How to Fix Cloudflare Error 1020 (Access Denied)
What Error 1020 means
Error 1020 is Cloudflare's "you are not welcome here" message. Site owners can write firewall rules — now called WAF custom rules — that block traffic matching conditions they choose: visitors from certain countries, IP ranges known for abuse, requests with suspicious user agents, or hits on sensitive paths like wp-admin. When your request matches one of those rules, Cloudflare serves the 1020 "Access denied" page instead of the site, and nothing on your computer or the origin server is broken.
The error page shows a Cloudflare Ray ID at the bottom — a unique ID for your blocked request. That Ray ID is the most important thing on the page: it is how the site owner finds your request in their logs and lifts the block. And note that 1020 is different from Error 1015 (Rate Limited), which means you were asking for pages too fast rather than being turned away on purpose.
Common causes
- VPNs, proxies, and Tor exit nodes: many rules block these outright because abuse so often comes through them — your VPN's exit IP may be banned even though you personally did nothing wrong.
- A flagged IP address: your IP may sit in a range the owner blocked after past abuse. This is common on shared mobile or carrier NAT connections and public Wi-Fi, where hundreds of strangers share one public address.
- Country blocks: the rule may block entire countries the owner does not serve. Travelers, expats, and users whose IP is mislocated to another country all get caught by these.
- Bot or user-agent filtering: aggressive bot protection can flag legitimate browsers — especially ones with unusual extensions, automation tools, or privacy add-ons that change the browser's fingerprint.
- Overly broad rule expressions: the owner wrote the rule too loosely — blocking a whole ASN, a path pattern that matches real pages, or a keyword that also appears in normal requests — so ordinary visitors trip it.
How to fix Error 1020 — step by step
Steps 1 through 3 are for visitors. Steps 4 through 6 are for site owners.
- Visitor: turn off your VPN, proxy, or data-saver tunnel. Disconnect any VPN, corporate proxy, or "secure browsing" tunnel, close the browser completely, and reload the site. If the page loads, the firewall rule was blocking your VPN's exit IP — use the site without the VPN, or ask the owner to allowlist that exit node.
- Visitor: test from a different network. Toggle Wi-Fi off and load the page on mobile data, or try from another network. If a different IP gets through, your usual IP (or its range) is what is blocked — the block follows the address, not your device, so nothing you reinstall on your phone or PC will change it.
- Visitor: send the site owner your Ray ID and details. Scroll to the bottom of the 1020 page and copy the Cloudflare Ray ID, then contact the site owner through their contact page, support email, or social accounts — the block only stops the site itself, not their other channels. Include the Ray ID, the time it happened, the URL you tried to open, and your public IP address (search "what is my ip"). Ask them to allowlist your IP in the rule. Most owners unblock a clearly legitimate visitor the same day once they have the Ray ID.
- Site owner: find which rule fired in Security Events. Log in to Cloudflare, open the domain, then go to Security, then Events. Filter by recent requests with a 1020 response, or filter by Action: Block and look for the visitor's Ray ID. The log row names the exact rule that fired and shows the request's IP, country, user agent, ASN, and path — that tells you whether you blocked a VPN exit node, a whole country, or something specific like a path pattern.
- Site owner: allowlist the affected visitor or narrow the rule. Open Security, then WAF, then Custom rules, and edit the rule from the previous step. To unblock someone: add a skip or allow for their IP — go to Security, then WAF, then Tools, then IP Access Rules, add the IP with the action "Allow", and save. An IP Access Rule "Allow" overrides the custom rule. If the rule is blocking good traffic broadly, tighten its expression: switch a blocked country to a challenge instead of a block, or move the rule to "Managed Challenge" so suspicious-but-possibly-human visitors get a checkbox instead of a wall. Click Save and Deploy, then retest.
- Site owner: check for mis-targeted conditions. Re-read the rule's expression field by field: a country code typo, an ASN block that covers a whole mobile carrier, a user-agent match like "python" that also catches legitimate tools, or Bot Fight Mode flagging real browsers. The common fix: replace hard blocks on broad signals with Managed Challenge, and keep the hard block only for confirmed abuse patterns such as specific attack paths or known botnets. Watch Security, then Events for 24 hours after the change — if 1020s keep appearing on clean residential IPs, the rule is still too wide.
Did this fix it? Quick checklist
- The page loads with your VPN or proxy disconnected
- A different network (mobile data) reaches the site fine
- You saved the Ray ID and timestamp to send to the site owner
- Owner-side: the blocking rule targets a specific threat, and trusted IPs are allowlisted
If you are a visitor and the 1020 appears on every network you try, your whole region may be blocked rather than just your IP — contact the owner and ask whether your country is on their block list instead of assuming the problem is your connection. If you are an owner and legitimate visitors keep tripping the rule, resist the urge to make it stricter: every hard block you add is a door you are nailing shut, and challenge-based rules stop most abuse while still letting real people knock.
Frequently asked questions
What does Cloudflare Error 1020 mean?
Error 1020 means a firewall rule the site owner wrote in Cloudflare matched your request and blocked it: "Access denied." It is a deliberate block, not a bug — your IP, country, VPN, or browser signature matched a rule meant to keep out abuse. The Ray ID at the bottom of the page identifies your blocked request in the owner's logs.
Why do I get Error 1020 but the site works for my friend?
Because the block is tied to your request's properties — usually your IP address or country — not the site. Your friend has a different IP and possibly a different country, so the rule never matches them. Try disabling your VPN or switching to mobile data: if the site loads, your usual IP is what the rule is blocking.
Can I bypass Error 1020 with a VPN?
Usually it makes things worse. Many 1020 rules specifically target VPN and datacenter IPs because abuse comes through them, so switching to another VPN often lands on a different blocked IP. The reliable path is to browse without the VPN, or contact the owner with your Ray ID and ask for an allowlist.
How do I find which Cloudflare rule caused a 1020?
In Cloudflare: Security, then Events, then filter by the Ray ID or by blocked 1020 responses in the time window the visitor reported. The matching log row names the exact rule. Open it under Security, then WAF, then Custom rules to see its expression — the condition that matched is the thing to fix.
I'm a site owner — how do I allowlist an IP that my rule blocked?
Go to Security, then WAF, then Tools, then IP Access Rules, add the visitor's IP with the action "Allow," and save. An Allow IP access rule overrides WAF custom rules, so the visitor gets through even while the original rule stays in place for everyone else. Ask the visitor for their current public IP — residential IPs can change — and re-check if they report being blocked again.