Menu
How it worksPricingFor agenciesAI assistantsCompareSecurityFAQ Sign in Join the waitlist

Make WordPress® private

Updated

After you go live, visitors get the static copy. But your WordPress is still running at your host, and anyone who finds it can still reach it. This step closes that door. If you keep WordPress, it's what makes the biggest difference to your site's exposure, so don't skip it.

Not planning to edit the site again? You can retire WordPress instead.

The idea: WordPress moves to its own address, such as wp.example.com, with a login screen in front of it. Only you, your editors and WranglePress's builder get past it.

What you need

  • Your domain's DNS on Cloudflare (free). Cloudflare Access, the login screen we recommend, needs it. If your DNS is elsewhere, see Without Cloudflare.
  • Your hosting control panel.
  • About 30 minutes.

1. Give WordPress its own address

  1. In your hosting control panel, add wp.example.com to the same website as an alias (sometimes called a domain alias, parked domain or additional domain), so the host serves your WordPress on that address too.
  2. In Cloudflare DNS, add a record for wp pointing at your host: an A record with your server's IP address (the one your domain used before going live). Set it to Proxied (orange cloud).

2. Put a login in front of it (Cloudflare Access)

  1. In the Cloudflare dashboard, open Zero Trust (free for up to 50 users).
  2. Go to Access → Applications → Add an application → Self-hosted. Set the domain to wp.example.com.
  3. Add a policy that allows your team: for example, Emails or Emails ending in @yourcompany.com.
  4. Save. Now anyone visiting wp.example.com gets a Cloudflare login screen first.

3. Give WranglePress a key

Our builder needs to get past the login screen too.

  1. In Zero Trust, go to Access → Service credentials → Service Tokens → Create Service Token. Name it "WranglePress". Copy the Client ID and Client Secret (the secret is shown only once).
  2. Open your Access application, and add a second policy: action Service Auth, include Service Token → "WranglePress".
  3. In the WranglePress dashboard, open your site's Settings, expand Cloudflare Access service token, paste the Client ID and Client Secret, and click Save settings.

We store the token encrypted and send it only to your WordPress address.

4. Switch WordPress to the new address

  1. In WordPress, go to Settings → General. Change both WordPress Address (URL) and Site Address (URL) to https://wp.example.com, and save. You'll be asked to log in again, at the new address.
  2. In WranglePress, change WordPress address in Settings to https://wp.example.com and save.
  3. Click Build now, and check the preview. Links still point at your public domain: we rewrite them during the build.

5. Close the back door

Your server may still answer requests sent straight to its IP address, skipping Cloudflare. Ask your host, or do it yourself:

  • Best: a Cloudflare Tunnel from your server, with all other incoming web traffic blocked. Possible on a VPS or dedicated server.
  • On shared hosting: allow web traffic only from Cloudflare's IP addresses, for example with rules in .htaccess. Ask your host to help if you're unsure.

Without Cloudflare

If you can't move your DNS to Cloudflare, you can still reduce exposure:

  • Use a hard-to-guess WordPress address, and restrict it to Cloudflare's IP addresses as above (our builder runs on Cloudflare).
  • Ask your host whether they offer password protection for a whole site that allows specific IP addresses.

This is weaker than Cloudflare Access, because the address isn't behind a login. Email us if you need help choosing.

Check it worked

  • Open https://wp.example.com in a private window: you should see the Cloudflare login, not WordPress.
  • Your public domain still loads the copy.
  • Publishing in WordPress still starts a build (check the Builds list).