Skip to content

Access custom block pages

Last updated View as MarkdownAgent setup

You can customize the block page that displays when users fail to authenticate to an Access application. Each application can have a different block page.

Types of block pages

Cloudflare Access offers three different block page options:

  • Default: Displays a Cloudflare branded block page.
  • Custom Redirect URL - Redirects blocked requests to the specified URL. For example, you could redirect the user to a dynamic Access Denied page ↗︎ that fetches their identity and shows the exact reason they were blocked.
  • Custom Page Template - (Only available on Pay-as-you-go and Enterprise plans) Displays a custom HTML page hosted by Cloudflare.

Custom redirect URL parameters

When Access redirects a blocked request to your Custom Redirect URL, it includes these query parameters:

Parameter Description
kid The application audience (AUD) tag.
account_id The Cloudflare account ID that owns the application. Omitted when account context is unavailable.
original_url The requested hostname and path, including any query string. Included when request state is available.

For example, a request to app.example.com/admin can redirect to:

https://denied.example.com/?kid=<APP_AUD>&account_id=<ACCOUNT_ID>&original_url=app.example.com%2Fadmin

Use account_id to identify the account when looking up the application through the Access applications API. Match kid to the application's AUD tag, not its application ID.

These parameters provide context for your block page. Do not use them as proof of authentication or authorization: a visitor can modify URL query parameters.

Identity versus non-identity

You can display a different type of block page to users who fail an identity-based policy versus a non-identity policy.

  • Identity failure block page: Displays when the user is blocked by an identity-based Access policy (such as email, user group, or external evaluation rule), after logging in to their identity provider.
  • Non-identity failure block page: Displays when the user is blocked by a non-identity Access policy (such as country, IP, or device posture). Cloudflare checks non-identity attributes before prompting the user to login.

Create a custom block page

To create a custom block page for Access:

  1. In the Cloudflare dashboard ↗︎, go to Zero Trust > Reusable components > Custom pages.

  2. Find the Access Custom Pages setting and select Manage.

  3. Select Add a page template.

  4. Enter a unique name for the block page.

  5. In Type, select whether this is an identity or non-identity block page.

  6. In Custom HTML, enter the HTML code for your custom page. For example,

    <!doctype html>
<html>
	<body>
		<h1>Access denied.</h1>

		<p>To obtain access, contact your IT administrator.</p>
	</body>
</html>

  7. To check the appearance of your custom page, select Download and open the HTML file in a browser.

  8. Once you are satisfied with your custom page, select Save.

You can now select this block page when you configure an Access application.

Was this helpful?