admin-ajax. If AJAX broke, ensure block rules exclude `/wp-admin/admin-ajax.php` when they target admin paths.

When to stop troubleshooting

Escalate if you cannot access the Cloudflare account that owns the zone, Security Events are empty but admin stays blocked (host WAF or plugin may own it), Access policies were set by another admin you cannot reach, or you suspect compromise and need admin restored under monitored conditions. WordPress Repair at that point means recovering access while keeping edge protection aimed at attackers—not disabling every rule blindly.

Information to collect before requesting help

01 Cloudflare Ray ID and exact error/challenge text
02 Security Events row: service, action, rule name/ID, path
03 Your current public IP and whether a VPN is on
04 Whether grey-cloud or direct-origin admin works
05 List of WAF custom rules touching wp-admin or wp-login
06 Whether Cloudflare Access is enabled for those paths
07 WordPress security plugins active and any lockout emails

How a professional repairs the problem

We match the Ray ID to Security Events, identify the exact Cloudflare product blocking admin, and restore editor access with a minimal allowlist or rule skip. We preserve WAF coverage for anonymous traffic, exclude admin-ajax when needed, align any Access policies, and retest login from the client’s real networks before sign-off.

Frequently asked questions

Why can customers see the site but I cannot open wp-admin? +

Admin-only WAF or Access rules often target `/wp-admin` and `/wp-login.php` while leaving the public site alone. That is expected when the edge is doing its job—your IP or identity simply is not allowed right now.

Is Error 1020 the same as a wrong WordPress password? +

No. 1020 is Cloudflare firewall access denied. Fix the firewall/WAF match first; WordPress never gets a chance to check the password if the edge blocks the request.

Should I grey-cloud the domain to get into admin? +

As a short diagnostic, DNS-only can prove Cloudflare is in the path. Prefer fixing the WAF/Access rule so you can stay proxied—grey-clouding exposes origin IPs and removes edge protection.

Can Cloudflare block admin even if my password is correct? +

Yes. Blocks and challenges happen before WordPress authentication. A correct password never helps if the request is denied at the edge.

How is this different from a security plugin lockout? +

Plugin lockouts usually show the plugin’s own message and may be cleared by renaming the plugin folder via hosting. Cloudflare blocks show Cloudflare pages/Ray IDs and require dashboard rule changes (or Access policy changes).

Do I need to disable the entire WAF? +

Almost never. Skip or allowlist the specific false positive for admin paths or your IP. Turning off all managed rules to reach wp-admin is an unnecessary open window.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

You will receive a clear explanation of the likely cause.
We will tell you if the issue falls outside our repair scope.
No additional work will be performed without approval.
A backup should be created whenever access and website condition allow it.

Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.