How to Fix Cloudflare Error 1006 (Access Denied: IP Address Banned)
What Cloudflare Error 1006 means
Cloudflare's 1xxx error family covers problems in the DNS, proxy, and security layers, and Error 1006 is the one titled "Access Denied: Your IP address has been banned." Cloudflare groups it with Errors 1007, 1008, and 1106, which all carry the same meaning: the visitor's IP address was banned under the website owner's security settings. When you see this page, the site itself is almost certainly working fine for everyone else. You are not hitting a server outage, a broken link, or a mistyped address — you have been deliberately turned away at the gate.
That distinction matters, because it rules out most of the usual fixes. Clearing your browser cache, reinstalling your browser, or waiting an hour for the site to "come back" will not help, since nothing on your computer or on the site's server is broken. The decision belongs to the site owner's Cloudflare configuration, and Cloudflare's own documentation states that its support team cannot override the owner's settings. So the work splits into two parts: first, make sure your side is genuinely clean, so the ban is not immediately re-earned; second, get the owner to remove the ban itself. Visitors handle the first part and request the second; site owners handle the second part directly in their dashboard.
Common causes
- Malware or a virus on your computer: an infected machine quietly generates spam, botnet traffic, or attack patterns, and the site's security rules correctly flag its public IP as a source of abuse. This is a leading cause of an IP ban, and it is why a full scan comes before any message to the site owner.
- Another infected device on your network: Cloudflare sees your public IP address, so the flagged traffic can come from anywhere behind your router — another family member's laptop, a phone, a smart TV, or an internet-connected camera running bot malware. Your own computer can be spotless while a compromised gadget on the same Wi-Fi keeps the whole household banned.
- Automated tools running on your connection: scrapers, auto-refreshers, SEO audit tools, download managers, and misconfigured VPN exits send requests far faster than a human browses. Even legitimate tooling can cross the line into patterns that security rules treat as abuse, and the resulting ban lands on the IP, not on the tool.
- A previous holder of your IP address: home internet connections share IP ranges, and many providers hand out dynamic addresses. If the previous holder of your current address was abusive or infected, the ban can attach to you the moment that address rotates to your router. A router restart sometimes draws a cleaner address and clears the problem on its own.
- An over-broad rule on the site owner's side: owners sometimes block whole countries, hosting ranges, or address blocks that include legitimate visitors, or they set a Zone Lockdown rule that was never meant to cover ordinary browsers. Cloudflare even notes that Error 1006 can appear in the Workers Preview tab when Zone Lockdown blocks the Google Cloud Platform addresses that tab relies on. If your devices are clean and the ban follows you across networks, the block is likely a false positive the owner needs to narrow.
How to fix Error 1006 — step by step
Steps 1 through 6 are for visitors. Step 7 is for the site owner.
- Confirm the ban follows your IP address, not the website. Error 1006 is a deliberate block, not a broken site. Open the same page on your phone with Wi-Fi turned off, using mobile data only. If the page loads there, the ban is aimed at your home or office IP address, and the visitor steps below apply. If the page fails on mobile data too, the ban may cover a wider range, or you may be looking at a different problem — note exactly what each device shows before you move on.
- Write down your public IP address and the Ray ID. On a device that is not blocked, search for what is my IP and write down the public address of the blocked connection, not the 192.168.x.x address from your router settings. Also copy the Ray ID printed at the bottom of the Error 1006 page, plus the date and time you first saw the error. The site owner needs your public IP to find and lift the ban, and the Ray ID lets them locate your exact blocked request in their Security Events log.
- Update your antivirus software and run a full scan. A banned IP usually means something on that address generated traffic the site classified as abusive, and malware on a computer is a leading cause. Update your antivirus definitions, run a full system scan rather than a quick one, and follow it with a second-opinion scan from a free on-demand tool such as Malwarebytes. Remove anything found and restart the computer. Contacting the site owner before cleaning up achieves little, because the same traffic will keep the ban in place.
- Check every device on your network and secure your router. Cloudflare judges the public IP, so the offending traffic can come from any device behind your router — another computer, a phone, a smart TV, or an internet-connected camera running bot malware. Scan the other computers on the network, disconnect any device you do not recognize, and log in to your router to replace a weak or default admin password. A single compromised gadget can keep an otherwise clean household banned.
- Restart your router and stop automated tools. Turn off scrapers, auto-refreshers, SEO audit tools, download managers, and any software that hammers the site faster than a person could browse. Then restart your router and wait a couple of minutes before reconnecting: many home internet plans assign a fresh public IP address on reconnect, and a new address with a clean reputation can clear the block on its own. This does not help with a static IP, but it is harmless and often effective, and it is worth trying before you write to the owner.
- Contact the site owner and ask them to allow your IP. Only the site owner can lift an IP ban, because the ban lives in their Cloudflare security settings and Cloudflare cannot override it. The 1006 page blocks the site itself, so reach the owner through their social media profiles or the contact address in the domain WHOIS record. Keep the message short: you are a legitimate visitor seeing Cloudflare Error 1006, you have scanned your devices and secured your network, and you are asking them to remove the ban or add an Allow rule for your IP. Include your public IP address, the Ray ID, and the time you first saw the error.
- Site owner: find the ban and remove it in IP Access Rules. If you run the site, open the Cloudflare dashboard, select the domain, and go to Security, then Events, and search for the visitor Ray ID or IP address to confirm which rule fired. Then go to Security, then WAF, then Tools, and look at IP Access Rules: delete the Block rule for that IP or add an Allow rule for it. If the ban came from a firewall rule or a country block that is broader than you intended, narrow that rule instead of whitelisting one address at a time. Also check Zone Lockdown rules, which can produce Error 1006 for legitimate addresses that were never meant to be blocked, including Google Cloud Platform IPs used by the Workers Preview tab.
Did this fix it? Quick checklist
- A full antivirus scan came back clean on every computer on your network
- The site loads from a different network, proving the ban follows your old IP
- Your public IP address and the Ray ID are written down for the site owner
- If you own the site, IP Access Rules no longer block the visitor, with an Allow rule in place
If the owner removed the ban and you still see Error 1006, first check that they allowed the right address — people routinely paste their local network address (192.168.x.x) instead of their public one, which changes nothing. Then confirm the rule was changed in the correct zone if the site holds multiple domains, and wait a few minutes for dashboard changes to take effect. And if you are the owner and the same addresses keep getting banned, do not just keep whitelisting: look at what traffic those addresses were actually sending, because a real bot problem on the visitor's side will keep re-triggering the block.
Frequently asked questions
What does Cloudflare Error 1006 mean?
Error 1006 is Cloudflare Access Denied page that means your IP address has been banned by the website owner. Cloudflare groups Error 1006 with 1007, 1008, and 1106, and all four mean the same thing: the client IP address was banned under the site security settings. The site is working fine — you have been deliberately turned away.
How is Error 1006 different from Error 1012 or Error 1020?
Error 1006 is specifically an IP ban: your address sits on the site block list. Error 1012 is the broader Access Denied page for malicious activity detected from your computer or network, and Error 1020 means a single firewall rule with a Block action matched your request. The practical fix is similar — clean your devices and contact the owner — but with 1006 the owner must remove or override the IP ban itself, not just adjust a rule.
Can Cloudflare support unban my IP address?
No. Cloudflare states that it cannot override the security settings the site owner has set for the domain, and that includes an IP ban. The block was created by the owner configuration, so only the owner can delete the Block rule or add an Allow rule for your address. Your route to the site runs through the owner, not through Cloudflare support.
Will a VPN or a new IP address fix Error 1006?
A different IP address will usually let you reach the site, because the ban applies to your old address — restarting your router often draws a fresh one, and a VPN makes you appear from another address entirely. Treat that as a workaround, not a fix: if your device or network is still generating abusive traffic, the new address can end up banned too, and many sites also block known VPN exit IPs. Scan your devices first, then use a different network only as a diagnostic step or a stopgap.
I own the site — how do I unban a visitor who sees Error 1006?
In the Cloudflare dashboard, select the domain, then go to Security, then Events, and search for the visitor Ray ID or IP to confirm the ban. Then go to Security, then WAF, then Tools, and check IP Access Rules: delete the Block rule for that IP or add an Allow rule for it. If the visitor never should have been blocked, also review your firewall rules and Zone Lockdown rules for anything broader than you intended, since an over-wide rule will keep banning legitimate visitors one address at a time.