Cloudflare Error 1020: Access denied
Cloudflare decided this request is not allowed — a firewall rule, WAF custom rule, IP/country block, or Access policy stopped it at the edge, so your origin never saw it.
What visitors see
Error 1020
Access denied
The owner of this website has banned your access based on
your browser's apparent characteristics or your IP address.
Cloudflare Ray ID: …Copy the Ray ID. It is the fastest way to find the exact rule in the Cloudflare dashboard.
1020 vs 1015 vs 403 vs 1014
| Symptom | Who blocked it | Typical cause |
|---|---|---|
| Error 1020 | Cloudflare Firewall / WAF / Access | Custom rule, IP/country/ASN block, Bot Fight, Access app policy |
| Error 1015 / rate limit | Cloudflare rate limiting | Too many requests from an IP or path; often “You are being rate limited” |
| HTTP 403 from origin | Your app / nginx | App authz, deny, missing host — origin did respond |
| Error 1014 | Cloudflare CNAME setup | CNAME cross-user / banned configuration (setup), not a visitor ban |
| Error 1016 | Origin DNS | Cannot resolve origin — not an access policy |
Rule of thumb: 1020 = “Cloudflare’s security layer said no.” Fix the matching rule or the client identity — opening origin ports will not help a request the edge never forwards.
Frequent real causes
- Custom Firewall / WAF rule — block on path, user-agent, country, ASN, or expression that is broader than you meant (e.g. blocked
/apiand your own CI). - IP / country / ASN block list — office VPN, mobile carrier CGNAT, or a cloud egress IP landed on a block.
- Bot Fight / Super Bot Fight — aggressive bot mode challenges or blocks scripted clients, curl, and some headless browsers.
- Cloudflare Access — app policy requires login; unauthenticated or wrong-IdP users get Access denied style pages (often still Ray-ID keyed).
- Hotlink / referrer / threat score rules — empty referrer, datacenter IP, or elevated threat score matches a block action.
- Accidentally blocked yourself — you tested a rule while on the same IP the rule bans.
Diagnose with the Ray ID
- Open Cloudflare → Security → Events (or Firewall → Events).
- Search / filter by the Ray ID from the error page.
- Read service, action (block / challenge), and rule name / rule ID.
- Confirm whether the client IP, country, JA3/bot score, path, or Access policy matched.
- If you cannot find the Ray ID, widen the time range and filter by the hostname + client IP.
Fixes that usually work
- Skip or allow the legitimate path/IP/ASN in the rule (prefer narrow skips over turning the whole WAF off).
- For your own office/CI, add an allow rule with higher priority than the block, scoped to those IPs.
- If Bot Fight is too sharp for APIs, exclude the API hostname or switch scripted clients to a documented bypass (authenticated token, not “disable all bots forever”).
- For Access-protected apps, sign in with the right IdP or adjust the policy groups — do not confuse Access denial with an origin 403.
- After changes, hard-refresh or try a private window; CDN caches do not usually cache 1020 the way they cache 200s, but browsers may reuse a tab error page.
What not to do
- Do not restart the origin first — the request never got there.
- Do not “pause Cloudflare” as the default fix; you lose the audit trail and every other protection with it.
- Do not wholesale allow
http.user_agent contains "curl"on production unless you understand the abuse risk.
# From a blocked client, capture the Ray ID from HTML or headers:
curl -sI https://www.example.com/ | tr -d '\r' | grep -i cf-ray
# Compare from a known-good network / IP to see if the block is IP-based.
Related
Cloudflare Error 1010 · Cloudflare Error 1006 to 1009 · All Cloudflare error codes · Cloudflare Error 1016 · HTTP 429 / rate limiting · HTTP 401 vs 403 · ERR_BLOCKED_BY_CLIENT · Cloudflare Error 523 · CSRF token missing · Anvil HTTP status · Wirebook status-code lesson
Questions
What does Cloudflare Error 1020 mean?
A Cloudflare firewall, WAF, bot, or Access policy blocked the request at the edge — the origin never handled it.
How do I find which rule blocked me?
Copy the Ray ID from the error page and search Security → Events (Firewall Events) for that Ray ID to see the rule name and action.
Is Error 1020 the same as HTTP 403?
No. A 403 from your origin means the app answered. 1020 is Cloudflare refusing before the origin.
Can Bot Fight Mode cause 1020?
Yes. Aggressive bot modes can block or challenge scripted clients, datacenter IPs, and some browsers — check Events for the bot service.
Why am I blocked but a coworker is not?
Different client IPs, countries, ASNs, or bot scores. Compare both Ray IDs in Events.
Does pausing Cloudflare fix 1020?
It bypasses the block but also every other edge control. Prefer adjusting the matching rule or adding a narrow allow.
Can Cloudflare Access show as 1020?
Access denials are policy blocks at the edge. Check Access audit/logs as well as Firewall Events for the Ray ID.
Published · updated .