Cloudflare Access adds customizable login and denial pages

A blocked page can explain the next legitimate step

On October 27, 2026, Cloudflare announced customizable Access pages for login, identity-based denial, forbidden access and interactive CLI approval. Administrators can author HTML and supported Liquid templates and assign them to an application or use them as account defaults. This October 28 report follows the vendor’s changelog and documentation.

The change is relevant to staff portals, internal tools and partner applications. A page can explain where to seek help rather than present an opaque error. Presentation does not grant access: Cloudflare Access continues to make authentication and authorization decisions under the configured policies.

Use the right page for the point in the flow

Login precedes completed authentication. An identity-denied page addresses cases where a signed-in identity still fails access requirements. Forbidden pages cover other denials, while CLI approval handles the interactive approval step for command-line access. Assigning the wrong type can produce misleading advice.

Successful authentication is not permission to enter every application. Support should inspect policies, groups and access conditions when a signed-in employee is blocked, rather than promise that a password reset fixes every case. Explain legitimate next steps without exposing unnecessary configuration details.

Template validation is not a rendered end-to-end preview

The documented path is Reusable components → Custom pages → Access custom pages, then manage and create a template by type. The editor offers supported variables and a Problems area. Publish the template and assign it to the intended application or matching account default; saving a template does not automatically apply it everywhere.

Cloudflare says editor validation is not a rendered preview. Friday Works recommends a separate test application, checking permitted sessions, denied sessions and missing-variable cases. Test mobile layouts, long Vietnamese text, help links and keyboard operation before changing an account-wide default.

Login pages require exactly one visible cf-access-authbox outside Liquid conditions and loops. CLI approval requires exactly one cf-access-cli-approval. These components support the Access flow. Do not replace them with a custom credential form or self-written approval buttons merely to match the main website.

Template limits support the security boundary

The documentation restricts arbitrary JavaScript, inline event handlers and elements that could alter authentication. Liquid is a supported subset, not an unrestricted server-code environment. Missing variables can render as empty strings, so messages should remain understandable without a name, email address or detailed evaluation result.

The official vendor demo pictured here intentionally denies every sign-in and uses sample conditions. It illustrates policy-result presentation; it is neither a Friday Works customer incident nor proof of deployment to our production account. Do not copy its deliberately contradictory access conditions into a real policy.

Consider which identity details, trace identifiers and policy checks a user actually needs. These can assist support, but an error page should not become a guide to bypassing policy. Keep detailed investigation in controlled administrative channels.

Assignment scope determines the impact of an edit

An application-specific template takes precedence over the corresponding account default, followed by the built-in page when no applicable customization is present. Editing a shared template can affect multiple applications. Friday Works recommends recording those dependencies and retaining an external HTML copy before each change.

After assignment, verify the correct page type on the intended application, that authorized users still enter and unauthorized users remain denied. Track subsequent support requests rather than treating improved appearance as proof of correct authorization. Organizations coordinating access across several tools can pilot this change without rewriting authentication.