{"id":369647,"date":"2026-09-17T07:24:18","date_gmt":"2026-09-17T07:24:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/diesis-jwt-auth-for-cloudflare-access\/"},"modified":"2026-09-19T10:17:23","modified_gmt":"2026-09-19T10:17:23","slug":"diesis-jwt-auth","status":"publish","type":"plugin","link":"https:\/\/tt.wordpress.org\/plugins\/diesis-jwt-auth\/","author":23566973,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.4.0","stable_tag":"1.4.0","tested":"7.1.1","requires":"6.8","requires_php":"8.1","requires_plugins":null,"header_name":"DIESIS JWT Auth for Cloudflare Access","header_author":"DIESIS Media - Florian Gratzl","header_description":"Validates Cloudflare Access JWTs at the WordPress origin for selected paths.","assets_banners_color":"","last_updated":"2026-09-19 10:17:23","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/DiesisMedia\/diesis-jwt-auth","header_author_uri":"https:\/\/diesis.media","rating":0,"author_block_rating":0,"active_installs":0,"downloads":70,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.3.0":{"tag":"1.3.0","author":"diesismedia","date":"2026-09-17 07:23:52","revision":3699685},"1.4.0":{"tag":"1.4.0","author":"diesismedia","date":"2026-09-19 10:17:23","revision":3703188}},"upgrade_notice":{"1.4.0":"<p>The plugin UI follows the WordPress language. No settings change needed.<\/p>","1.3.0":"<p>Plugin slug renamed to diesis-jwt-auth. Installs of the earlier diesis-wp-jwt-auth folder are separate plugins: install this one, enter or copy the settings, then delete the old folder.<\/p>","1.2.0":"<p>Plugin renamed. Settings and behaviour are unchanged; no action needed.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3699685,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3699685,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3699685,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.3.0","1.4.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3699685,"resolution":"1","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"The settings page: enforcement toggle, issuer, application audience, optional allowed emails, protected and excluded paths."}},"plugin_section":[],"plugin_tags":[1911,710,3882,38851,600],"plugin_category":[38,54],"plugin_contributors":[281210],"plugin_business_model":[],"class_list":["post-369647","plugin","type-plugin","status-publish","hentry","plugin_tags-access","plugin_tags-authentication","plugin_tags-cloudflare","plugin_tags-jwt","plugin_tags-security","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-diesismedia","plugin_committers-diesismedia","plugin_committers-flownex"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/diesis-jwt-auth\/assets\/icon.svg?rev=3699685","icon":"https:\/\/ps.w.org\/diesis-jwt-auth\/assets\/icon.svg?rev=3699685","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/diesis-jwt-auth\/assets\/screenshot-1.png?rev=3699685","caption":"The settings page: enforcement toggle, issuer, application audience, optional allowed emails, protected and excluded paths."}],"raw_content":"<!--section=description-->\n<p>Cloudflare Access can put a login in front of <code>\/wp-admin<\/code> and <code>\/wp-login.php<\/code>. It only helps if every request really passes through Cloudflare. Without Cloudflare Tunnel, anyone who knows the origin's address can reach WordPress directly and skip Access entirely.<\/p>\n\n<p>DIESIS JWT Auth for Cloudflare Access closes that gap. For the paths you choose, WordPress itself checks the <code>Cf-Access-Jwt-Assertion<\/code> header that Cloudflare Access adds to authenticated requests. A request without a valid token is answered with HTTP 403 before WordPress does anything else.<\/p>\n\n<p><strong>What it does<\/strong><\/p>\n\n<ul>\n<li>Verifies the Access JWT signature (RS256) against the signing keys of your Cloudflare Access team.<\/li>\n<li>Checks expiry, issuer and the application audience of your Access application.<\/li>\n<li>Optionally restricts access to a list of email addresses as a second check at the origin.<\/li>\n<li>Protects the paths you configure, with prefix matching and explicit exclusions.<\/li>\n<li>Caches signing keys for 12 hours and refreshes them when Cloudflare rotates keys.<\/li>\n<\/ul>\n\n<p><strong>What it does not do<\/strong><\/p>\n\n<ul>\n<li>It does not replace the WordPress login and does not create or log in users. Visitors pass Cloudflare Access first and then sign in to WordPress as usual.<\/li>\n<li>It does not accept Cloudflare Access service tokens. Those carry no email claim and are always denied. Keep machine-to-machine paths such as cron, XML-RPC or the REST API out of the protected paths, or leave them public in both WordPress and the matching Access destination.<\/li>\n<\/ul>\n\n<p><strong>Safe defaults<\/strong><\/p>\n\n<p>Enforcement only runs when the settings are complete and the issuer is an HTTPS <code>cloudflareaccess.com<\/code> URL. Incomplete or invalid settings disable enforcement instead of locking you out. If Cloudflare's key endpoint is temporarily unreachable, a previously cached key set keeps working.<\/p>\n\n<p><strong>Third-party service<\/strong><\/p>\n\n<p>To verify tokens the plugin downloads the public signing keys of your Cloudflare Access team from the issuer you configure, for example <code>https:\/\/your-team.cloudflareaccess.com\/cdn-cgi\/access\/certs<\/code>. No site data is sent; the request is a plain download of public keys, repeated at most every 12 hours or after a key rotation. Cloudflare's terms and privacy policy apply to that endpoint: <a href=\"https:\/\/www.cloudflare.com\/terms\/\">Terms<\/a>, <a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\">Privacy policy<\/a>.<\/p>\n\n<p>Source code, issues and support: <a href=\"https:\/\/github.com\/DiesisMedia\/diesis-jwt-auth\">github.com\/DiesisMedia\/diesis-jwt-auth<\/a><\/p>\n\n<!--section=installation-->\n<ol>\n<li>Create a self-hosted application in Cloudflare Zero Trust that covers your WordPress login and admin paths, and note the team domain (the issuer) and the application audience tag.<\/li>\n<li>Install the plugin from the WordPress plugin directory or upload the ZIP under Plugins &gt; Add New Plugin &gt; Upload Plugin, then activate it.<\/li>\n<li>Open Settings &gt; DIESIS JWT Auth.<\/li>\n<li>Enter the issuer, for example <code>https:\/\/your-team.cloudflareaccess.com<\/code>, and the application audience. Save with enforcement still disabled.<\/li>\n<li>Check that the protected paths match the paths your Access application covers. Use the copyable defaults below, adjusting the prefix if WordPress is installed in a subdirectory.<\/li>\n<li>Enable enforcement and save.<\/li>\n<li>Test twice: once through your Cloudflare URL, which should work, and once directly against the origin, which should return 403.<\/li>\n<\/ol>\n\n<h4>Default settings<\/h4>\n\n<p>A fresh installation starts with these values:<\/p>\n\n<ul>\n<li>Enforcement: disabled.<\/li>\n<li>Issuer: empty. Enter your own Cloudflare Access team domain, such as <code>https:\/\/your-team.cloudflareaccess.com<\/code>, with no extra path.<\/li>\n<li>Application audience: empty. Copy the audience tag of your self-hosted Access application from Cloudflare Zero Trust. This is not the application name or your site URL.<\/li>\n<li>Allowed emails: empty. There is no additional email allowlist at the origin. A valid user token with an email claim is still required.<\/li>\n<li>Protected paths: the three lines below.<\/li>\n<li>Excluded paths: empty. There are no exclusions.<\/li>\n<\/ul>\n\n<p>Copy these lines into Protected paths, one per line, for WordPress installed at the domain root:<\/p>\n\n<pre><code>\/wp-login.php*\n\/wp-admin\n\/wp-admin\/*\n<\/code><\/pre>\n\n<p>If your login and admin URLs start with <code>\/wordpress\/<\/code>, use:<\/p>\n\n<pre><code>\/wordpress\/wp-login.php*\n\/wordpress\/wp-admin\n\/wordpress\/wp-admin\/*\n<\/code><\/pre>\n\n<p>Use the path prefix from your actual login and admin URLs, without the domain. Leaving Protected paths empty restores the default three paths; it does not disable protection.<\/p>\n\n<p>Issuer and Application audience are specific to your Cloudflare setup and have no shared default. Leave Allowed emails and Excluded paths empty for the default setup. If you add an email allowlist, use your actual permitted addresses, one per line, matching your Access policy.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"i%20excluded%20a%20path%20in%20wordpress%2C%20but%20cloudflare%20still%20asks%20me%20to%20log%20in.\"><h3>I excluded a path in WordPress, but Cloudflare still asks me to log in.<\/h3><\/dt>\n<dd><p>Exclusions in this plugin only stop the origin check. Cloudflare Access decides on its own which paths it intercepts. Leave the path public in the Access application as well.<\/p><\/dd>\n<dt id=\"why%20does%20a%20request%20get%20a%20403%3F\"><h3>Why does a request get a 403?<\/h3><\/dt>\n<dd><p>Any failed check ends in 403: no <code>Cf-Access-Jwt-Assertion<\/code> header, a token not signed with RS256, an invalid or expired signature, a wrong issuer or audience, a missing email claim, or an email that is not on the allowed list. With <code>WP_DEBUG<\/code> enabled the reason is written to the PHP error log.<\/p><\/dd>\n<dt id=\"i%20locked%20myself%20out.%20how%20do%20i%20get%20back%20in%3F\"><h3>I locked myself out. How do I get back in?<\/h3><\/dt>\n<dd><p>Make sure you are opening the site through Cloudflare, not through the origin's own address, and that the Access application covers the same paths as the plugin. If you need to disable the plugin without admin access, rename or delete its folder under <code>wp-content\/plugins\/<\/code> via SFTP or your host's file manager.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20cloudflare%27s%20certificate%20endpoint%20is%20down%3F\"><h3>What happens when Cloudflare's certificate endpoint is down?<\/h3><\/dt>\n<dd><p>A cached key set stays valid for 12 hours and keeps working. Only if there are no cached keys at all and Cloudflare cannot be reached are protected requests denied.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20work%20with%20cloudflare%20access%20service%20tokens%3F\"><h3>Does the plugin work with Cloudflare Access service tokens?<\/h3><\/dt>\n<dd><p>No. Service tokens carry a <code>common_name<\/code> instead of an email and are always denied. Keep paths used by machines out of the protected paths.<\/p><\/dd>\n<dt id=\"does%20it%20work%20on%20multisite%3F\"><h3>Does it work on multisite?<\/h3><\/dt>\n<dd><p>Yes. Settings are per site, and uninstalling cleans up every site of the network.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>The plugin is translatable. It ships catalogs for de_DE, es_ES, it_IT, zh_CN, ja, and pt_BR; further languages can come from translate.wordpress.org.<\/li>\n<li>Documented all default settings, with copyable protected paths for root and subdirectory installations.<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>The plugin slug and text domain are now <code>diesis-jwt-auth<\/code>; the option and cached key names follow it.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Renamed to DIESIS JWT Auth for Cloudflare Access; first release in the WordPress plugin directory.<\/li>\n<li>The bundled JWT library is now namespaced to this plugin, so another plugin shipping a different version cannot replace it.<\/li>\n<li>Fixed the release build appending to an existing ZIP.<\/li>\n<li>The settings page and menu entry carry the plugin name.<\/li>\n<li>The release package contains only the files the plugin needs; development and agent files stay out.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>An issuer that is not an HTTPS cloudflareaccess.com URL, or settings missing the issuer or audience, now disable enforcement instead of denying access. A bad option row can no longer lock the site.<\/li>\n<li>During a Cloudflare outage without cached keys, a protected request makes one key fetch instead of two and is denied with the reason <code>keys_unavailable<\/code>.<\/li>\n<li>The key refresh throttle counts every fetch attempt, so an unknown key id costs at most one extra fetch per five minutes.<\/li>\n<li>Uninstall no longer depends on the vendor directory.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Security: request paths are canonicalized before matching, so encoding and dot-segment tricks such as <code>\/a\/..\/wp-login.php<\/code> can no longer dodge a protected path.<\/li>\n<li>Uninstall removes the option from every site on a multisite network and clears cached keys from persistent object caches.<\/li>\n<li>Accept boolean and integer <code>true<\/code> for the enforcement flag on programmatic option updates.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: validates Cloudflare Access JWTs at the WordPress origin, protects configurable login and admin paths, optional email allowlist.<\/li>\n<\/ul>","raw_excerpt":"Validates Cloudflare Access JWTs at the WordPress origin so protected paths stay closed to requests that bypass Cloudflare.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/369647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=369647"}],"author":[{"embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/diesismedia"}],"wp:attachment":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=369647"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=369647"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=369647"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=369647"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=369647"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=369647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}