sellSecurity

badge

Access

Checks who you are before letting you into an app — no VPN, no trusted network required.

50 usersFree Zero Trust seats

Zero TrustNever trust, always verify

No VPNIdentity at the door

lightbulb

What is Access?

Cloudflare Access puts an identity check in front of your applications. Before anyone can open an app, they must log in and prove they're allowed — based on who they are, not which network they're on.

This is the Zero Trust idea: never automatically trust someone just because they're inside the office network. Every request is verified. Access checks identity using providers you already use, like Google or GitHub, or a one-time PIN sent to an email.

meeting_room

Think of it like…

A receptionist who checks your ID at every single door, instead of an old building where badging in once at the lobby lets you wander anywhere.

help

Why use it instead of a VPN?

A VPN (Virtual Private Network) drops you onto the whole internal network and trusts you broadly once you're connected. That's risky and clunky. Access grants entry to one specific app at a time, per person.

person_check

Per-app control

Grant access to exactly one app, not the entire network behind it.

bolt

Nothing to install

For web apps, users just visit a URL and log in — no VPN client needed.

groups

Use existing logins

Plug in Google Workspace, GitHub, Microsoft Entra ID, and more as identity sources.

history

Full audit log

See exactly who accessed what and when — great for security reviews.

rocket_launch

How to protect an app

Everything happens in the Cloudflare Zero Trust dashboard. Here's how to put a login wall in front of an app and decide who gets in.

Connect a login provider
In Zero Trust → Settings → Authentication, add an identity provider. The simplest is the built-in One-time PIN, which emails users a code; or connect Google/GitHub.
Add your application
Go to Access → Applications → Add an application → Self-hosted. Enter the app's domain, e.g. dashboard.example.com (often a Cloudflare Tunnel hostname).
Create an Allow policy
Add a policy with action Allow and an Include rule that matches who should get in — for example, emails ending in @yourcompany.com.
text
```
Policy name: Company staff
Action: Allow
Include:  Emails ending in  @yourcompany.com
Require:  (optional) Identity provider = Google
```
Save and test
Save the application. Now visiting the app shows a Cloudflare login screen first; only people matching your policy get through to the app.

rule

Include / Require / Exclude

Include is OR logic (match any), Require is AND logic (must also match), Exclude is NOT (block these). Combine them to express rules like 'company emails, but require MFA, except contractors'.

school

Key concepts

verified_user

Zero Trust

A model that verifies every request and trusts no one by default, inside or outside.

apps

Application

The thing you're protecting — a self-hosted site, an SSH server, or a SaaS app.

gavel

Policy

A rule deciding Allow, Block, or Bypass for a set of people.

account_circle

Identity provider

Where logins come from: Google, GitHub, Microsoft Entra ID, or email PIN.

One-time PIN

The simplest login: Cloudflare emails the user a temporary code. No IdP setup needed.

phonelink_lock

Device posture

Optional checks that the user's device is healthy (e.g. disk encrypted) before allowing in.

tips_and_updates

Tips & billing

vpn_lock

Pairs perfectly with Tunnel

Use Cloudflare Tunnel to connect a private app without opening ports, then put Access in front of it for the login wall. Together they replace a VPN for most internal tools.

Cloudflare's Zero Trust free plan covers up to 50 users at no cost.
Access works for self-hosted web apps, SSH/RDP, and many SaaS apps.
Start with One-time PIN to test quickly, then connect a real identity provider later.
Every login attempt is logged, giving you a clear audit trail.