The page is unmistakable once you have seen it: a large "Sorry, you have been blocked", the line "You are unable to access" followed by the site's name, a paragraph explaining that the website is using a security service to protect itself from online attacks, and, at the bottom, a Cloudflare Ray ID and your IP address. It appears on shopping sites, forums, government portals, and tools you have used for years, and it tends to appear when you have done nothing more provocative than open a link.
The text blames "the action you just performed", which is the part people find maddening, because the action was usually clicking. What actually happened is simpler and less personal. The site sits behind Cloudflare, the site's owner configured security rules, one of those rules matched your request, and Cloudflare refused it on the owner's behalf before the site ever saw it. Most of those rules are about the address you connected from, which is why this page has a strong relationship with VPNs, proxies, and shared networks, and why a proxy company ends up writing about it.
What the block page is, and what it is not
Cloudflare sits in front of the website and inspects every request. The owner can write rules that say things like "block this country", "block these IP ranges", "block requests whose browser looks automated", or "block anything that matches this pattern in the URL or form data". When a rule's action is block, Cloudflare answers with this page and an error code. Cloudflare's own list of 1xxx errors names them:
| Code on the page | Cloudflare's title | What matched | Who can change it |
|---|---|---|---|
| 1020 | Access denied | A firewall rule the owner wrote | The owner; you can change what the rule sees |
| 1006, 1007, 1008 | Your IP address has been banned | An IP or range the owner banned | The owner; you can arrive from a different address |
| 1009 | Country or region banned | The country your address maps to | The owner; you can arrive from another country |
| 1005 | Autonomous System Number banned | The whole network your address belongs to | The owner; you can use a different network |
| 1010 | Banned based on your browser's signature | Your browser or automation tool | You: a normal browser, no spoofing |
| 1012 | Access denied | A more general rule | The owner |
| 1015 | You are being rate limited | Too many requests from your address | You: slow down or wait |
Two things this page is not. It is not the "checking your browser" or "verify you are human" challenge, which gives you a way through; the block page gives you none. And it is not a sign that the site is down. The site is fine, and other people are reading it right now. The difference between them and you is what the rule saw.
Why it is usually the address
Every request carries the address it came from, and Cloudflare's rules, along with the reputation data behind them, weigh that address heavily. Several kinds of address share the consequences of everyone who uses them:
- VPN exits. A single VPN server address is shared by thousands of customers. If a few of them scraped, spammed, or attacked a site, the owner blocked the address, and every other customer inherits the block. This is the single most common reason a normal person sees the page.
- Proxies, Tor, and private relays. Same mechanism. Apple's iCloud Private Relay and similar services route through shared addresses that some owners block wholesale.
- Datacenter addresses. A request from a hosting provider's range looks like a server, not a person, and many owners block or challenge datacenter traffic by default. Anyone browsing through a cloud desktop or a corporate gateway that exits from a datacenter gets caught.
- Carrier-grade NAT. Mobile networks and some home ISPs put hundreds or thousands of customers behind one public address. If one of them misbehaves, the address is blocked for all of them. Our explainer on CGNAT covers how that sharing works.
- A country rule. Owners block regions they do not serve or that generate abuse. A VPN exit in that region, or a genuine visit from it, gets the page.
The test for all of these is the same. Turn off the VPN or proxy and reload. Or switch the device to a different network, such as your phone's mobile data, and reload. If the page disappears, the rule was about the address, and nothing on your computer was at fault.
In your hands
The address you arrive from
VPN off, other network, dedicated IP
The browser you use
no spoofing extensions, no automation
Cookies and extensions
clear, disable, private window
Your request rate
for 1015, slow down
Only the owner
The rule itself
country, ASN, IP, WAF pattern
Whether the block is a mistake
needs your Ray ID
Allowlisting you
by IP, if they choose
Fixes, in the order that works
1. Turn off the VPN, proxy, or relay, and reload
If you use a VPN, disconnect it. If a proxy is configured on the device or in the browser, switch it off; how to turn off a proxy shows where the setting lives on every system. Turn off iCloud Private Relay or any "secure browsing" feature in a security suite. Then reload the page. This clears the block for most people, and it tells you the cause was the shared address.
If you need the VPN for other reasons, reconnect to a different server, ideally in a different city or country, and try again. A server that has not been used against this site is often enough.
2. Prove it with a different network
Load the same page on your phone over mobile data, with Wi-Fi off. If it loads there and not at home, the blocked address is your home connection, which usually means either a VPN or proxy you forgot about, or an address your ISP shares with other customers. Restarting the router sometimes gets a new address from the ISP; if your address never changes, the ISP or the site owner is the next call.
3. Rule out the browser
Code 1010 blocks a browser signature, and some owners block anything that looks automated. Extensions that spoof your user agent, aggressive privacy tools that strip headers, and automation extensions all change what Cloudflare sees. Open a private window with extensions disabled and try the site. If it loads, re-enable extensions one at a time to find the culprit. A very old browser version can trip the same rule; update it.
4. Clear cookies for the site
Rarely the cause on its own, but cheap to try, and it matters when the block began after a challenge went wrong. Clear cookies for that site only, or use a private window, and reload.
5. If it happens on many sites, scan the computer
One site blocking you is a rule. Many unrelated sites blocking you within a day is a signal that your address has been generating traffic you did not send. Malware that uses your connection to scrape or attack, a browser extension doing the same, or an infected device on your network can all burn your address across the web. Run a full scan, remove extensions you do not recognise, and check other devices on the network. Proxy settings that keep turning back on covers the related pattern where malware redirects your traffic.
6. Contact the owner with the Ray ID
When the page persists from a clean browser on a normal connection, the rule is too broad and only the owner can fix it. Cloudflare's documentation is explicit that visitors cannot contact Cloudflare about these errors; the website owner can. Email the site with the Ray ID from the bottom of the page, your approximate location, and the time. The Ray ID lets them find the exact rule that fired in seconds, which is the difference between a fix and a shrug.
7. If you must use a proxy or VPN, use an address nobody else shares
The block follows shared addresses. A dedicated address that only you use carries only your reputation. For people who need a fixed exit in a specific country, a static ISP proxy is that: an address on a real residential network, assigned to you alone, that reads to Cloudflare as a household rather than a hosting range or a crowded VPN node. It does not override a country rule or an owner who has blocked you personally, and nothing does, but it removes the most common cause of this page.
Automation is a different conversation
Scrapers, monitors, and bots see this page for the same reasons and one more: the request itself looks automated. A datacenter address, a Python default TLS fingerprint, missing headers, and hundreds of requests a minute each match rules that a person never trips. Changing the exit address helps with the address rules and does nothing for the rest. Scraping past Cloudflare covers what Cloudflare actually checks and where residential proxies fit, how websites detect proxies explains the address side, and proxy ASN targeting is about choosing exits on networks that owners do not block by default.
The honest summary for automation: the block page is Cloudflare telling you which layer failed. A 1006 or 1020 from a datacenter pool is the address layer, and residential exits with sticky sessions fix it. A 1010 is the browser layer, and no proxy fixes it. A 1015 is your rate, and the fix is patience.
For site owners who found this page from the other side
If your visitors are reporting this page, the rule is doing what you told it to, and the question is whether you told it too much. In the Cloudflare dashboard, the Security events log shows every block with the rule that fired, the country, the ASN, and the Ray ID your visitor sent you. Country and ASN rules are the usual over-reach: a rule that blocks a whole hosting provider also blocks corporate users behind a gateway there, and a country rule blocks every traveller on a VPN. Prefer a managed challenge to a block where you can, so that real people have a way through, and allowlist the specific addresses of partners and tools that need access.
The one-minute version
Turn the VPN off and reload. Try mobile data. Try a private window with no extensions. If the page is gone, the address was the cause and you now know which address. If it is still there, email the owner the Ray ID, because the rule is theirs. And if you need a proxy or VPN for legitimate reasons and keep meeting this page, the fix is an address that is yours alone rather than one shared with a crowd.