Disable Access Policy on Cloudflare Pages Without Debit/Credit Card

Tags: cloudflare, access policy, python

Disclaimer: The author of this blog post takes no responsibility or any liability for unintended deletion or damage to your website. It is advised that you assume full responsibility for the outcomes resulting from the correct or incorrect usage of the provided script. Please be aware that utilizing this tutorial and the accompanying code is done at your own risk.

Introduction:

This tutorial explains the process of disabling Cloudflare Access Policy on a website deployed on Cloudflare Page.

At the time of writing this blog post, if one does not enter any Debit/Credit Card information into Cloudflare and accidently enables Cloudflare Access Policy on one’s page, then the only process to disabling it will be through sending API requests.

Unfortunately this is a known UI limitation that has not been solved for almost 2 years.

As you can see in the above screenshot there isn’t a button to disable this policy. If one clicks on the ‘Manage Policy’ button, it redirects them to a page asking for credit/debit card info.

Steps:

1. Install Python (3+ Version)

   You can download Python from python.org

2. Get CloudFlare Account ID

   You can get this from the cloudflare dashboard URL while logged in. For example, for this URL: https://dash.cloudflare.com/4h7t950qif5oqoxyn25j52kngnw11d2i the Cloudflare Account ID would be 4h7t950qif5oqoxyn25j52kngnw11d2i

   FYI: This is not my Account ID

3. Get Cloudflare Global API Key

   You can get this API Key from the CloudFlare My Profile/Api Tokens Page. For my instance it was a 37 character key.

   a. Click on My Profile

   b. Click On API Tokens

   c. Click on View next to Global API

4. Get Access Policy ID

   You need to get the Access Policy ID that you want to delete on the account. There may be multiple access policies enabled, please make sure you identify the correct one.

   Before running the following script, fill in your Cloudflare email, Cloudflare Account ID as well as Cloudflare Global API Key.

   The output of the script should be in the following format. If there are multiple access policies, identify the correct one and copy the ID to the next script.

   Found ID: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, Name: XXXXXXXXXXXX, Domain: XXXXXXXXXXXX.pages.dev

5. Delete Access Policy

   Copy the previously identified Access Policy ID and copy the same Cloudflare email, Account ID and Global API Key into this script. Run it.

Result:

And you’re done!

Comment Below: