Quick Answer
Cloudflare Error 1020: Access Denied means a request matched a website owner's Cloudflare Firewall Rule with a Block action. Visitors cannot remove that rule. Save the blocked URL, screenshot, time, and Cloudflare Ray ID, then send them to the website's official support team. Site owners should search Security > Analytics > Events—or the Analytics page's Events tab in the new dashboard—for the Ray ID or client IP and correct the narrowest false-positive condition.
Error 1020 is not automatically an individual IP ban and has no universal expiration time. A rule can match an IP, network, country, path, method, header, user agent, cookie, or several signals together. Changing IP addresses matters only when a network-derived value caused the match.
In 2026, a true 1020 also points to a legacy response path. Cloudflare deprecated Firewall Rules and upgraded them to WAF Custom Rules; current Custom Rule blocks normally use a different WAF block response. A Cloudflare-branded HTTP 403 is therefore not necessarily Error 1020.
Key Takeaways
- Error 1020 is a rule-based denial. It means a Cloudflare Firewall Rule blocked the request; it does not identify the matching condition by itself.
- Visitors cannot remove the website owner's rule. Capture the URL, UTC time, screenshot, and Ray ID, then contact the website through an official support channel.
- It is not necessarily an IP ban. A rule can evaluate the source network, geography, URL, method, headers, user agent, cookies, and other request fields.
- There is no standard cooldown. Error 1020 can continue for as long as the request matches an active blocking rule.
- Changing IP addresses is conditional, not a general fix. It matters only when the rule uses the IP, ASN, country, or another network-derived value.
- Site owners should trace before changing anything. Find the event in Security Events, inspect the rule and request, then create the narrowest safe correction instead of disabling protection globally.
- The 2026 terminology matters. Firewall Rules are deprecated; current WAF Custom Rule blocks normally use a WAF block response rather than the legacy 1020 page.
Methodology: Cloudflare's Error 1020 guidance, Firewall Rules migration documentation, WAF Custom Rules documentation, Security Events reference, Ray ID reference, and IP Access Rules guidance were checked on August 26, 2026. This article distinguishes documented behavior from conditional troubleshooting inferences. We did not attempt to trigger or bypass a third party's security rules. Proxidize is not affiliated with Cloudflare.
Cloudflare Error 1020 vs. 1005, 1010, 1015, and HTTP 403
Cloudflare-specific error numbers and HTTP status codes describe different layers. Read the response status and page body together before choosing a fix.
| Response | What it identifies | Correct first check |
|---|---|---|
| Cloudflare Error 1005 | The visitor's Autonomous System Number (ASN) was blocked | Check the network/ASN and the site's IP Access Rules |
| Cloudflare Error 1010 | Access was denied based on the browser's signature | Check the browser configuration and Browser Integrity Check |
| Cloudflare Error 1015 | A Cloudflare rate-limiting rule restricted requests | Stop retries, follow retry guidance, and inspect the rate-limit event |
| Cloudflare Error 1020 | A legacy Cloudflare Firewall Rule blocked the request | Find the Ray ID in Security Events and inspect the matching rule |
| HTTP 403 | A standard Forbidden response from Cloudflare or the origin | Identify who returned it and inspect the response body and logs |
| Current WAF Custom Rule block | A WAF Custom Rule took a blocking action | Inspect Custom Rules in Security Events; do not assume the body will say 1020 |
Read the cluster guides for Cloudflare Error 1005, Cloudflare Error 1010, and Cloudflare Error 1015 when the page shows one of those codes instead.
Cloudflare explains that its 1xxx codes appear in the HTML response body rather than the HTTP status line. Error 1020 commonly accompanies a Cloudflare-generated 403 response, but a generic 403 can also come from a WAF rule, another Cloudflare security feature, or the origin server. A 403 page without Cloudflare branding is generally an origin response, according to Cloudflare's HTTP 403 documentation.
What Does Cloudflare Error 1020 Mean?
Cloudflare defines Error 1020 as an Access Denied response caused by a customer's Firewall Rule. In practical terms, the request matched a rule expression and that rule told Cloudflare to block it.
The error tells you which control family denied the request, but not why the rule matched. The reason is in the rule and the corresponding Security Event. Two people seeing Error 1020 on the same site may have matched different conditions or the same broad condition for different reasons.
A rule could be intentionally protecting an administration area, private API, staging hostname, login route, geographic market, or partner integration. It could also be too broad, ordered incorrectly, or based on stale addresses. Error 1020 does not determine whether the rule is correct; it confirms that Cloudflare enforced the website owner's configuration.
Why Does Error 1020 Still Say “Firewall Rule” in 2026?
Cloudflare Firewall Rules are deprecated. Cloudflare moved existing rules to WAF Custom Rules, and the old Firewall Rules and Filters APIs have been unsupported since June 15, 2025. The current locations are Security > Security rules in the new dashboard and Security > WAF > Custom rules in the old dashboard.
The response behavior changed during that migration. Cloudflare's Firewall Rules upgrade guide states:
- A legacy Firewall Rule with a Block action produced Error 1020.
- A WAF Custom Rule block uses the WAF block response instead.
- Custom Rules are evaluated in order and use the Skip action for targeted exceptions.
- Current rule automation should use the Rulesets API rather than the retired Firewall Rules API.
This means an old screenshot, cached support article, or customer report may say 1020 while the current event and rule appear under Custom Rules. It also means a new WAF block may look similar to Error 1020 without displaying the number 1020. Search the event before assuming which feature acted.
Why Am I Getting Cloudflare Error 1020?
You are seeing Error 1020 because your request matched a blocking expression configured by the website owner. Common rule inputs include:
| Possible matching signal | Example of what the owner may be protecting | Would changing IP necessarily help? |
|---|---|---|
| Source IP or IP range | Administration pages limited to known office addresses | Only if the IP is the relevant condition and the new address is authorized |
| ASN or network | Traffic from a blocked hosting, carrier, or provider network | It may change the ASN, but it does not change the site's policy |
| Country or region | Content, compliance, or service availability limited by geography | Only if geography is the matching condition and access from the new location is permitted |
| Hostname or URI path | A staging host, `/admin/`, or a private API route | No; the path or hostname still matches |
| HTTP method | `POST`, `PUT`, or another method blocked on a sensitive endpoint | No; the method still matches |
| User agent or header | A private integration requiring an agreed header | No; correct the client or the rule |
| Cookie or token indicator | A restricted environment requiring a specific cookie | No; the required application state is still missing |
| Combined expression | A country, path, method, and header evaluated together | Only if the changed value is part of the expression and all other conditions permit access |
Cloudflare's Custom Rules use cases document rules based on IP lists, countries, paths, methods, cookies, and required headers. Although the current interface calls these Custom Rules, they illustrate why the number 1020 alone cannot be reduced to “bad IP.”
Legitimate visitors can be caught when a rule is broader than its intended audience. Common operational examples include an office or partner changing its egress IP, a mobile carrier or VPN placing several users behind one network, a monitoring job reaching a protected path without its expected header, or a country rule affecting travelers. Only the event and expression can establish the cause.
Is Cloudflare Error 1020 an IP Ban?
No—not necessarily. An IP may be one rule term, but Error 1020 identifies the enforcement mechanism rather than one blocked attribute. Cloudflare uses Error 1005 for an ASN ban and other codes for explicit individual-IP bans.
Use this diagnostic test:
A different result from another connection is not proof of an IP ban; the country, ASN, headers, cookies, path, or timing may also differ.
How Long Does Cloudflare Error 1020 Last?
Cloudflare Error 1020 has no universal duration because it is a rule-driven denial, not an Error 1015 rate-limit cooldown. It continues while the rule is active, the request matches it, and no earlier exception applies.
Access returns only when the owner changes the policy or the legitimate request no longer matches. Waiting alone is not a fix. Recovery after reconnecting may reflect a different IP, network, or location—not an Error 1020 timer.
How Can a Visitor Fix Cloudflare Error 1020?
A visitor cannot edit the website's rule. Use this sequence:
- Verify the code: Confirm the page actually displays 1020, Access Denied language, and a Ray ID. A page showing only 403 needs generic 403 diagnosis first. The proxy error code guide explains how to identify which system returned an error.
- Capture evidence: Save the complete screenshot, sanitized blocked URL, Ray ID, date, time, timezone, preceding action, and whether the connection used a corporate gateway, VPN, or proxy. Do not share passwords, cookies, tokens, or payment details.
- Stop repeated traffic: Pause refreshes, duplicate tabs, extensions, scripts, and background applications. Repetition cannot remove the rule and makes the event timeline harder to inspect.
- Contact the website: Send the evidence through an official support or developer channel and ask the owner to search Cloudflare Security Events. Only the website owner can make the access decision or raise the zone issue with Cloudflare Support.
- Follow the approved resolution: The owner may correct a false positive, provide an approved API, request a documented partner route, or confirm that the restriction is intentional.
Cloudflare notes that Ray IDs are not guaranteed to be unique, so the timestamp, path, and client IP can help the owner isolate the event. One controlled check in a normal, updated browser may help, but do not cycle through browsers and networks; changing several variables at once destroys useful evidence.
What Usually Does Not Fix Error 1020?
| Common suggestion | Why it is not a general fix |
|---|---|
| Wait a fixed number of minutes | Error 1020 has no standard cooldown |
| Clear cookies and cache | It helps only if the rule depends on cookie or browser state; it cannot remove an IP, ASN, country, path, or method rule |
| Change DNS resolvers | DNS does not edit the website owner's Cloudflare rule |
| Restart the router | It matters only if the public IP or network changes and that value caused the match |
| Disable TLS verification or browser security | It adds risk and does not remove the Cloudflare rule |
| Rotate through VPN or proxy IPs | It changes only part of the request and can obscure the real cause |
| Retry with higher concurrency | It creates more blocked traffic and does not change the access decision |
Does Changing Your IP Address Fix Cloudflare Error 1020?
Sometimes, but only when changing the route alters a value used by the rule. It is a diagnostic clue, not proof of the cause and not permission to bypass the site's policy.
| Rule condition | Likely effect of changing networks | Correct interpretation |
|---|---|---|
| Exact source IP or range | Often changes | The old address may have matched; the owner still needs to verify the rule |
| ASN or network provider | May change | A different provider may fall outside the expression |
| Country | May change | The site may intentionally restrict that geography |
| Path, method, header, or user agent | Usually unchanged | The same request-level rule can still block |
| Cookie or application state | Usually unchanged unless the browser state also changes | The proxy does not supply the required application state |
| Combined rule | Unpredictable | Every term and the rule logic must be inspected |
Visitors should capture the Ray ID and contact the owner. Authorized applications should keep the route stable during diagnosis and use an approved static or dedicated egress when the owner requires a known partner address. Success from another route proves only that some request property differed; the owner must confirm which rule matched.
Can a Proxy Fix Cloudflare Error 1020?
A proxy cannot override a Cloudflare rule. It can change the IP, ASN, country, and route, but not the URL, method, headers, cookies, permissions, behavior, or website policy. For authorized monitoring and QA, keep one sticky route during diagnosis and stop when 1020 appears; do not rotate until something passes.
Proxidize Residential Proxies provide country, city, and ISP targeting with rotating and sticky sessions across 195+ countries. Those controls are useful for authorized location testing and repeatable web-data workflows; they are not a Cloudflare bypass. The guide to why websites block web scrapers explains which problems a proxy can address and which require changes to the browser, session, request pacing, or application.
If a proxy is part of the approved route, keep it consistent using proxy session management and validate it separately with the proxy testing guide before blaming the provider for a target's 1020 page.
Need residential proxies for authorized geo-testing or web-data collection? Explore Proxidize Residential Proxies →
How Should Automation Handle Error 1020?
Authorized automation should treat a confirmed 1020 response as a stop condition, not a routine retry.
Record the sanitized target and method, response status and body code, Ray ID, UTC time, proxy/session identifier without credentials, relevant geography, and retry count. Never log cookies, authorization headers, proxy passwords, or account identifiers. Cap retries at every layer so several components do not retry the same blocked request.
When the site owner controls both sides, define an authenticated integration path instead of weakening general public rules. An official API, signed token, mTLS connection, service identity, stable approved egress, or tightly scoped Skip rule is more reliable than hoping a rotating address does not match.
How Can a Website Owner Fix Cloudflare Error 1020?
Use Collect → Trace → Correct → Validate. Do not disable the full security layer before identifying the rule.
1. Collect the Request Evidence
Ask for the screenshot, Ray ID, sanitized URL, method if known, timestamp with timezone, and client type. Request the client IP only through a secure support channel. Convert the error's UTC timestamp correctly before searching.
2. Find the Event
Go to Security > Analytics > Events or, in the new dashboard, open the Analytics page and select Events. Set a narrow time window, filter by Ray ID or client IP, and expand the event to find the action, security source, rule name or ID, host, path, country, ASN, user agent, and relevant request fields.
Cloudflare Security Events shows traffic a security product acted on or flagged. It can use sampled data, and retention varies by plan. If the Ray ID is absent, narrow the time window, search by IP and request attributes, or use Log Explorer/Cloudflare Logs when available.
3. Inspect the Rule
Review the full expression: network and country conditions, host/path/method scope, headers or cookies, negated allowlist logic, referenced lists, and rule order. Confirm whether a partner or monitoring route changed.
Current WAF Custom Rules are evaluated in order. A Block action stops later evaluation, so an exception below it cannot help. Cloudflare documents the Skip action for narrowly exempting legitimate traffic.
4. Apply the Narrowest Safe Correction
| False-positive cause | Safer correction |
|---|---|
| Trusted service changed its fixed egress IP | Update the approved IP list through a controlled process |
| Rule covers too many paths or hosts | Limit it to the sensitive route or hostname |
| A required method, header, or cookie is wrong | Correct the client contract or exact rule term |
| A partner or internal monitor is legitimate | Put a narrowly scoped Skip rule before the Block rule |
| A broad Block catches uncertain traffic | Consider a challenge or logging period when the risk model permits it |
| Legacy automation still manages Firewall Rules | Migrate to WAF Custom Rules and the Rulesets API |
An IP Access Rule with Allow excludes a visitor from several security checks, including the WAF. Cloudflare now recommends Custom Rules instead for most IP- and geography-based control. Do not allow a country, ASN, or large range to resolve one ticket.
5. Validate the Change
Reproduce only the authorized request. Confirm that it succeeds, unrelated traffic remains protected, rule order is correct, and Security Events shows the expected result. Record the change, owner, reason, review date, and rollback path.
How Can Site Owners Prevent False Error 1020 Blocks?
- Give every rule a descriptive name, owner, reason, and review date.
- Scope expressions to the smallest necessary host, path, method, and network set.
- Put verified, narrowly scoped exceptions before terminating Block rules.
- Use managed lists and remove stale partner IPs or temporary entries.
- Review Security Events after deployment and partner/network changes.
- Migrate legacy Firewall Rules automation to WAF Custom Rules and the Rulesets API.
- Document an approved access path for APIs, monitors, partners, and internal tools.
The objective is not to eliminate every denial. It is to make each decision intentional, traceable, and narrow enough to avoid unnecessary false positives.