Cloudflare error pages · error message

Cloudflare: Sorry, you have been blocked

Policy / accountHTTP 403Blocked by the site's security rules

Last verified

The exact message
Sorry, you have been blocked. You are unable to access example.com

What it means

This is Cloudflare's standard block page. It usually continues: "This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data." The page shows a Ray ID and your IP.

It appears when a security feature, very often the WAF's managed rules, decides a request looks like an attack: for example a form submission or query string that resembles SQL injection or cross-site scripting. It can also be shown for other block actions without a custom response.

For automation, it often appears after a script submits unusual input, posts malformed data, or sends a URL with characters a managed rule treats as hostile. It is the site's security policy, not an outage.

What it looks like

Sorry, you have been blocked
You are unable to access example.com
Why have I been blocked?
This website is using a security service to protect itself from online attacks. ...
Cloudflare Ray ID: 8a1b2c3d4e5f6789 • Your IP: 203.0.113.7

Why it happens

  • A WAF managed rule matched content in the URL, headers or body (SQL keywords, script tags, path traversal patterns).
  • A custom rule with a Block action matched the request.
  • Malformed or unusual input from a script or form filler.
  • An IP or network with a poor reputation.

How to fix it

  1. Note the Ray ID shown on the page and send it to the site owner with the time of the request.
  2. Review what you submitted; remove unusual characters or code-like strings if they are not needed.
  3. For automation, use the site's API instead of posting to HTML forms.
  4. Do not alter payloads to slip past security rules on a site you do not own.
  5. Site owners: look up the Ray ID in Security Events to find the rule, then add an exception or adjust sensitivity if it is a false positive.

How to stop it recurring

Integrators: send well-formed requests through documented APIs. Site owners: test managed rules in Log mode before enforcing, review false positives regularly, and configure a custom block response that tells people how to reach you. The numbered variant of this block is error 1020.

Official documentation: developers.cloudflare.com/waf. See all Cloudflare error messages.

Related errors

Definitions

Quick answers

What does "Sorry, you have been blocked" mean in Cloudflare?

This is Cloudflare's standard block page. It usually continues: "This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data." The page shows a Ray ID and your IP.

How do I fix "Sorry, you have been blocked"?

1. Note the Ray ID shown on the page and send it to the site owner with the time of the request. 2. Review what you submitted; remove unusual characters or code-like strings if they are not needed. 3. For automation, use the site's API instead of posting to HTML forms. 4. Do not alter payloads to slip past security rules on a site you do not own. 5. Site owners: look up the Ray ID in Security Events to find the rule, then add an exception or adjust sensitivity if it is a false positive.

Retries and timeouts without writing the loop

Autonoly's HTTP Request node and browser steps have per-node retries, timeouts and continue-on-fail, so a transient 429 or 503 can back off instead of failing the run. It has no proxies or IP rotation: if a site blocks automated traffic, that block applies to Autonoly too.

Also see Error handling in workflows.