Cloudflare: Error 1020: Access denied
Last verified
Error 1020: Access deniedWhat it means
Error 1020 means a security rule the site owner configured in Cloudflare matched your request and its action was Block. Cloudflare's documentation states the cause precisely: a security rule with a Block action matched the request and the rule has no custom response configured. Cloudflare returns it with HTTP status 403.
For a visitor or an automated client, 1020 is not a Cloudflare outage and not a bug in your code. It is the site's own policy. Rules can match almost anything Cloudflare sees: country, IP or network, URL path, request headers, request rate, or the bot score Cloudflare assigns. That is why the same page can work in your browser and return 1020 to a script or headless browser running in a data center.
For the site owner, every 1020 has a Ray ID on the page. Searching that Ray ID or the client IP in Security Events shows exactly which rule fired.
What it looks like
HTTP/1.1 403 Forbidden
Server: cloudflare
CF-RAY: 8a1b2c3d4e5f6789-FRA
... Error 1020 ... Access denied ... Ray ID: 8a1b2c3d4e5f6789Why it happens
- A WAF custom rule blocks requests by path, country, ASN, user agent or header combination.
- A rule blocks requests with a low Cloudflare bot score, which is common for scripts and headless browsers.
- An IP Access rule or list blocks the client's IP or range.
- The owner blocked a cloud or hosting provider's network, catching legitimate automation.
How to fix it
- Visitors: take a screenshot showing the Ray ID and send it to the site owner, as Cloudflare's own guidance recommends.
- Automation users: check the site's robots.txt, terms and any official API. A 1020 means the owner chose to block this traffic; do not try to get around it.
- If you have a legitimate business need, ask the owner to allow your integration explicitly, for example by IP or an authenticated API.
- Site owners: search the Ray ID or IP in Security Events to find the rule and its matched fields.
- Site owners: adjust the rule's expression, add a skip rule for known partners, or change Block to a challenge if real users are caught.
How to stop it recurring
Visitors and integrators: use documented APIs and ask for access before automating a protected site. Site owners: write rules narrowly, log before blocking (use the Log action first), give blocked users a custom response that explains how to reach you, and review Security Events after every rule change. A generic block without a 1020 number is covered under "Sorry, you have been blocked".
Official documentation: developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1020. See all Cloudflare error messages.
Related errors
- Sorry, you have been blockedSorry, you have been blocked. You are unable to access example.com
- Error 1015: You are being rate limited
- Error 1010: Browser signature bannedError 1010: The owner of this website has banned your access based on your…
- Errors 1006, 1007, 1008: Your IP address has been bannedAccess denied: Your IP address has been banned
Definitions
- CAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response m
- Cloudflare Bot ManagementCloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Ente
- Cloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, is
- User AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and
- Rate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given
Quick answers
What does "Error 1020: Access denied" mean in Cloudflare?
Error 1020 means a security rule the site owner configured in Cloudflare matched your request and its action was Block. Cloudflare's documentation states the cause precisely: a security rule with a Block action matched the request and the rule has no custom response configured. Cloudflare returns it with HTTP status 403.
How do I fix "Error 1020: Access denied"?
1. Visitors: take a screenshot showing the Ray ID and send it to the site owner, as Cloudflare's own guidance recommends. 2. Automation users: check the site's robots.txt, terms and any official API. A 1020 means the owner chose to block this traffic; do not try to get around it. 3. If you have a legitimate business need, ask the owner to allow your integration explicitly, for example by IP or an authenticated API. 4. Site owners: search the Ray ID or IP in Security Events to find the rule and its matched fields. 5. Site owners: adjust the rule's expression, add a skip rule for known…
Retries and timeouts without writing the loop
Autonoly's HTTP Request node and browser steps have per-node retries, timeouts and continue-on-fail, so a transient 429 or 503 can back off instead of failing the run. It has no proxies or IP rotation: if a site blocks automated traffic, that block applies to Autonoly too.
Also see Error handling in workflows.