Cloudflare Error 1006 Explained – Access Denied and How to Respond
Learn what error 1006 means, how it differs from a rate limit or a firewall rule, and what a visitor or operator can do about it.
Error 1006 reports that the visitor's address has been banned. It is an address-level block rather than a rate limit or a client-signature refusal, and it persists until the ban is lifted.
1. What It Means
The address has been added to a deny list, either by the site or through platform-level protections.
- Not a rate limit. That produces 1015 and clears on its own.
- Not a signature refusal. That produces 1010.
- Not a general firewall rule match. That produces 1020.
- The address itself is the reason.
2. Why an Address Gets Banned
| Cause | Typical origin |
|---|---|
| Sustained abusive traffic | Volume from that address |
| Reputation feeds | Abuse reported elsewhere |
| Manual blocking | The site added it deliberately |
| Range blocking | The whole range was blocked, not you |
| Shared address | Someone else behind the same address |
The last two are the reason well-behaved visitors encounter it.
3. Shared Addresses Make It Collateral
Carrier-grade NAT, office gateways, campus networks, and VPN exits all put many people behind one address. A ban earned by one affects everyone.
That is also why it is worth reporting rather than assuming you did something: the operator may not realise how many people the block covers.
4. What a Visitor Can Try
- Test from another network — a phone hotspot is the quickest.
- Disable a VPN, since shared exits are frequently banned.
- Confirm other sites work, distinguishing a site block from a local problem.
- Contact the site with the ray identifier from the error page and the approximate time.
If it works from another network, the address is the cause and only the operator can lift it.
5. Related Codes
- 1007 — the address was banned by the owner of the site.
- 1008 — banned through a broader mechanism.
- 1010 — the client's signature was refused.
- 1015 — rate limited; clears with time.
- 1020 — a firewall rule matched.
Distinguishing them matters: waiting resolves 1015 and never resolves 1006.
6. For Site Operators
- Check what the block covers. An address may represent thousands of users.
- Prefer challenges for uncertain traffic and reserve bans for confirmed abuse.
- Expire bans. Standing lists accumulate and eventually refuse legitimate visitors.
- Publish a contact route on block pages.
- Review reputation-feed blocks, which are broad by design.
7. For Legitimate Collection
A 1006 is a statement that this address is unwelcome. Rotating to another address to continue substitutes evasion for permission and is neither durable nor appropriate.
The productive responses are to stop, review robots.txt and terms, reduce volume substantially, and ask about an API or an allow-list entry.
8. Summary
Error 1006 is an address-level ban, distinct from rate limiting and from signature or rule-based refusals, and it does not clear with time.
Because addresses are shared it frequently affects uninvolved visitors, who can only confirm the diagnosis from another network and contact the site — and for automated collection it is a signal to ask rather than to route around.