Cloudflare Error 1020: Access Denied

Troubleshooting P1 cloudflare error 1020

Learn what Cloudflare Error 1020 Access Denied means, which firewall rule triggers it, how it differs from 1015 and 1010, and how to diagnose and resolve it.

Error 1020 means a site owner wrote a rule and your request matched it. That is the whole mechanism, and it is worth internalising because it changes where you look: 1020 is not Cloudflare deciding you are a bot, it is Cloudflare enforcing something a human configured.

1. What Does Cloudflare Error 1020 Mean?

Error 1020 — Access Denied — is returned when a request matches a Cloudflare firewall rule whose action is Block.

Key idea: a customer-defined rule matched, and the action was to refuse.
Mechanism: Cloudflare evaluates WAF custom rules, rate-limiting rules, and managed rulesets at the edge; a Block action terminates the request before it reaches the origin.
Status code: usually 403, with the 1020 identifier in the body.

The request never reached the website's own server. The origin has no log of it, which is why site owners sometimes insist nothing is wrong.

2. Common Causes

Country or region blocking. The site restricts traffic by geography, and your address resolves to an excluded country. Extremely common, and it catches VPN users constantly.

ASN or hosting-provider blocking. A rule blocking traffic from cloud provider ASNs. Requests from AWS, Google Cloud, or a VPS provider match regardless of anything else about them.

User-agent rules. A rule matching known automation strings, or conversely one requiring a plausible browser user agent. An empty User-Agent matches many such rules.

Path-based rules. /wp-admin, /api/, or /login protected by a rule that only permits certain addresses.

Threat-score thresholds. A rule blocking requests whose Cloudflare threat score exceeds a value. Shared or previously abused addresses inherit poor scores.

Rate-limiting rules with a Block action. Sustained volume from one address converts into a firewall block rather than a 429.

Missing or malformed headers. Rules requiring specific headers — an API key header, a referrer — block anything without them.

A misconfigured rule. Rules are written by people, and an overly broad expression blocking legitimate visitors is a genuinely frequent cause.

3. How to Diagnose It

Read the block page. It shows the Ray ID and the client IP Cloudflare saw. Both are what a site owner needs to identify the exact rule, and asking without them wastes everyone's time.

Try from a different network. Success from a mobile connection and failure from a server strongly indicates ASN or country matching.

Try a plain browser request. If a normal browser from your network is also blocked, the rule is matching your address rather than your client's characteristics.

Vary one thing at a time. Change only the user agent, then only the IP, then only the path. Whichever change unblocks you names the rule's dimension.

Check whether it is only certain paths. Blocking on /api/ while / loads fine identifies a path rule immediately.

Distinguish 1020 from a challenge. A challenge page — "Checking your browser" — is not 1020. Challenges are a managed bot response; 1020 is a firewall Block, and no amount of solving will pass it.

4. How to Fix It

If you are the site owner: open the Cloudflare dashboard, go to Security Events, and filter by the Ray ID from the block page. It names the exact rule that fired. From there, narrow the expression, add an exception, or change the action from Block to Managed Challenge, which lets legitimate users through while still filtering automation.

If you are a legitimate visitor: contact the site with the Ray ID and the IP shown on the page. Only they can change the rule. Disabling a VPN, or switching networks, resolves the common geography and ASN cases immediately.

If you are running automated traffic with permission: ask the operator to allowlist your ASN, your specific addresses, or a shared secret header. This is the correct and durable fix, and it is what the header-based rule exists to support.

If you are running automated traffic without an arrangement: understand what 1020 is telling you. Unlike a challenge, which is a test you can legitimately pass, a Block is an explicit statement that this traffic is not wanted. Rotating addresses until one slips through is circumvention of a stated decision, not a technical fix — and it is fragile, because the next rule will be broader.

Check for a supported route. Many sites blocking automated traffic at the edge publish an API or data export precisely so it does not have to be scraped.

Error	Meaning	Cause
1020 Access Denied	Firewall rule with a Block action matched	Customer-configured rule
1015 Rate Limited	Too many requests	Rate-limiting rule
1010 Browser Signature Banned	Browser signature identified as automation	Detected headless or modified browser
1006 / 1007 / 1008	IP banned	Address-level ban
"Just a moment…"	Interstitial challenge	Bot management, not a Block

6. Real-World Examples

A site loads on mobile but 1020s on office Wi-Fi. Something about the office egress address — often its ASN or a shared reputation — matches a rule.
1020 from every cloud server, never from a laptop. A hosting-ASN rule, and adding more cloud IPs cannot help.
1020 only on /api/. A path rule, while the marketing site remains open.
A site owner sees no traffic in origin logs. Correct — Cloudflare blocked at the edge, so nothing arrived.
1020 after adding a VPN. The exit node is in an excluded country, or its address carries a poor threat score.

7. Summary

Cloudflare Error 1020 means a firewall rule matched your request and its action was Block. It is customer-configured, evaluated at the edge, and the origin server never saw the request.

Diagnose by varying one dimension at a time — network, user agent, path — until the blocked variable reveals itself. Fix it as a site owner by finding the rule via the Ray ID in Security Events and narrowing it. Fix it as a visitor by contacting the operator with the Ray ID, since only they can change it.

And distinguish 1020 from a challenge: a challenge is a filter you can pass legitimately, while a Block is a decision someone made deliberately. Treating the second like the first leads somewhere unproductive.