Cloudflare Error 1020 "Access Denied": Meaning and How to Fix It

Error 1020 means a request was blocked by a rule that the site owner configured in Cloudflare, such as a firewall or WAF custom rule, an IP Access Rule, or a country or bot restriction. Cloudflare's own page describes it as a violation of the site's access policies. The server behind the site never saw your request, because Cloudflare stopped it at the edge.

You see a Cloudflare-branded page titled "Access denied" with "Error code 1020", a Cloudflare Ray ID and your IP address. It can affect a single visitor, a whole country, an API client, a scraper or a legitimate tool such as a payment webhook. Only the site owner can change the rule, so what you can do depends on which side you are on.

What can trigger a 1020

1. A custom WAF rule with a Block action that matches your request. Rules can match IP, country, ASN, user agent, URL path, request headers, cookies, bot score or threat score.
2. An IP Access Rule that blocks an IP, range, ASN or country.
3. Rules that are too broad. A block on a user agent substring, an empty header, a missing Referer, or a whole hosting provider's ASN catches normal users and tools.
4. Automated traffic. Scripts, scrapers and API clients with default user agents (curl, Python requests, Go-http-client) match bot or user agent rules.
5. Shared or reputation-damaged IPs, such as some VPNs, proxies and cloud ranges.
6. A recently added rule or imported rule set that is blocking real users.

If you are a visitor

• Copy the Ray ID and your IP shown on the page; the site owner needs them to find your event.
• Switch networks (mobile data instead of Wi-Fi) or turn off a VPN or proxy and retry. If that works, your IP or ASN is being blocked.
• Disable browser extensions that modify headers or user agent, then try a private window.
• Contact the site owner or support with the Ray ID, time and your IP. You cannot override the rule yourself.

The What Is My IP tool shows the address the site sees.

If you are the site owner

Step 1: find the rule using the Ray ID

In the Cloudflare dashboard open your domain, then the Security section and Security Events (older dashboards call this Firewall Events). Filter by Ray ID, or by the visitor's IP. The event lists the action taken and which rule or service matched. That tells you exactly which rule to fix, with no guessing.

Step 2: fix the rule

• Refine the rule's expression so it no longer matches legitimate traffic. For example, narrow a country block to specific paths, or exclude a known good IP.
• Allow trusted traffic with a higher-priority Skip rule or an IP Access Rule set to Allow for known partners, payment gateways and monitoring services.
• Change the action from Block to Managed Challenge or JS Challenge where false positives are likely, so real users can still pass.
• Test with Log mode first, where available, to see what a new rule would catch before enforcing it.

If you cannot find the rule, work by elimination: temporarily disable custom rules one at a time (or switch them to Log), retry, and re-enable each as you confirm it is not the cause. Keep notes, and do not leave all protections off on a live site.

Step 3: check IP Access Rules and other layers

Look under Security, WAF, Tools for IP Access Rules; a stale block on a range can be the culprit. If you use Cloudflare for SaaS, Workers or Page Shield, check their rules too. Also check whether a rule came from a managed template or another dashboard user.

For API clients and webhooks

If your script gets 1020, set a descriptive User-Agent and send the headers a normal client would. Ask the site owner to allow your fixed IP or provide an API key rule rather than trying to evade protections. Do not attempt to bypass a site's security controls.

How to verify

Re-request the URL from the affected IP or network, and confirm you get the normal response, not the Cloudflare block page. Run the Cloudflare Error Checker and HTTP Status Checker to see what status is returned from other locations. Look at Security Events again: new requests from the same IP should show an Allow, Skip or no match instead of a Block. If the block affected only some regions or ISPs, test again from those.

Next steps

• Identify the error with the Cloudflare Error Checker.
• Review Cloudflare setup, DNS and SSL modes.
• Compare with origin-side Cloudflare failures in Cloudflare 520 to 526 errors.
• If you were blocked for sending too many requests, see Cloudflare error 1015.

FAQ

Is error 1020 a problem with the website's server?

No. The origin server was never contacted. A Cloudflare rule blocked the request at the edge.

Can I fix error 1020 as a visitor?

Not directly. You can try another network, turn off a VPN, or remove header-modifying extensions, but the site owner must change or relax the rule that blocked you.

Does a 1020 come with a Ray ID?

Yes. The block page shows a Ray ID, and the site owner can search for it in Security Events to see which rule matched.

Is this the same as Cloudflare Access?

No. Access is the Zero Trust login layer and shows its own sign-in pages. A 1020 comes from firewall or WAF rules.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.