DEV Community: Itse Isaac Azi

How I Secured My WordPress Admin with Cloudflare Access (Zero Trust) and GitHub SSO

Itse Isaac Azi — Wed, 04 Nov 2026 21:01:06 +0000

Summary: I put an identity check in front of the WordPress login page of fastweb.com.ng using Cloudflare Access, so only verified users can reach it. I used GitHub as the login method and added a country-based rule on top.

Perquisite

Cloudflare Account
GitHub Account

The problem
WordPress login pages such as /wp-admin and /wp-login.php are public by default, so bots constantly try to guess passwords on them. I already had a WAF, bot protection, and Turnstile in place, but the login page was still visible to everyone. I wanted to reduce that exposure.

The solution: Zero Trust with Cloudflare Access
Zero Trust means never trust a request by default; verify it every time. Cloudflare Access puts a checkpoint in front of the login page. Visitors must prove who they are before they can even see the WordPress login form.

My layers, from outside to inside:

Cloudflare WAF and bot mitigation filter malicious traffic.
Cloudflare Access verifies identity with GitHub SSO.
Turnstile checks that the visitor is human.
The WordPress password is the final layer. This is defence-in-depth: if one layer fails, the others still protect the site.

Step-by-Step implementation

Step 1: Visit your Cloudflare account and Login
Step 2: Click on Access Controls—>Applications

Step 3: Click on Applications and create new applications

Fill in the details as shown in the fields above and click on save
Step 4: Click on Zero Trust in Cloudflare

Today we will be using (https://github.com/login) as our identity provider

Add GitHub as an identity provider.

In GitHub, I created an OAuth app under Developer settings. I set the callback URL to my Cloudflare team’s /cdn-cgi/access/callback address, then copied the Client ID and Client Secret into Cloudflare’s GitHub login method and used the Test button. [Screenshot: Login methods page. Never show the client secret.]

What this means: GitHub vouches for my identity, and Cloudflare trusts its answer. This is OAuth-based identity federation, the same idea as “Sign in with Google".

Now copy the client ID from GitHub and go back to Cloudflare past it, and also generate the secret key and paste it in the field below. Then copy the callback URL back to GitHub

Paste the callback URL from Cloudflare and click on update application

Results

The admin login page is no longer reachable by anonymous visitors or bots.
Unauthorised attempts are stopped at Cloudflare’s edge, before they reach my server.
Public pages and features still work normally.

How to Onboard a New User on Okta

Itse Isaac Azi — Wed, 19 Aug 2026 20:26:32 +0000

Prerequisite

Okta Account: You can register on

Secure Identity for Employees, Customers, and AI | Okta

The Okta and Auth0 Platforms enable secure access, authentication, and automation — putting Identity at the heart of business security and growth.

okta.com

. Make sure to create a free account and log in.

Step One: Log in to your account with your details

Step Two: Click on Directory

Step Three: Click on People

Step Four: Filling in the details of the new member

Step Five: Go back to the people tabs and refresh to see the new account that has been created.

Step Six: Click on the newly created user to view more options

Step Seven: Log in to your email to access the activation link

After clicking the activation link in your desired email, you will be prompted to set a password and MFA to protect your account.

WordPress (WP) and Okta Single Sign-On

Itse Isaac Azi — Wed, 05 Aug 2026 22:26:15 +0000

Prerequisite

Okta Account
WordPress website

WordPress does not independently authenticate users when Okta and WordPress use Single Sign-On (SSO). Instead, it uses Okta to verify a user's identity.

Consider it like this:
The program that the user wants to use is called WordPress.

The trusted identity provider (IdP) that confirms the identity of the user is Okta.

SAML 2.0 is the protocol that securely sends the authentication result from Okta to WordPress.

Before SSO

Without SSO, the login flow looks like this:

              The user
                │
        WordPress Login Page
                │
        Username + Password
                │
    WordPress checks credentials.
                │
            Database
                │
           Login Success

Problems with this approach include:

Users must remember separate passwords.
Passwords are stored and managed by WordPress.
MFA may not be consistently enforced.
User accounts have to be managed separately in WordPress.

After SSO

With Okta SSO:



           User
            │
            ▼
     WordPress Website
            │
            ▼
     "Login with Okta"
            │
            ▼
           Okta
            │
    Username + Password
            │
            ▼
      MFA Challenge
            │
            ▼
     Identity Verified
            │
            ▼
     SAML Response Sent
            │
            ▼
         WordPress
            │
            ▼
       User Logged In

Observe that the password is never checked by WordPress. It just acknowledges Okta's reliable response.

The Components
1. User

The employee, administrator, editor, or customer trying to log in.
Example:

John

John wants to access:

https://company.com/wp-admin

2. WordPress (Service Provider)

In SAML, WordPress acts as the Service Provider (SP).

Its job is to:

Request authentication.
Trust Okta's response.
Create a local session.
Assign the appropriate WordPress role.

WordPress does not verify the password.

3. Okta (Identity Provider)

Okta is the Identity Provider (IdP).
It:

Stores user identities.
Verifies passwords.
Enforces MFA.
Applies sign-in policies.
Sends a signed SAML response back to WordPress.

4. SAML
SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication information.

WordPress sends a request like

Please authenticate this user.

Okta replies:

This user has been authenticated.

Email:
john@company.com

First Name:
John

Last Name:
Smith

Groups:
Administrators

The response is digitally signed so WordPress can verify it hasn't been altered.

A Real Login Walkthrough

Suppose:
WordPress site:

https://company.com

Okta organisation:

https://company.okta.com

The login sequence is

Step 1

John opens:

https://company.com/wp-admin

WordPress sees no active session.

Step 2

Instead of showing the standard login form, WordPress redirects John to Okta.

company.okta.com

Step 3

Okta displays its login page.

Email:

Password

Step 4

Okta prompts for MFA if required.
For example:

Approve on Okta Verify

Enter 6-digit code

Step 5

Okta verifies:

Password
MFA
Device policies
Location policies
Time-based policies If everything meets policy, authentication succeeds.

Step 6
Okta generates a SAML assertion.
This contains information such as:

NameID

john@company.com

First Name

John

Last Name

Smith

Department

IT

Groups

Administrators

The assertion is digitally signed with Okta's private key.

Step 7
WordPress validates:

The signature.
The certificate.
The issuer.
The audience.
The assertion's expiration time.

If all checks pass, WordPress trusts the response.

Step 8

WordPress creates a local session and, if configured, maps the user to a role.

What Happens the First Time a User Logs In?

If Just-In-Time (JIT) provisioning is enabled:

The user authenticates with Okta.
WordPress doesn't find a matching account.
WordPress automatically creates the account.
The user is logged in.

This avoids manually creating WordPress accounts.

What Happens on Later Logins?

WordPress finds the existing account by email or another mapped identifier and signs the user in immediately after Okta authenticates them.

Why This Is More Secure

Instead of storing passwords in WordPress:

100 Passwords

↓

WordPress Database

You centralise authentication in Okta:

100 Users

↓

Okta

↓

WordPress trusts Okta

Benefits include:

One password per user across applications.
Centralised MFA enforcement.
Faster onboarding and offboarding.
Centralised audit logs.
Reduced password reuse.
Consistent access policies.

Common Security Policies You Can Enforce in Okta
Examples include:

Require MFA for WordPress administrators.
Block sign-ins from countries your organisation doesn't operate in.
Require managed or compliant devices.
Deny access from anonymous proxies or VPNs (if licensed features are available).
Block legacy authentication methods.
Set session timeout and re-authentication requirements.

These policies are enforced before WordPress grants access.

Multi-Factor Authentication(MFA)

Itse Isaac Azi — Fri, 09 Aug 2024 14:00:30 +0000

able to be called a Two-factor authentication, also known as 2FA, is an electronic authentication technique that limits access to a specific website or application by requiring the user to provide two or more forms of identification. A primary goal of multifactor authentication is to prevent unauthorised access to any network, application, system, or website.

HOW AUTHENTICATION WORKS

Generally, in order to gain access to a specific website, system, network, or application, the user must authenticate themselves. Usually, in order to gain access, the user must supply a password or pin (personal identification number); however, if these details are entered incorrectly, the user will not be allowed to access the system. Usually, in order to gain access, the user must supply a password or pin (personal identification number); however, if these details are entered incorrectly, the user will not be allowed to access the system. Furthermore, the user is required to furnish proof in multiple ways, such as through the utilisation of biometrics, OTPs (one-time passwords), facial recognition, and pin security questions. I will go over the various popular forms of authentication in the following section.

METHODS OF AUTHENTICATION

1.Something the user has

2.Something the user knows

3.Something the user is

1.Something the user possesses: this can be any tangible object the user owns, such as badges, smart cards, USB drives, and security tokens.

2.Something the user knows: This can be answers to security questions about passwords, pins, and OTPs.

3.Something the user is: instances of facial recognition, fingerprint, retinal scanning, and biometric

Taking money out of an ATM is the most typical application of multi-factor authentication (MFA). The user must enter their unique pin combination in order to access the system; if the combination is entered incorrectly, the user's attempt to access the system is unsuccessful. Occasionally, the unauthorised user is actually a hacker or scammer rather than the person who is trying to access the system at all. Using multi-factor authentication (MFA) and a strong password combination are recommended measures to safeguard your account and prevent unauthorised access.

ADVANTAGES OF AUTHENTICATION APPs

The application is typically linked to the user's phone, making it inaccessible unless the user's phone is stolen.
This technique generates OTPs more quickly and is independent of the network and any provider.
Mobile data is not needed in order to access the code.
It is simple to set up.

5.You will not lose your code if you switch devices because it will be backed up online.

HOW TO CONNECT GOOGLE AUTHENTICATION APP TO YOUR GREY ACCOUNT

This method is simple and it can be achieved by following this simple steps written by Chioma Mmeje Click on the link below

Have you ever experienced difficulty in getting OTP via SMS?

When it comes to security and preventing unauthorised access, there are a number of methods to choose from. Based on my experience and years of use, authentication apps offer our systems greater protection.

What is a data breach?

Itse Isaac Azi — Wed, 12 Jun 2024 19:47:41 +0000

Go to your browser and click on the address.

2. Look up Nordpass.com on the internet.

Enter your information to register and log in.

4. Click Data Breach Scanner in the tools section.

**5. This is where you can configure your credit or debit card, email, or both.

After this, you can scan your information to see the outcomes. You will find out at this point whether or not any of your personal information has been compromised.**