Cloudflare's error pages carry a four-digit code beginning with 1, and the code is the most informative thing on the page. It names the rule or the failure that produced the block. Most people only ever meet a handful of them, and the handful splits cleanly into two groups: codes about the visitor, which change when the visitor changes something, and codes about the site, which change only when the owner does. Knowing which group you are in saves an afternoon.
Cloudflare publishes the full list, and one line on that page frames everything below: only the website owner can contact Cloudflare for support. A visitor's options are to change what the rule sees, or to give the owner the Ray ID from the page so they can change the rule.
The codes about you
| Code | Cloudflare's title | What the rule looked at | What changes it |
|---|---|---|---|
| 1005 | Access Denied: Autonomous System Number (ASN) banned | The whole network your address belongs to | A different network |
| 1006, 1007, 1008, 1106 | Access Denied: Your IP address has been banned | Your specific address | A different address, or the owner lifting the ban |
| 1009 | Access Denied: Country or region banned | The country your address maps to | An address in a served country |
| 1010 | Banned based on your browser's signature | The browser, not the address | A normal, current browser with no spoofing |
| 1012 | Access Denied | A general rule | What the rule matched on |
| 1015 | You are being rate limited | Requests per address per window | Time, pace, or more addresses |
| 1020 | Access denied | A firewall rule the owner wrote | Whatever the rule matched on, usually the address |
1006, 1007, 1008: your address is banned
The clearest of the set. The owner, or a rule the owner runs, put your address on a ban list. For a person, that address is almost always shared: a VPN exit, a proxy, a mobile carrier's address behind carrier-grade NAT, or an office gateway. Someone on it earned the ban and everyone on it inherits it. Turn the VPN off, or switch networks, and the code disappears. If your home address itself is banned and you did nothing, your ISP may have reassigned you an address with a history, and a router restart sometimes hands you a new one.
For automation the code means the pool is burned for that site: the address, or the range it sits in, is on the list. Rotating within the same range does not help. ASN targeting is about choosing exits on networks that owners have no reason to ban, which is the durable fix.
1005: your whole network is banned
An ASN is a network operator's block of addresses, such as a hosting provider or a carrier. Owners ban entire ASNs to keep out datacenter traffic in one rule, and that rule catches every business that exits through a cloud gateway and every person whose VPN sits in a banned provider's range. Switching to a different exit within the same provider does not help; the ban is on the operator. A residential exit is on a consumer ISP's ASN, which is exactly the kind of network a site cannot ban without losing its customers.
1009: your country is banned
A map, not a judgement. The site does not serve the region your address maps to. On a VPN, the exit's country is the problem; disconnect or choose a server in a served country. Physically in the region, the only way in is an address elsewhere, and whether that is appropriate is between you and the site's terms.
1010: your browser's signature is banned
The one code in this group where the address is irrelevant. The rule looked at the browser's presentation, its user agent and related fingerprint, and matched something the owner banned: an automation framework, a scraper library, an ancient browser, or a spoofed user agent that does not match the rest of the fingerprint. Open a current mainstream browser with extensions disabled. For automation, no proxy changes this; the client has to present as a browser.
1012 and 1020: a rule matched
1020 is the workhorse. Owners write firewall rules that combine conditions, and when the rule's action is block, the visitor gets 1020 on the "Sorry, you have been blocked" page. Because the rule can match on almost anything, the diagnosis is the same as for that page, and our guide to Sorry, you have been blocked walks through it: VPN off, another network, a clean browser, then the Ray ID to the owner. 1012 is the more general access-denied code and behaves the same way.
1015: you are being rate limited
The only code in the group that expires on its own. The owner set a request limit per address per window, and the address crossed it. For a person that usually means fast refreshing, many tabs, or a neighbour on a shared address doing the same. Wait out the window and slow down. For automation it is the per-address budget made visible: spread requests across more addresses at a lower rate each, and honour the retry timing. The arithmetic is identical to a 429 Too Many Requests.
The codes about the site
Everything else in Cloudflare's list is between Cloudflare and the site, and nothing a visitor does changes it. 1000 through 1004 are DNS and configuration errors on the owner's side. 1011 is hotlinking denied, which appears when a page on another site embeds this site's image. 1013 is a hostname mismatch between the request and the TLS certificate, a configuration fault. 1014 is a CNAME the owner has no right to use. 1016 is an origin DNS error, meaning Cloudflare cannot resolve the site's own server. 1018 and 1023 are hosts Cloudflare cannot find. 1019 is a compute error on Cloudflare's side. 1025 asks you to check back later. 1033 is a tunnel error, 1034 an edge address restriction, and the 1035 through 1041 series are request rewrite errors. 1101 and 1102 are rendering errors in the owner's Cloudflare Workers code, and 1200 is a cache connection limit.
For any of these, a visitor waits or tells the owner. They are the same family as the 522 connection timed out page: failures behind Cloudflare, where your connection succeeded and the site's did not.
Reading the code from an automation job
A scraper's log is a distribution of these codes, and the distribution is the diagnosis. Mostly 1006 and 1005 means the pool's addresses and networks are on ban lists: move to residential exits on consumer ASNs. Mostly 1020 with a clean pool means the rule is matching the request rather than the address: headers, TLS fingerprint, missing challenge cookies. Any 1010 means the client is not presenting as a browser, and no address fixes it. A rising share of 1015 means the per-address rate is too high for the pool size. Our guide to scraping past Cloudflare covers each layer and where residential proxies fit, and the honest summary is that they fix the address layer completely and the other layers not at all.
Which codes you can act on
Address codes (1005 to 1009, 1006 above all) change with a different address or network. 1010 changes with a real browser. 1020 and 1012 change with whatever the rule saw, usually the address. 1015 changes with time and pace. Everything else is the site's, and the Ray ID is how you help them fix it.