Cloudflare error 1020 reads "Access denied". It means a security feature that the website owner set up blocked your request, and Cloudflare answered with HTTP 403. Cloudflare's own page on the error, updated October 14, 2026, gives two examples: API Shield schema validation and JWT validation. Blocks by WAF custom rules and WAF managed rules no longer show a 1020 at all. Either way, the rule belongs to the site, so only its owner can lift it. We sell residential proxies, and for this error we do not recommend them.
What does error 1020 mean today?
Cloudflare's definition is short. A security rule with a Block action matched the request, and the owner gave that rule no custom response. Cloudflare then serves its standard 1020 page with status 403.
Many guides still blame "firewall rules". That feature is gone. Cloudflare deprecated Firewall Rules, ended support for their API on June 15, 2025, and upgraded existing rules to WAF custom rules. A request that a WAF custom rule blocks gets a different answer: the WAF block page.
Today a 1020 comes from features such as API Shield, which guards APIs. Schema validation compares a request with the API's published schema. JWT validation checks the token the request carries. Cloudflare's page names both as features that can block with a 1020.
Which Cloudflare block did you get?
Several Cloudflare pages look alike. The words and the number on the page tell them apart.
| What the page shows | What blocked the request | Status |
|---|---|---|
| Access denied, error 1020 | A security feature such as API Shield | 403 |
| Sorry, you have been blocked | A WAF custom or managed rule | 403 |
| Error 1005 | A ban on your network (ASN) | 403 |
| Error 1006, 1007 or 1008 | A ban on your IP address | 403 |
| Error 1009 | A ban on your country or region | 403 |
| Error 1010 | Your browser's signature | 403 |
| Error 1015 | A rate limit | 429 |
The block page has its own guide, Sorry, you have been blocked. For every kind of Cloudflare 403, challenges included, see Cloudflare 403 Forbidden. Codes 1006, 1015 and 1020 are compared in Cloudflare errors 1006, 1015 and 1020.
Where do you find the Ray ID?
Every request that passes through Cloudflare gets a Ray ID. It travels in the cf-ray response header, and Cloudflare prints it on its error pages. The site owner needs it to find your request.
Two requests to our own site, two seconds apart, got two different IDs. Cloudflare warns that Ray IDs are not guaranteed to be unique, so send the time along with the ID.
What can you do if a site shows you error 1020?
- Take a screenshot. Keep the Ray ID and the time in it. This is the step Cloudflare's page gives visitors.
- Send it to the site owner. Use the site's contact or support page, and say what you were doing when the page appeared.
- Do not wait for Cloudflare to lift it. Its pages for related codes say its support cannot override a customer's security settings.
- Check what changed on your side. A VPN, a work network or a browser extension changes what the site sees. The 403 guide lists browser fixes in order.
- Look at your address if you suspect it. Our proxy checker shows the network a site sees, and FFraud shows how fraud tools score it. Why is my IP blocked covers the other reasons an address gets refused.
Why does an app or script get error 1020?
API clients meet this error more often now, because API Shield sits in front of APIs. Two of its checks can refuse a request:
- Schema validation. Cloudflare compares each request with the API's OpenAPI schema: the endpoint, the HTTP method and the format of path and query values. A request outside the schema can be blocked.
- JWT validation. Cloudflare verifies the JSON Web Token before the request reaches the API. It flags tokens that are expired, tampered with or not yet valid.
Check the token first, and renew it if it has expired. Then compare the request with the API's documentation. If both look right, send the owner the Ray ID, because the event in Security Events names the rule. Neither check reads your address, so a new one would not help.
What should a site owner check?
- Find the event. Ask the visitor for the screenshot, then search Security Events, under Security, Analytics, Events, for the Ray ID or the client IP. Convert the UTC time on the page to your own time zone.
- Read which feature acted. The event names the security feature and the rule that blocked the request.
- Fix the rule or the schema. Update the setting that blocked the request. Cloudflare lets JWT validation rules log instead of block while you migrate.
- Let known clients through on purpose. A custom rule with the Skip action can exempt a partner or your own tool from chosen security features.
- Replace the default page. A custom error rule can serve your own 1020 page, with your contact details on it.
On the Free plan, Security Events shows sampled logs only, so a single request may be missing from the list.
Does a proxy fix error 1020?
We sell residential proxies, and our answer is no. A 1020 is the owner's decision, and the checks Cloudflare names read the request and its token. If you need automated access to a site or an API, ask its owner, or use the API the site offers.
If an owner agrees to allowlist you, give them a fixed address. Our ISP proxies are static: the exit IP is the one you bought, and it never rotates. How sites judge addresses in general is covered in how websites detect proxies and what a clean IP is.
What do other guides to error 1020 say?
On October 22, 2026, we read six guides that rank for "cloudflare error 1020", all from proxy or scraping companies. All six name firewall or WAF rules as the cause. None mentions API Shield, JWT validation or the end of Firewall Rules.
What this page could not check
- No 1020 of our own. We did not trigger a 1020 on any site. Our test of 140 Cloudflare sites is in the 403 guide.
- Every feature. Cloudflare names two features that can return a 1020 and does not list all of them.
- Changing docs. Cloudflare rewrote its 1020 page on October 14, 2026. Check it again after January 22, 2027.
Sources
- Cloudflare, "Error 1020", last updated October 14, 2026, read October 22, 2026.
- Cloudflare, "Firewall Rules upgrade", last updated April 16, 2026: the deprecation and the different block page.
- Cloudflare, "Schema validation" (October 5, 2026) and "JSON Web Tokens validation" (October 6, 2026).
- Cloudflare, "Security Events" (October 2, 2026) and "Cloudflare Ray ID" (October 15, 2026).
- Cloudflare, "Cloudflare 1XXX errors" and its pages for errors 1005, 1006, 1009, 1010 and 1015, read October 22, 2026.
- Cloudflare, "Custom rules", last updated October 16, 2026: the Block and Skip actions.
- Six guides from proxy and scraping companies that rank for "cloudflare error 1020", read in full on October 22, 2026.
- Our own capture of two requests to hproxy.com, October 22, 2026, 18:10 UTC.
