Make a single path public with Cloudflare Zero Trust (while the rest stays protected)

When you protect a site with Cloudflare Zero Trust (Access), every request normally requires an authenticated user. But sometimes you need one folder to be public—think images, downloads, or a healthcheck—without opening the entire site. Good news: you can safely expose a specific path while keeping everything else locked down.

This guide shows how to make https://uat.acme.com/wp-content/uploads/* publicly accessible while the rest of uat.acme.com remains behind Access authentication. Adjust paths and hostnames for your environment.

TL;DR

Create a second Access application scoped to the exact path you want public and give it a Bypass → Everyone policy. Cloudflare evaluates the most-specific path first, so the uploads path is open while the broader app continues to require login.

Prerequisites

• You have Cloudflare Zero Trust (Access) configured for your zone.
• Your domain is proxied through Cloudflare (orange cloud).
• You can manage Access applications in the Cloudflare dashboard (or via API/IaC—this walkthrough uses the dashboard).

Step-by-step (Dashboard)

1) Create a path-scoped Access application

1. In the Cloudflare dashboard, go to Zero Trust → Access → Applications.
2. Click Add an application → Self-hosted.
3. Set Application name to something clear like UAT Uploads Public.
4. Set Application domain to the path you want to expose, including the wildcard:
   
   https://uat.acme.com/wp-content/uploads/*

   1 2	https://uat.acme.com/wp-content/uploads/*

   Yes—Access apps support paths. The * ensures everything under /wp-content/uploads/ is covered.

2) Add a Bypass policy for everyone

1. In the new app, go to Policies → Add a policy.
2. Action: Bypass
3. Include: Everyone
4. Save.

3) Keep your existing site-wide Access app as-is

You likely already have an app covering the broader site, e.g. https://uat.acme.com/* with a Require policy. Leave it in place. Because Access matches most-specific first, requests to /wp-content/uploads/* will hit the new Bypass app; everything else still requires login.

Verify it’s working

Open an incognito/private window and try a real file under the uploads path:

You should see the asset directly, not the Access login screen.

Optional: quick command-line checks

Use curl -I to look for Access headers:

If the public request shows a redirect to /cdn-cgi/access/login, revisit the policy and path.

Common pitfalls & fixes

• Auth still prompts on the public path
  Double-check the path in the app (/wp-content/uploads/*), and ensure the app’s policy is Bypass → Everyone. Confirm there isn’t a conflicting app with a broader path but higher precedence; remember path specificity wins.
• You exposed too much
  Avoid using an overbroad path like https://uat.acme.com/*. Keep the public scope as narrow as possible (e.g., just /wp-content/uploads/*).
• Caching/Firewall rules interfere
  The Bypass policy only skips Access auth. Standard Cloudflare features (Cache Rules, Firewall, Bot Fight Mode, WAF) still apply. If something else is blocking requests, adjust those rules separately.

WordPress hardening tips for /wp-content/uploads/

Exposing uploads publicly is common and safe for static assets, but lock down execution at the origin:

• Disable PHP execution in uploads.
  In Apache, place an .htaccess in wp-content/uploads/:
  
  <FilesMatch "\.(php|php\d?)$"> Deny from all </FilesMatch>

  1 2 3 4

  <FilesMatch "\.(php|php\d?)$">   Deny from all </FilesMatch>

  
  In Nginx, add a location block:
  
  location ~* ^/wp-content/uploads/.*\.(php|php\d?)$ { deny all; }

  1 2 3 4

  location ~* ^/wp-content/uploads/.*\.(php|php\d?)$ {     deny all; }

• Limit uploadable file types to images and documents you actually need.
• Scan uploads with your security plugin or origin malware scanner.

FAQ

Q: Can I allowlist multiple public folders?
Yes—create one Access app per folder (each with its own Bypass → Everyone policy). Specificity still applies.

Q: Can I restrict public access by IP or country instead of Everyone?
Yes. Instead of Everyone, include an IP range, country, or service token group. The principle is the same.

Q: Does Bypass affect API tokens or service bindings?
Bypass only controls Access authentication. Other auth layers you run (e.g., application auth, signed URLs) remain in effect.

Q: Will this work with non-WordPress paths?
Absolutely. Any path on a proxied hostname can be scoped with its own Access app and policy.

Wrap-up

By carving out a path-scoped Access app with a Bypass policy, you keep your staging or admin areas private while serving public assets as intended. It’s simple, explicit, and reversible—and it plays nicely with the rest of Cloudflare’s security stack.

Need help tailoring this for production, multi-tenant WordPress, or CI/CD? Reliable Penguin can assist with architecture, IaC, and guardrails.