Cloudflare Error 1003: Direct IP Access Not Allowed (Fix)

Error 1003 reads "Access denied. Direct IP access not allowed." Cloudflare's documentation says it means direct access to a Cloudflare IP address is not allowed. You (or a program you wrote) connected to one of Cloudflare's addresses without naming a site Cloudflare could route to.

This one is usually the easiest Cloudflare error to fix, because the cause is how the request was addressed, not how the site is configured.

Why it happens

Cloudflare hosts millions of sites on a shared pool of addresses. An IP alone does not say which site you want. The request has to carry a hostname, in the URL, the Host header, and for HTTPS the TLS Server Name Indication. If it carries only an IP, Cloudflare has nothing to match and rejects it.

Typical situations:

• You typed the IP from a DNS lookup into the browser bar.
• A bookmark, script or monitoring check uses http://104.x.x.x/.
• A hosts-file entry, load balancer health check or internal tool hits a Cloudflare address with no matching host.
• A proxied record was looked up with dig, and the returned Cloudflare address was used as if it were the server.
• Someone scanning IP ranges hit Cloudflare's addresses.

If you are a visitor

Use the website's domain name, not an IP address. Type https://www.example.com/, not the numbers. If a link or app is sending you to a raw IP, report that to the site owner.

Note that the IP you see for a Cloudflare-protected site is not the site's server. It belongs to Cloudflare's network, so visiting it directly can never show the site.

If you are the site owner or developer

Cloudflare's page gives no separate owner steps, since the fix is to stop using the IP. In practice, hunt for where the IP-based request comes from.

Step 1: reproduce it

curl -I http://104.16.0.1/

curl -I https://www.example.com/

Replace the address with whatever your logs show. Use the HTTP Header Checker on the domain to confirm the proper response, and the IP Lookup to confirm the IP you were using belongs to Cloudflare.

Step 2: find the source

Check these in order:

1. Monitoring and uptime checks. Make sure they request the domain URL, not an IP.
2. Application config. Look for hard-coded IPs in API base URLs, webhook targets, and .env files.
3. Health checks from load balancers. They sometimes request by IP; give them a Host header.
4. Scripts and integrations that cached an old DNS answer and use the address directly.

Step 3: send the right Host header if you must connect by IP

For testing, you can still hit a specific address while naming the site:

curl -I --resolve www.example.com:443:104.16.0.1 https://www.example.com/

--resolve keeps the hostname in the URL, Host header and SNI while overriding DNS. This is the proper way to test a particular edge address. It is a test technique only, since Cloudflare's addresses can change.

Step 4: do not mix up the origin and the edge

If you want to reach your own server directly to compare behavior, use the origin IP, not a Cloudflare one. Find the origin in your host's control panel or in DNS records stored in the dashboard. Then test with the Host header:

curl -I -H "Host: www.example.com" http://ORIGIN_IP/

Our guide to Cloudflare DNS and SSL modes explains how the edge reaches your origin. Hiding the origin address is a good practice; if it leaks, consider restricting origin access to Cloudflare's ranges.

Not the same as 1020 or 1015

Error 1003 is about how you addressed the request. If you used the correct domain and still see a block, you have a firewall problem: see 1020 Access denied or 1015 rate limited. A DNS-related cousin is 1000.

Verify

Request the domain again, or run the Cloudflare Error Checker on it. Use the DNS Checker to see which addresses the name resolves to today.

Next steps

• Run the Cloudflare Error Checker.
• Look up an address with the IP Lookup.
• Confirm a site is behind Cloudflare with the CDN Detector.
• Read Cloudflare 520-526 errors explained.

FAQ

Is error 1003 a security block?

It is a refusal, not a rule you can tune. Cloudflare rejects requests that give only an IP address and no routable hostname.

Can the site owner turn it off?

Cloudflare's documentation offers no owner setting for it. The fix is to address the site by its domain.

Why does the site work by name but not by IP?

The IP is shared by many sites. Only the hostname tells Cloudflare which one you want.

Does my firewall rule cause 1003?

No. A firewall block shows error 1020 or a similar page. 1003 comes from an IP-only request.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.