Cloudflare error pages carry a four-digit code that starts with 1. The code names what refused you: a ban on your IP address, network or country, your browser, a rate limit or another security feature. Each one is a rule the website owner set, and Cloudflare's own pages say its support cannot override them. This guide covers what each code means, how long a 1015 rate limit lasts and what to send the owner. We sell residential proxies, and we do not recommend them for any code on this page.
Which code did you get?
| Code | What Cloudflare's page says | Status |
|---|---|---|
| 1005 | Access denied: your network (ASN) is banned | 403 |
| 1006, 1007, 1008, 1106 | Access denied: your IP address is banned | 403 |
| 1009 | Access denied: your country or region is banned | 403 |
| 1010 | Access denied based on your browser's signature | 403 |
| 1012 | Access denied after malicious activity from your network | 403 |
| 1015 | You are being rate limited | 429 |
| 1020 | Access denied by a security feature | 403 |
Every code in the table is a rule the site owner configured, and all but 1015 come with HTTP 403. Pages without a number have their own guides. Cloudflare 403 Forbidden explains challenges, and Sorry, you have been blocked explains the WAF block page.
What do 1006, 1007 and 1008 mean?
Cloudflare documents four codes on one page: 1006, 1007, 1008 and 1106. Its title is "Your IP address has been banned", and its cause takes one line: a Cloudflare customer blocked traffic from your client. The page draws no difference between the four numbers, whatever some guides claim.
People often meet it through an address they share, such as a VPN exit or a work network. If you use a VPN, turn it off and reload. Otherwise, follow Cloudflare's advice and ask the owner to check their security settings or to allow your address. The same code also appears in the Workers Preview tab when a zone blocks the Google Cloud addresses the preview relies on.
What do 1005 and 1009 mean?
Error 1005 means the owner banned the whole network your address belongs to, its Autonomous System Number (ASN). Our page on ASN targeting explains what an ASN is. In the test behind our 403 guide, one of 140 Cloudflare sites answered our US datacenter address with a 1005. Owners set these bans, and lift them, in IP Access rules.
Error 1009 means the site does not serve the country or region your address maps to. On a VPN, that is the VPN's country, so turn it off and try again. If you are in that region yourself, ask the owner. Cloudflare notes that blocking a country in IP Access rules is an Enterprise feature.
What does 1010 mean?
Error 1010 means the owner banned your access based on your browser's signature. Behind it sits the Browser Integrity Check, which Cloudflare turns on by default. It denies requests with header patterns that spammers abuse, and it challenges visitors with no user agent or an unusual one.
Try a current, mainstream browser with any extension that rewrites headers turned off. If a script of yours gets the code, the owner has chosen to refuse such clients, so ask for access or for an API.
What does 1012 mean?
Error 1012 means the owner refused your address because of malicious activity seen from your computer or network. Cloudflare names a virus or malware infection as the most likely cause. Update your antivirus, run a full scan, then ask the owner to allow your address again.
What does 1015 mean, and how long does it last?
Error 1015 is a rate limit. The owner set a rule that counts requests over a period, and your requests passed the limit. Cloudflare then answers with HTTP 429 and blocks further requests for a length of time the owner chose. By default the block runs to its end, even if you slow down.
The longest block an owner can set depends on the owner's Cloudflare plan:
So a block on the Free plan lasts 10 seconds. On Pro it can last up to an hour, and on Business and Enterprise up to a day. Cloudflare's page with these limits, printed as we read it:
What to do about a 1015:
- Wait. Cloudflare asks visitors to try again later and not to retry quickly, because that may extend the block.
- Ask the owner if it keeps coming back. Cloudflare does not decide who gets rate limited; the site owner sets these rules.
- Slow automated jobs down. Lower the request rate, and ask the owner for an API or a higher limit. Our 429 guide covers how to wait between retries.
A second message also carries the number 1015: "Unable to purge" comes from Cloudflare's cache purge and concerns site owners only.
What does 1020 mean?
Error 1020 means a security feature the owner configured blocked the request. Cloudflare retired Firewall Rules and ended their API in June 2025. The examples it now gives are API Shield schema validation and JWT validation, while WAF custom and managed rules show the WAF block page. Our guide to error 1020 covers what to check.
Which codes come from the site's setup?
The rest of Cloudflare's list describes the site's setup, and nothing a visitor does changes it. 1000 to 1004 are DNS and configuration errors. 1011 refuses hotlinked images, and 1013 is a mismatch between the HTTP hostname and the TLS SNI hostname. 1014 is a CNAME the owner may not use. 1016 is an origin DNS error, and 1018 and 1023 are hosts Cloudflare cannot find. 1019 is a compute server error, 1025 asks you to check back later and 1033 is a tunnel error. 1034 restricts an edge IP, and 1035 to 1041 are request rewrite errors. 1101 and 1102 are rendering errors in Workers code, and 1200 is a cache connection limit.
For any of these, wait or tell the owner. They belong with the 522 connection timed out family: your connection reached Cloudflare, and the trouble sits behind it.
What should you send the owner, and what can owners change?
As a visitor, send a screenshot of the error with the Ray ID and the time in UTC. Add a line on what you were doing. Only the owner can change these settings.
As an owner:
- Find the event. Search Security Events for the Ray ID or the client IP to see which feature acted.
- Check IP Access rules. Bans on an IP, a network or a country live there, though Cloudflare now suggests custom rules for new ones.
- Allow with care. Allowing an IP or an ASN skips custom rules, rate limiting rules and WAF managed rules for it, so allow only clients you trust.
- Tune rate limits. When a rule fires too fast, Cloudflare suggests a longer counting period, such as 10 seconds instead of one.
- Adjust the Browser Integrity Check. Turn it off for the zone, or skip it for chosen paths with a custom rule.
Does a proxy help?
We sell residential proxies, and we do not recommend them for these errors. Each code records a decision the owner made about who may visit and how often. If you need automated access, ask the owner for it or use the site's API. An owner who agrees can allow a fixed address, and our static ISP proxies keep one for as long as you hold them.
What this page could not check
- No codes triggered. We did not trigger any of these codes for this page. The 1005 we met came from the test in our 403 guide.
- The four IP codes. Cloudflare does not say how 1006, 1007, 1008 and 1106 differ.
- Plan limits change. Cloudflare updated its rate limiting page on August 25, 2026. Check the limits again after January 22, 2027.
Sources
- Cloudflare, "Cloudflare 1XXX errors", last updated October 14, 2026, with its pages for errors 1005, 1006, 1009, 1010, 1012, 1015 and 1020, read October 22, 2026.
- Cloudflare, "Rate limiting rules", last updated August 25, 2026: block lengths and counting periods by plan.
- Cloudflare, "IP Access rules", last updated August 14, 2026.
- Cloudflare, "Browser Integrity Check", last updated August 3, 2026.
- Cloudflare, "Firewall Rules upgrade", last updated April 16, 2026.
- HProxy, Cloudflare 403 Forbidden: our test of 140 Cloudflare sites, October 22, 2026.
- Five guides from proxy and scraping companies that rank for "cloudflare error 1015" or cover errors 1006 to 1008, read in full on October 22, 2026.
