The access gate keeps a path private without touching your application's code. A visitor who opens the protected path without a valid session gets a login page (401): they enter an allowed email address, receive a 6-digit code by email and enter it. The edge then sets a signed session cookie and lets them through.
Settings
| Field | Default | Meaning |
|---|---|---|
access_gate.enabled | false | Turn the gate on. |
access_gate.path | / | Protected path prefix. / protects the whole site; /wp-admin protects every path that starts with it. Matching ignores case and // or . segments. |
access_gate.emails | [] | Allowed addresses, stored in lower case. |
access_gate.ttl_hours | 0 | How long a confirmed visitor stays signed in, in hours. 0 = 72 hours. |
The gate applies in every WAF mode.
Turn it on
Domain → Security → Access gate. Turn on Require email confirmation, fill in Allowed emails (one per line), the Protected path prefix and the Session length (hours), then save. Use Applies to to protect one name only.
openwaf-cloud ctl zones set example.com access_gate.enabled=true access_gate.path=/wp-admin \
access_gate.emails:='["[email protected]","[email protected]"]' access_gate.ttl_hours=24 \
--reason "Protect wp-admin"curl -sS -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/edge" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "X-Change-Reason: Protect wp-admin" \
-H "Content-Type: application/json" \
-d '{"access_gate": {"enabled": true, "path": "/wp-admin", "emails": ["[email protected]", "[email protected]"], "ttl_hours": 24}}'update_settings with "settings": {"access_gate": {"enabled": true, "path": "/wp-admin", "emails": ["[email protected]"]}}. emails replaces the whole list.
How codes and sessions work
- A code is valid for 5 minutes and allows 3 attempts. Asking for a new code invalidates the previous one in that browser.
- Sending is limited: 3 codes per hour for the same email from the same network, and 10 code requests per hour from one IP.
- An address that isn't on the list gets exactly the same answer as one that is, but no email is sent, so the form can't be used to discover who is allowed.
- The session cookie
__waf_accessis signed,HttpOnly,Secure,SameSite=Laxand valid only for the name where the code was entered. It is not tied to the visitor's IP, so changing network doesn't sign them out. - Removing an address from the list ends its open sessions.
- The gate's own endpoints (
/__waf/access/send-code,/__waf/access/verify) are limited to 30POSTrequests per minute per IP.