Cloudflare + WordPress REST API + n8n integracija
🎯 Namen dokumenta
Ta dokument opisuje:
kako varno omogočiti
WordPress REST API za n8n
kako
blokirati javni REST API dostop kako uporabiti Cloudflare WAF + IP allowlist
kako se izogniti Cloudflare Access / Zero Trust
preverjeno delujočo konfiguracijo iz produkcije
Velja za
🧠 Povzetek problema (TL;DR)
Če uporabljaš:
potem Cloudflare privzeto:
blokira REST
API z
JS Challenge sproža Bot Fight Mode
vrača 403 Forbidden
zahteva
Access token, ki za REST
API NI primeren
⚠️ REST API ni browser in ne zna reševati Cloudflare izzivov.
Rešitev je:
Končna arhitektura
n8n (statičen IP)
> Cloudflare WAF (Custom Rules)
> WordPress REST
API (/wp-json/)
1️⃣ WordPress – Application Password
V WordPress Admin panelu:
Users
izberi uporabnika (npr. automation_n8n)
Application Passwords
Create new password
Shrani:
WordPress username
Application Password
Opomba:
uporablja se Basic Auth
ne JWT
ne OAuth
2️⃣ n8n – preveri izhodni IP
V n8n ustvari HTTP Request node:
Method: GET
URL: https://api.ipify.org?format=json
Authentication: None
Rezultat:
{
"ip": "49.12.184.65"
}
Ta IP bo uporabljen v Cloudflare pravilih.
3️⃣ Cloudflare – Global Security Level
Cloudflare Dashboard:
Nastavi:
Security Level = Low
Razlog:
4️⃣ Cloudflare – Custom Rule (ALLOW + SKIP)
Cloudflare:
Security
Security rules
Custom rules
Create rule
Ime pravila:
Allow WordPress REST API
Expression:
starts_with(http.request.uri.path, "/wp-json/")
and (ip.src eq 49.12.184.65 or ip.src eq 86.61.31.249)
Action:
Skip
WAF components to skip:
Rule order:
First
To pravilo:
5️⃣ Cloudflare – Custom Rule (BLOCK public REST)
Ustvari drugo pravilo.
Ime:
Block public WordPress REST
Expression:
starts_with(http.request.uri.path, "/wp-json/")
and not (ip.src eq 49.12.184.65 or ip.src eq 86.61.31.249)
Action:
Block
Rule order:
After: Allow WordPress REST
API
To pravilo:
6️⃣ Cloudflare – Zero Trust / Access
Cloudflare:
Zero Trust
Access
Applications
Stanje:
NO APPLICATIONS
Ne uporabljamo:
Access Applications
Service Tokens
Access Policies
Identity Providers
Razlog:
7️⃣ Testiranje v browserju
Iz dovoljenega IP-ja:
https://example.com/wp-json/
Pričakovano:
Iz nedovoljenega IP-ja:
8️⃣ Testiranje v n8n
HTTP Request node:
Method: GET
URL: https://example.com/wp-json/wp/v2/users/me
Authentication: Basic Auth
Username: WP user
Password: Application Password
Pričakovano:
🔐 Varnostna politika
| Element | Status |
| REST API javno dostopen | ❌ |
| IP allowlist | ✅ |
| Basic Auth | ✅ |
| WAF bypass samo za n8n | ✅ |
| Cloudflare Zero Trust | ❌ |
⚠️ Pogoste napake
Security Level = High
uporaba Cloudflare Access za REST
API manjkajoč “Skip”
napačen vrstni red pravil
JS / Managed Challenge na /wp-json/
testiranje iz napačnega IP-ja
✅ Status
🧩 Opomba