If your domain uses Cloudflare, every visitor reaches Cloudflare before they reach your WP Alpha server. Some problems can only be diagnosed, and some changes can only be made, inside your Cloudflare account. Rather than sending us your Cloudflare password, add our support team as a member of the account. This article explains how, and why it works better for both of us.
Why a shared password no longer works
Cloudflare verifies sign-ins from new locations. When anyone logs in from an IP address the account has not seen before, Cloudflare emails a PIN to the account’s email address and will not continue until it is entered. With a shared login, that means you receiving a code each time someone on our team signs in from a new address, and passing it on, usually at the moment something is urgent.
A shared password also leaves you with no control. Member access gives each person their own sign-in, you can see who has access, and you can remove anyone without changing your own password.
When we will ask for Cloudflare access
Because Cloudflare sits between your visitors and the server, it is involved in a fair share of tickets. Typical cases:
- 403 errors or blocked services. Cloudflare firewall rules, country filters and bot settings can refuse visitors, payment gateways or plugins before the request ever reaches the server. Those events are not visible from the hosting side.
- 524 timeouts. Cloudflare shows a 524 when the server takes too long to respond. We investigate the server, but it often helps to see Cloudflare’s view of the same requests.
- DNS changes. When Cloudflare manages your domain, pointing records at a new server, adding email records or creating a subdomain all happen in Cloudflare DNS.
- Cache and SSL settings. Purging Cloudflare’s cache after a change, or checking the SSL mode when the site shows certificate warnings or a redirect loop.
Adding our team as a member
- Log in to your Cloudflare account.
- Open Members. Older dashboards, like the one in the video, show it as a link in the main menu; in the current dashboard it is under Manage Account.
- Enter the email address our support team gives you in your ticket.
- Choose a role if your plan offers one, then click Invite.
- Reply to the ticket to tell us the invitation has been sent. Once we accept it, your account appears in our Cloudflare dashboard and we can get to work.
The person you invite must have their own Cloudflare account to accept. If you are adding someone from your own business, such as a developer or marketer, and the invitation returns an error, ask them to sign up on the Cloudflare website first, then try again.
Which role to choose
If your plan lets you pick a role, choose the narrowest one that covers the job. For diagnosis alone, read-only access is enough for us to see firewall events, DNS records and settings. If the ticket involves changing DNS, editing firewall rules or purging the cache, we need a role that can edit those areas. You can change the role later, and remove the member entirely once the work is finished.
What to include in your ticket
- The domain, and confirmation that it runs through Cloudflare.
- That you have sent the invitation, the address you sent it to and the role you chose.
- What you need done or what is going wrong, with an example URL and roughly when it started.
- Any recent Cloudflare changes, made by you or anyone else with access.
Recent changes matter more than people expect. Plenty of Cloudflare tickets turn out to be a rule added for one reason that quietly affects something else.
Keeping the member list tidy
Review your Cloudflare members now and then, and remove developers, agencies and former staff who no longer need access. When someone leaves your business, remove them the same day: their personal Cloudflare login keeps opening your account until you do. Make sure the account owner login and its email address belong to the business, not to an individual contractor. That address receives the sign-in PINs and any notices Cloudflare sends about the account, so losing access to it can lock you out of your own DNS.