Oh, then you can just add a WAF rule that blocks anything not coming from a "worker" on your zone, w
Oh, then you can just add a WAF rule that blocks anything not coming from a "worker" on your zone, which afaik counts Functions too.

project.pages.dev domainproject.pages.dev