# Cloudflare error 1020: Access denied

> A security rule of the website's owner blocked your request. The website itself is online.

## Quick answer

Cloudflare shows error 1020 when a request matches a firewall rule that the website owner set up, for example a rule about countries, address ranges, browsers or automated traffic. Cloudflare does not decide this. Its page for the error names the customer's Firewall Rules, a feature Cloudflare has deprecated and converted to WAF custom rules (the owner's own filter rules in Cloudflare's web application firewall). The site is up and refused this one request on purpose.

When to wait: Waiting does not lift a firewall rule. Only the website owner can change it.

## If you are visiting the website

1. **Switch off VPN and proxy for one try** Rules often look at the address a request comes from. A VPN, a proxy or a company network can give you an address that a rule blocks, so switch it off and reload once.
   - Windows: Disconnect an active VPN under Settings > Network & internet > VPN. Under Network & internet > Proxy, switch off a proxy you did not set up.
   - macOS: Disconnect an active VPN, then check Apple menu > System Settings > Network > your network service > Details > Proxies and switch off proxies you did not configure.
2. **Try a private window and then another network** A private window starts without your stored cookies. If that does not help, switch off extensions that change requests, such as VPN, proxy or privacy add-ons, at `chrome://extensions`, and try mobile data instead of Wi-Fi.
   - Windows: Press Ctrl + Shift + n in Chrome to open an Incognito window.
   - macOS: Press ⌘ + Shift + n in Chrome to open an Incognito window.
   - ChromeOS: Press Ctrl + Shift + n to open an Incognito window.
3. **Send the owner a screenshot with the Ray ID** Cloudflare's advice to visitors is to give the website owner a screenshot of the error. Capture the whole page, including the Ray ID (a reference number Cloudflare gives every request) and the time near the bottom, and send it through the contact form, email or social media account of the site.
4. **Retry once per change, not in a loop** Reloading again and again does not change a rule and can make your traffic look automated. One retry after each change is enough.
5. **If the block is meant for your region** If the owner confirms that your country is blocked on purpose, look for an official version of the service for your country. Our comparison at /vpn starts with free options and rates VPN services only on documented facts; a VPN can break the terms of a site, so read them first.

## If you run the website

1. **Find the event behind the Ray ID** In the Cloudflare dashboard, go to Security > Analytics and open the Events tab. Filter by the visitor's IP address or look for the Ray ID from the screenshot. The time on the error page is in UTC, so convert it before you search; the event names the action and the security feature that acted. On the Free plan you only see sampled logs, so the exact request may be missing; then search by IP address and time.
2. **Narrow the rule instead of excusing one visitor** Adjust the matching custom rule, or allow a trusted address with an IP Access rule. An Allow rule skips custom rules, rate limiting rules and managed rules for that address, so use it sparingly.
3. **Use a challenge where a block is too hard** If a rule is meant to slow down bots, a Managed Challenge makes the browser pass a check instead of refusing the request outright, so real visitors still have a way in.
4. **Ask for reports quickly** Security Events keeps data for up to 31 days. Ask visitors for the Ray ID soon after a block.
5. **Confirm the fix from outside** Request the page from another network with `curl -sI https://example.com` and check that the answer is no longer a 403 from Cloudflare. A rule aimed at bots can still block `curl`, so also ask the visitor to try again.

## 1020, 1009 or 1015: what is the difference?

All three come from Cloudflare, and with all three the website is online. Error 1009 is a ban on a whole country or region, 1015 is a rate limit that ends after a while, and 1020 comes from a firewall rule the owner wrote. Such a rule can also look at countries, addresses, browsers or automated traffic.

That is why 1020 needs the Ray ID: the page alone does not reveal which rule matched.

## What our check sees

According to the Cloudflare rules documentation, most security features answer a blocked request with HTTP status 403. CheckWebsiteNow reports such an answer as a restricted answer, not as an outage: the site is reachable but refused the request.

A rule can treat our server differently from your browser, so your result and ours can differ. That difference is itself a clue for the owner.

## For site owners: why real visitors get caught

Rules that match a whole country, the address range of a cloud provider or a missing browser header can catch people as well as bots, for example visitors on a VPN, a corporate proxy or a privacy browser.

Look through recent Security Events for blocked requests that look human before you tighten a rule. Cloudflare itself recommends custom rules over IP Access rules for blocks by address or country, because they allow finer conditions.

## Common questions

### Am I banned from the website for good?

Not necessarily. The rule may match your network, your country or your browser rather than you as a person. When the owner narrows or removes it, access returns at once.

### Can Cloudflare unblock me?

No. Cloudflare's documentation for error 1020 asks visitors to send the website owner a screenshot, because only the owner controls the rule.

### Will a VPN get around error 1020?

It can go either way. A rule may block your own network, or it may block the shared addresses that VPN services use. Try without a VPN first, and respect the terms of the site.


## Likely causes

- The owner blocks requests from your country, address range or network provider. (common, owner side)
- Your VPN, proxy or company network shares an address that a rule blocks. (sometimes, visitor side)
- A browser extension, an unusual browser or an automated tool makes the request look like a bot. (sometimes, visitor side)
- A rule matches more requests than the owner intended. (sometimes, owner side)

## What to avoid

- Do not keep reloading; the rule decides, not the number of attempts.
- Do not report the site as broken; error 1020 is a deliberate refusal of one request.

## Related messages

- [Cloudflare error 1009: Country or region banned](https://checkwebsitenow.com/errors/cloudflare-1009)
- [Cloudflare error 1015: You are being rate limited](https://checkwebsitenow.com/errors/cloudflare-1015)
- [403 Forbidden](https://checkwebsitenow.com/errors/http-403)
- [Result: The check was restricted](https://checkwebsitenow.com/errors/result-access-restricted)

## Sources

- [Cloudflare Docs: Error 1020 (Access denied)](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1020/)
- [Cloudflare Docs: Security Events](https://developers.cloudflare.com/waf/analytics/security-events/)
- [Cloudflare Docs: Cloudflare Ray ID](https://developers.cloudflare.com/fundamentals/reference/cloudflare-ray-id/)
- [Cloudflare Docs: IP Access rules](https://developers.cloudflare.com/waf/tools/ip-access-rules/)
- [Cloudflare Docs: WAF custom rules](https://developers.cloudflare.com/waf/custom-rules/)
- [Cloudflare Docs: Firewall Rules to WAF custom rules migration](https://developers.cloudflare.com/waf/reference/migration-guides/firewall-rules-to-custom-rules/)
- [Cloudflare Docs: Rules language actions (Block, Managed Challenge)](https://developers.cloudflare.com/ruleset-engine/rules-language/actions/)
- [Google Chrome Help: Browse in Incognito mode](https://support.google.com/chrome/answer/95464?hl=en)
- [Microsoft Support: Use a proxy server in Windows](https://support.microsoft.com/en-us/windows/use-a-proxy-server-in-windows-03096c53-0554-4ffe-b6ab-8b1deee8dae1)
- [Apple Support: Change Proxies settings on Mac](https://support.apple.com/guide/mac-help/change-proxy-settings-on-mac-mchlp2591/mac)

Last updated: 2026-10-07. Check a website now: https://checkwebsitenow.com/?check=example.com