What the check looks at
E2 requests wp-admin/admin-ajax.php with a unique query parameter and no cookies. A redirect whose Location ends on .cloudflareaccess.com, the team domain of Cloudflare Access, means Access stands in front of it. It also looks at the login page, at the address WordPress gives, and notes when it is behind Access, which is fine.
Both addresses come from WordPress. When WordPress gives admin-ajax.php or the login page on another host, the plugin measures the default address on your own site instead and says so in a note.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | admin-ajax.php is reachable Requests to admin-ajax.php are not sent to a sign in page. |
| FailedConfidence: High | Cloudflare Access is in front of admin-ajax.php Your front end calls that address too, so features on the public site stop working for visitors who were never meant to sign in. |
| Could not checkConfidence: High | This check could not be completed The cache key ignores the query string ( qs_ignored). |
| Could not checkConfidence: Low | This check could not be completed The request did not get through. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
qs_ignored: Your cache key ignores the query string, so the plugin cannot test a page without risking a cached copy of it. Before it asks for any private address, the plugin requests your home page twice with a different unique query string. If either answer is aHIT, your cache key ignores the query string, and a test request could store a private page under an address visitors use. So the plugin stops and sends nothing.loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- Forms, add to cart, filters, load more buttons or live search stop working for visitors, while they work for you when you are signed in to Access.
Why it happens
Many themes and plugins call wp-admin/admin-ajax.php from the public site. An Access application written for the whole of /wp-admin covers it too, so anonymous visitors are sent to a sign in page.
Confirm it by hand
curl -sI "https://example.com/wp-admin/admin-ajax.php" | grep -iE "^HTTP|^location"A redirect to an address on cloudflareaccess.com confirms it.
How to fix it
In Cloudflare Zero Trust: narrow the Access application so it covers wp-admin and wp-login.php but leaves admin-ajax.php alone. Cloudflare applies the more specific rule when several are set for a common root path, so a rule for /wp-admin/admin-ajax.php with a Bypass policy takes precedence over the one for /wp-admin. Bypass turns off Access enforcement for that path and its requests are not logged; Cloudflare advises testing a Bypass policy before deploying it.
In WordPress: nothing to change.
Limitations
E2 tests only admin-ajax.php. A plugin that uses another address under wp-admin from the front end is not tested.
Related checks
- E1 Cloudflare blocking your own server: blocks and challenges on requests from your server.
- C1 wp-admin and the login page in the cache: reports Access on the login page as its reason.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.