Cloudflare Access Can Now Protect SSH, RDP, and More with Zero Trust!

Hey everyone, it's me! I've got great news today for anyone using Cloudflare Access — the range of things it can protect just got a lot bigger!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Access for private hostname applications can now secure traffic on all ports and protocols. Previously, applying Zero Trust policies to a private application required it to run on HTTPS port 443 and support Server Name Indicator (SNI). That limitation is now gone.

The story so far

Until now, Access was really built around HTTPS-based web applications. Since it required port 443 with SNI support, non-HTTPS applications like SSH, RDP, or internal databases running on raw TCP simply couldn't have Zero Trust policies like SSO or MFA applied to them. Even if you wanted to protect those services, the protocol requirement left them out of reach.

What changes

As long as an application is reachable via a Cloudflare off-ramp, you can now enforce these critical security controls regardless of port or protocol:

• Single sign-on (SSO)
• Multi-factor authentication (MFA)
• Device posture checks
• Variable session lengths

This extends Zero Trust security to non-HTTPS applications like SSH, RDP, and internal databases. The feature is already generally available (GA) across all Cloudflare plans.

Dive Deep

The example in the changelog makes this concrete: you can create a self-hosted application in Access for ssh.testapp.local running on port 22.

From there, you can build a policy with conditions like:

• Limited to engineers within your organization
• Requiring a passed SSO/MFA check
• Requiring a corporate device

Only engineers who satisfy all three conditions can connect to ssh.testapp.local on port 22. The key requirement is that the application must be reachable via a Cloudflare off-ramp — as long as that's true, you get the same protection for non-HTTPS applications that you'd get for a web app.

Wrap-up

• Cloudflare Access for private hostname applications now supports all ports and protocols
• Previously, HTTPS on port 443 with SNI support was required, ruling out SSH, RDP, and similar services
• You can now apply SSO, MFA, device posture, and variable session length policies to non-HTTPS applications
• Example: an SSO/MFA + corporate device policy on ssh.testapp.local port 22
• Generally available (GA) on all plans

If you've been wanting to put Zero Trust controls around your internal SSH servers, RDP, or raw-port databases, this update is exactly for you!