I got two support tickets today. Same error, same root cause, two different customers. Both locked out of their own Ghost admin panel with this message:
Request was rejected because user is not permitted to perform this operation.
Both had Cloudflare's orange cloud enabled. Both were confused because they didn't touch anything. And that's exactly the problem – you don't have to touch anything. Cloudflare will eventually cache something it shouldn't, and your Ghost admin panel will stop working.
Ghost Is Not a Static Site
Ghost has an admin panel at /ghost/, member authentication, API endpoints and internal routes that rely on session cookies and real-time, uncached server responses.
When Cloudflare's proxy (the orange cloud) is put in front of your site, all traffic is routed through Cloudflare's network. And Cloudflare, by default, caches things. Sometimes it caches things it absolutely shouldn't cache – like a page that includes session-specific headers.
What happens next is predictable: you try to log into /ghost/, but instead of reaching the actual Ghost server, you get served a stale cached response. Ghost sees a request without valid session data and does exactly what it should – it rejects you. You're not locked out because Ghost is broken. You're locked out because Cloudflare is serving you yesterday's response.
Why Cache Exclusions Are Harder Than They Look
The first reflex is usually to exclude /ghost/* from caching. That's a good first step, and can even fix the immediate problem. But Ghost's dynamic routes go well beyond the admin panel. There are Content API and Admin API endpoints, member sign-in and sign-up routes, webhook receivers, and various internal paths that all need to bypass caching too.
How Magic Pages Handles This
I have spent quite some time designing Magic Pages's CDN. The caching layer here is built for Ghost. It's not a generic CDN.
Ghost has a built-in X-Cache-Invalidate header that includes information on what needs to be purged. Ghost(Pro) uses it internally. I use it too. I wrote about the approach in A Better Cache Invalidation Solution for Ghost – the system has since been moved to a Cloudflare Worker, but the principle is the same: when you publish a post, update a page, change your theme, or modify your settings, the cache is purged immediately. Not after a TTL expires. Not when you remember to click a button. Immediately.
On top of that, I maintain cache exclusion rules that are tailored to each Ghost version. When Ghost 6 introduced new routes, I updated the rules across all Magic Pages sites. Nobody had to think about it or even know it happened. It just kept working.
This is what the Pro plan's CDN gives you – not just edge caching, but edge caching that actually understands Ghost.
If You Do Need Cloudflare's WAF
There are legitimate reasons to proxy traffic through Cloudflare. If you need WAF rules or specific security configurations, that makes sense. But in that case, the important thing is to disable all caching on Cloudflare's side. Set up a cache rule that matches all traffic to your domain and set the caching behavior to “Bypass.” Use Cloudflare purely for its security features and let Magic Pages handle the caching.
Trying to exclude individual paths isn't reliable enough – Ghost is more sensitive than most applications when it comes to this. A blanket bypass is the safe approach.
The Simple Version
If you're on Magic Pages, the most reliable setup is:
Use the gray cloud (DNS only) on all your DNS records pointing to Magic Pages. No proxy, no caching layer, no interference. Your site gets Magic Pages' built-in, Ghost-aware caching and CDN on the Pro plan. Everything just works.
If you require Cloudflare's security features, proxy the traffic but bypass all caching. Let Magic Pages handle the part that Magic Pages is built for.
If you're currently locked out of your Ghost admin check if you have Cloudflare's proxy enabled and switch your DNS records to the gray cloud (DNS only). If that doesn't fix it, reach out – I'm happy to help.
About Jannis Fedoruk-Betschki
I'm the founder of Magic Pages, providing managed Ghost hosting that makes it easy to focus on your content instead of technical details.
