How to Fix Cloudflare Error 1003 (Direct IP Access Not Allowed)

By ErrorFix · Updated October 18, 2026 · 3 min read

What Error 1003 means

When a website sits behind Cloudflare, every legitimate visit follows the same path: you type a domain name, your browser resolves it to a Cloudflare edge IP, and Cloudflare forwards the request to the site's real server after applying its firewall rules, caching, and bot checks. Error 1003 — 'Access Denied: Direct IP Access Not Allowed' — appears when someone skips the domain name and connects to a Cloudflare IP directly. Cloudflare recognizes the request as direct-IP access and refuses it, because without the domain name it cannot apply the site's security rules or route to the right website.

This block is intentional and permanent: there is no setting, flag, or browser trick that lets a visitor through it. Direct IP access is exactly what attackers use to bypass Cloudflare's protection — find the origin server's IP and attack it straight — so Cloudflare treats every direct-IP request as untrusted by default. If you are seeing a 1003, the site is almost certainly fine for everyone else; something on your side simply addressed the request to numbers instead of a name.

Common causes

• Browsing a raw IP in the address bar: pasting or typing an address like http://104.21.5.10/ — often copied from a DNS lookup tool, a ping result, or a tutorial — triggers the block immediately.
• Bookmarks or shortcuts pointing at the IP: an old bookmark saved before the site moved behind Cloudflare keeps sending the browser straight to the IP on every visit.
• Scripts and tools hardcoding the IP: scrapers, uptime monitors, RSS readers, and API integrations that store the server's IP instead of its domain name get a 1003 on every request.
• Browser extensions or embedded resources: an extension, widget, or page embed that loads a resource from the raw IP triggers the error even when the address bar shows a proper domain name.
• VPN or proxy rewriting requests: some VPNs, corporate proxies, and aggressive privacy tools resolve hostnames to IPs and forward IP-based requests, which Cloudflare rejects the same way.

How to fix Error 1003 — step by step

Steps 1 through 3 fix the common visitor cases. Steps 4 through 6 cover tools, extensions, and network software.

1. Check the address bar for a raw IP address. Error 1003 fires when the request goes to a Cloudflare IP directly instead of the website's domain name, so the first check takes five seconds: look at your browser's address bar. If it shows numbers like http://104.21.5.10/ or http://[2606:4700:...]/ instead of a name like example.com, that is exactly what Cloudflare is blocking. Reaching a Cloudflare-protected site by its IP is denied on purpose, because only requests through the domain get the firewall, caching, and security checks. This single mismatch is the cause in almost every real-world case.
2. Browse the domain name instead of the IP. Replace the IP address with the site's actual domain name and press Enter. If you found the IP from a DNS lookup tool, a ping result, or an old tutorial, just type or paste the real website name (for example www.example.com) into the address bar. Cloudflare serves the site normally the moment the request carries the correct hostname, so the 1003 page clears instantly — no cache clearing, no waiting, no settings changes. If you do not know the domain name, search for the site by name instead of trying to guess it from the IP.
3. Fix bookmarks, shortcuts, and auto-complete entries pointing at the IP. If the 1003 comes back every time you visit, something on your side keeps sending you to the IP. Open your bookmarks manager (Ctrl+Shift+O in Chrome, Ctrl+Shift+B in Firefox) and search for entries whose URL contains a raw IP instead of the domain name. Update or delete them, and check desktop shortcuts and browser auto-complete suggestions too — an old bookmark made before the site moved behind Cloudflare is one of the most common triggers. After fixing them, close and reopen the browser so no cached suggestion reopens the old address.
4. Update scripts, API clients, and tools that hardcode the IP. Error 1003 frequently shows up in web scrapers, monitoring tools, RSS readers, uptime checkers, and custom API integrations that store the server's IP instead of its domain. Open the script's configuration or code and replace every hardcoded IP address with the domain name, keeping the HTTP Host header correct — a request to the IP with the right Host header can still be blocked, so the URL itself must use the name. If a third-party tool triggers the error, report the issue to its developer with a screenshot; they need to fix their endpoint configuration.
5. Use the browser's network tab to find the direct-IP request. When the error appears only on certain pages, widgets, or embeds, press F12 to open developer tools, go to the Network tab, and reload the page. Scan the request list for any row whose URL starts with http:// or https:// followed by numbers instead of a domain name — that request is the 1003 trigger. It may come from a browser extension, an embedded player, or a page element loading a resource from the IP. Once identified, correct the source (update the extension's settings, fix the embed code, or contact the site owner if the broken link is on their page).
6. Disable extensions and check for proxy or VPN interference. Some browser extensions, VPNs, and corporate proxies rewrite requests or resolve hostnames to IPs before the request reaches Cloudflare, which can produce a 1003 even though the address bar shows a proper domain name. Open an incognito window (which loads without extensions by default) and try the site again — if it works there, re-enable extensions one by one until the error returns to find the culprit. VPN and proxy users should also try with the VPN paused once, because an exit node doing IP-based forwarding can trigger the same block.

Did this fix it? Quick checklist

• The address bar now shows the site's domain name, not a raw IP address
• Old bookmarks, shortcuts, and auto-complete entries pointing at the IP are updated or deleted
• Scripts, bots, and monitoring tools use the domain name in their URLs and Host headers
• The 1003 does not reappear in an incognito window (rules out extension or proxy rewriting)

One detail worth knowing: a 1003 page that looks slightly different — plain text saying 'Access Denied: Direct IP Access Not Allowed' instead of a branded error page — usually means you hit the raw origin IP, not even Cloudflare's edge. The site's server itself refused the direct connection. Either way the fix is the same: go back to the domain name. And if you are the one who built the link, app, or tool that points at the IP, treat the domain name as the only stable address — IPs rotate whenever the site changes hosts, so hardcoding them guarantees this error eventually.