Access on vanityURLs

Cloudflare Access is not a checkbox

Tue, 26 May 2026 00:00:00 +0000

The failure mode is ordinary. Someone opens /en/_stats/ from a private browser window and sees the dashboard instead of the Cloudflare Access login page.

That is the whole problem. Public redirects should stay public. Operational pages should not.

For vanityURLs, Cloudflare Access has one narrow job: keep localized stats paths such as /en/_stats/, localized test paths such as /en/_tests/, and similar operator surfaces private before the Worker serves them. Treat it as an access boundary, not a setup souvenir.

Start with one-time PIN, then earn the IdP

Fri, 22 May 2026 00:00:00 +0000

The first identity decision for a short-link domain should be boring.

Protect /en/_stats/, other localized stats paths, and /en/_tests/ before the instance goes public. Do not spend the first deploy designing an enterprise identity architecture unless the enterprise already exists.

For vanityURLs, Cloudflare Access protects the operational pages before the Worker serves them. The question is not “which IdP is best?” The question is “which access path can the operator review and revoke without ceremony?”