A blocked request on a Cloudflare-protected site tends to end the same way: a short page that reads Access denied, with the code 1020 printed underneath it. That code is specific, and it points at a specific cause. Error 1020 is not a Cloudflare outage or a glitch on your side. A rule that the site's own operator configured returned it, because your request matched that rule. We run a proxy network and FFraud, an IP-intelligence engine that scores addresses for the same signals these rules read, so this guide explains what a 1020 actually is, the handful of things that set one off, how to tell which one hit you, and what clears it.
What is Cloudflare error 1020?
Error 1020 is the message Cloudflare returns when a visitor is refused by a firewall rule that the website owner set up. Cloudflare now calls these WAF custom rules, and when one carries a block action, a matching request receives the 1020 page instead of the site. The rule belongs to the site rather than to Cloudflare, which is the single most useful fact about this error. Cloudflare support cannot remove it, and a refresh will not either. The block clears only when your request stops matching the rule, or when the operator changes the rule.
What actually triggers a 1020
A custom rule can match on many properties of a single request, so a 1020 has more than one possible cause. Four account for almost every case.
The address itself. A rule can block by country, by the network (ASN) an address belongs to, or by an explicit IP list the operator keeps. A datacenter or already-flagged exit is the classic match here, and it is the one a clean address fixes. The full stack behind this reading lives in how websites detect proxies.
The request headers. A rule that refuses blank or scripted user agents (curl, a bot library, an empty agent string) matches on the header, not on the IP. Swapping the address changes nothing, because the giveaway is what the client announced about itself.
A missing or failed challenge. Some rules require a Cloudflare clearance cookie that only a real browser earns by running JavaScript. A client that does not execute the script, or does not carry the cookie forward, is refused. Automation driven without a genuine browser trips this often.
The path or the method. A rule guarding a sensitive URL, such as an admin login or an API route, matches every request to that path regardless of who sends it. The address is clean, the browser is real, and the request is still blocked because of where it was pointed.
| What Cloudflare matched | What set off the 1020 |
|---|---|
| Country or network (ASN) rule | Your exit is in a blocked country or a hosting network |
| IP list | Your address is on the operator's own blocklist |
| User agent rule | A blank or scripted user agent, such as curl or a bot library |
| Missing clearance cookie | A client that did not solve the JavaScript challenge |
| Path or method rule | A request to a guarded URL, such as an admin path |
How to tell whether the address or the request is the problem
Before changing anything, separate the two possibilities. Two checks settle it.
First, run the network test. Open the site in a private window over a different connection, with mobile data being the easy one. If it loads there but not on your usual connection, the rule matched your address or its range. If it returns the same 1020 everywhere, the trigger is the request you are sending, a headless client or a blank user agent, or a path rule that refuses everyone.
Second, read the address the way a rule reads it. Put it through our proxy checker to see the network and country, and through FFraud to see the fraud score and whether it is classed as a known proxy or VPN exit. A hosting range or a high score means the rule almost certainly matched the address. Clean readings while you are still blocked point back at the request.
How to fix a 1020
Match the fix to the trigger you found.
- If the address matched, replace it rather than appeal it. A datacenter or free exit is usually the exact kind of network these rules target, so trading it for another of the same type just lands on the next block. A clean residential exit belongs to a consumer ISP, so it clears a country, network, or reputation match. Our residential proxies route through real home connections and start at $0.44/GB pay-as-you-go, and you can read any exit with the proxy checker before you trust it.
- If the request matched, make it look like a browser. Send a normal user agent, a full set of headers, and run the JavaScript that sets the clearance cookie. No new address helps a rule that keyed on your user agent or a missing cookie.
- If a path or an explicit IP-list rule matched, the operator blocked that route or that address deliberately. The clean path is to contact the site owner. This is also why Cloudflare's support pages send 1020 reports to the website, not to Cloudflare.
A 1020 is one branded version of a wider problem, and the full map of why an address gets refused sits in why is my IP blocked.
What a clean address does not fix
Swapping to a clean residential exit clears the 1020s that match on country, network, or reputation, which are common, but that is one layer and not a guarantee. A rule can key on your user agent, a missing cookie, a path, or your TLS fingerprint, and no address changes any of those. A clean IP behind a scripted client with a robotic rhythm can still be challenged or blocked outright. Anyone promising an address that Cloudflare never refuses is selling a story. The honest version is that a believable exit removes the most common trigger, and browser-shaped requests remove the rest. What each layer covers, and where the address stops mattering, is the same theme as what a clean IP actually is.
Sources
- Cloudflare, "Cloudflare 1XXX errors": error 1020 is access denied, returned when a request matches a firewall rule the site owner configured.
- Cloudflare, "WAF custom rules": how a custom rule matches request properties and how the block action behaves.
- Cloudflare, "Machine learning to detect bot attacks that use residential proxies": why hosting ranges are treated differently from consumer ISP ranges.
- DataDome, "What are data center proxies and how to detect them?": how anti-bot systems score hosting networks against ISP-registered ranges.