Cloudflare Error 1020: Access Denied – Causes and Fixes
Learn what Cloudflare error 1020 means, which firewall rule types trigger it, how to identify the match, and what visitors and operators can do.
Error 1020 means a firewall rule configured by the site matched the request and blocked it. The rule is the site's, so the same request can be fine everywhere else.
1. What Error 1020 Means
A custom rule matched and its action was block.
- The site wrote the rule. Nothing about it is platform policy.
- The match could be anything the rule engine can express.
- It is not a rate limit. That produces 1015.
- It is not a signature ban. That produces 1010.
2. What Rules Commonly Match On
| Condition | Typical intent |
|---|---|
| Country or region | Restricting service areas or blocking regions with abuse history |
| Address or range | Blocking a specific source, often hosting ranges |
| User agent | Blocking clients that identify as automation |
| Path | Protecting admin, login, or API paths |
| Request method | Blocking write methods from unauthenticated sources |
| Header presence or absence | Requiring or forbidding particular headers |
| Threat score | A composite risk assessment |
Combinations are common: a rule may block a path only when the request also comes from a hosting range.
3. Diagnosing It as a Visitor
The block page includes a ray identifier, which is the reference the site's operator needs to find the exact rule that matched.
Practical isolation steps:
- Try a different network — success suggests an address or country rule.
- Disable a VPN — VPN exits are frequently blocked.
- Try a different browser or device — success suggests a user-agent or client rule.
- Try a different path on the same site — success suggests a path-scoped rule.
4. What a Visitor Can Do
If the block is genuine policy, nothing client-side is appropriate. Contact the site with the ray identifier and the approximate time; that is the only reliable route to an exception.
Attempting to evade a deliberate block is neither effective for long nor appropriate, since the rule is the operator's stated intent.
5. For Site Operators
- Search the firewall event log for the ray identifier to see which rule matched and why.
- Check whether the rule is broader than intended — country and hosting-range rules catch many legitimate users.
- Prefer challenge over block for uncertain traffic, so false positives can self-resolve.
- Log matches before enforcing when introducing a rule.
- Keep an allow-list for known-good partners and verified crawlers.
6. For Legitimate Collection
A 1020 is a statement that the site does not want this traffic on this path from this source. The correct responses are to stop, to check robots.txt and terms, and to ask for permission or an API.
Where collection is authorised, an allow-list entry keyed on a stable identifier is far more durable than any adjustment to how requests are presented.
7. Error 1020 Versus Related Codes
- 1015 — too fast; wait and it clears.
- 1010 — client signature refused.
- 1006 / 1007 / 1008 — the address itself is banned.
- 403 without a ray page — the origin, not the edge, refused.
8. Summary
Error 1020 is a site-authored firewall rule blocking the request, matched on country, address, path, user agent, method, headers, or a combination.
Visitors should isolate the variable and contact the operator with the ray identifier; operators should read the firewall log and consider whether a challenge would serve better than a block.