Cloudflare error 1020 means a security rule on that website matched your request and blocked it on purpose. It is a decision made by the site owner, not an outage, and only they can change it.
The page is served by Cloudflare rather than by the website, which is why it looks the same on every site that shows it. The full wording is error 1020: access denied, and “Cloudflare 1020”, “error code 1020” and “CF error 1020” are all the same thing. It can only appear on a proxied hostname, because a DNS-only record never passes through the proxy where these rules are evaluated.
The single most useful thing to know is that 1020 is not a diagnosis of you. There is no global Cloudflare blocklist that this code draws from. Each site owner writes their own rules for their own zone, so the same request that is denied on one site sails through on the next one.
The number tells you which switch did it
Cloudflare has several features that can deny a request, and they emit different codes. That is more useful than it sounds: before anyone opens a log, the number on the screen has already eliminated most of the configuration surface.
Cloudflare’s reference for this error attributes it to Firewall Rules, a feature that is now deprecated and whose replacement is WAF custom rules. In practice, on a zone configured any time recently, a 1020 means a custom rule with the Block action. The neighbours are worth knowing so you do not go looking in the wrong screen:
| Code | What produced it | Clears by waiting? |
|---|---|---|
| 1020 | A WAF custom rule (or legacy firewall rule) set to block | No |
| 1006 / 1007 / 1008 | Your IP address was banned, typically by IP Access Rules | No |
| 1106 | A Zone Lockdown rule — the URL is restricted to an allowlist you are not on | No |
| 1010 | Browser Integrity Check disliked your browser’s signature | No |
| 1012 | Blocked on the basis of malicious activity seen from your address or network | Sometimes |
| 1015 | A rate limiting rule — too many requests in a window | Usually |
One detail catches people running scripts rather than browsers. Cloudflare’s error page reference records the WAF block page as returning a 403 status code, while a rate limiting block returns 429. The 1020 itself lives in the HTML body, not the status line — so a client that only logs status codes sees a bare 403 and never learns the number at all. If you are debugging an API integration that suddenly returns 403 from a Cloudflare-fronted host, fetch the response body before assuming it is an authentication problem.
If you are the one being blocked
Your options are genuinely limited, and most advice on this subject overstates them. Clearing cookies and cache does not help, because the rule is evaluated before any of that is read. In rough order of how often it works:
- Turn off a VPN or proxy and retry. Commercial VPN exit addresses and datacenter ranges are among the most commonly blocked things in these rules, and this is the one fix entirely in your hands.
- Try a different network. Switching from office Wi-Fi to a phone hotspot tells you within seconds whether the rule keys on your address or on something about your browser.
- Send the owner a screenshot. Cloudflare’s guidance to site owners is to search their logs by Ray ID or client IP, both printed on the error page. A screenshot with those visible turns a vague report into a one-minute lookup.
What will not work is contacting Cloudflare. Their documentation is explicit that support cannot override a customer’s security settings, and only the domain owner can raise a technical ticket at all.
If it is your site blocking your users
There is exactly one place that answers “which rule did this”, and it is the Security Events log under Security > Analytics. Search it for the Ray ID from the visitor’s screenshot, and the matching entry names the rule, the action it took and the field that matched.
One trap here wastes more time than the rest of the process combined: Cloudflare timestamps these events in UTC, and their own instructions include a note to convert the time on the error page to your local timezone before searching. Search the wrong hour and the log looks empty, which reads exactly like “it was not us”.
Once you have found the rule, there are three honest fixes:
- Narrow the rule. The usual culprit is a rule written broadly during an incident — a whole country, ASN or datacenter range — that nobody revisited afterwards.
- Allow the specific visitor. Cloudflare’s documented resolution is to update the rule or allow the address in IP Access Rules. Be aware of what that buys: an allow there bypasses custom rules, rate limiting rules and Managed Rules, so it is a wide exemption for a narrow problem.
- Use a skip rule instead. For a known good client, the skip action in a custom rule lets you exempt a request from specific features rather than all of them. Cloudflare notes it does not bypass every app security feature, which is precisely why it is the safer choice.
If the block is intentional and you simply want it to read better than a bare error number, the page is customisable. Cloudflare’s custom error examples include a rule matching cf.response.1xxx_code eq 1020 and returning your own HTML, which is a much better experience than leaving legitimate customers to work out what a four-digit number means.
FAQ
What does Cloudflare error 1020 mean?
It means the site you are visiting has a Cloudflare security rule that matched your request and blocked it. The block is deliberate and was configured by the site owner. Nothing is broken on your computer, and the site itself is not down.
How do I fix error 1020 as a visitor?
You mostly cannot, because only the site owner can change the rule that blocked you. Take a screenshot that includes the Ray ID and the timestamp, send it to the site owner, and they can look up the exact rule in their Security Events log. Turning off a VPN or proxy is the one thing worth trying first.
What HTTP status code does a Cloudflare 1020 error return?
403. Cloudflare documents the WAF block page as returning a 403 status code, and the 1020 text appears in the HTML body rather than in the status line. That is why an automated client sees a generic 403 and never sees the number 1020 at all.
What is the difference between Cloudflare error 1020 and 1015?
A 1020 means a security rule matched something about your request, such as its country, IP address, path or user agent. A 1015 means you were rate limited for sending too many requests in a short window. A 1015 usually clears on its own after you wait; a 1020 will not.
Why do I get error 1020 on only one website?
Because these rules are written per zone by each site owner. There is no global Cloudflare blocklist behind this code, so a rule on one site says nothing about any other site. If you see 1020 across many unrelated sites, suspect your network or VPN exit address rather than the sites.