What's the difference between 1006, 1007, and 1008?

Cloudflare's own documentation lists all three under one heading — 'Access Denied: Your IP address has been banned' — because they resolve to the same thing: a site owner blocked your IP at the edge. The distinction people report is about what tripped the block, not what to do about it. 1006 is usually a plain block on your individual IP; 1007 tends to show up when the owner banned a whole IP range or geography; 1008 is a custom firewall/WAF rule matching something about your request. But there is no 'contact this one differently' — all three are an owner decision you can't override, and the fix is identical for every one.

How is this different from Error 1020, 1015, or 1009?

Same wall, different door. 1006/1007/1008 is specifically an IP ban — your address is on the owner's blocklist. 1020 Access Denied is a broader firewall/WAF rule with a Block action (which can match on far more than IP). 1015 'You are being rate limited' is temporary and lifts after a cooldown — you sent too many requests, not that you're banned. 1009 bans your whole country by mapping your IP to an ISO country code. If you see 1006 rather than 1015, cooling off won't help: the ban is standing until the owner removes it.

I'm a normal visitor. Why am I banned, and how do I get in?

Almost always because the IP you're presenting isn't really 'yours.' VPN exit nodes, cheap proxies, CGNAT pools, and datacenter ranges are shared by thousands of people, and one of them abused this site before you — so the owner banned the address, and you inherited it. Turn off the VPN, drop any aggressive privacy proxy, and retry on a plain residential connection. If a clean home IP loads the site, that confirms it: the ban followed the shared address, not you. If you're still blocked on a residential line, it's a deliberate, targeted ban and only the site owner can lift it — quote the Ray ID from the error page when you reach them.

Views: 32

Error 1006, 1007, 1008 Access Denied: IP Banned (Cloudflare)

Error 1006/1007/1008 means a site owner banned your IP on Cloudflare — not an outage, not your device. Find which IP you present in 3 checks. Free instant check, no sign-up.

Check your domain for this issue now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.

Problem

The page returns a Cloudflare block screen reading Error 1006, 1007, or 1008 — Access Denied: Your IP address has been banned, usually with a Ray ID underneath. Nothing is down. Cloudflare reached the site fine; it just refused to hand the site to you. And here’s the part that saves you an hour of wrong turns: this is not a Cloudflare fault, and it is not a fault on your machine. It’s a decision. A site owner — a Cloudflare customer — put the IP address you’re connecting from on their blocklist, and the edge is enforcing that ban before your request ever reaches the origin.

The three codes are the same wall. Cloudflare’s own troubleshooting doc files 1006, 1007, and 1008 under a single entry — Access Denied: Your IP address has been banned — because they resolve identically. What differs is only what tripped the ban: an individual IP block, a banned range or region, or a custom firewall rule that happened to match your address. The distinction is trivia. The address is what matters, and the address is the thing to look at first.

Symptoms

The block screen shows Error 1006, Error 1007, or Error 1008 with the text Access Denied: Your IP address has been banned and a Ray ID.
It’s total and immediate — no challenge, no CAPTCHA, no “checking your browser.” A ban doesn’t negotiate; a rate limit (1015) or a managed challenge would.
The same site loads instantly from your phone on cellular, or from a different network, while your current connection stays blocked.
Switching VPN servers sometimes fixes it and sometimes doesn’t — a strong tell that the ban is attached to the exit IP, not to you.

Top 3 Causes

You inherited a shared IP’s bad reputation - The single most common case, and it has nothing to do with your behavior. VPN exit nodes, budget proxies, CGNAT ranges, and cloud/datacenter IPs are shared by huge numbers of strangers. One of them scraped, brute-forced, or spammed this site, the owner banned the address, and now everyone routed through that same exit hits the wall. You didn’t do anything — you’re just standing where someone else stood.
A deliberate, targeted ban on your actual IP - Sometimes it really is your address. If you (or your server, or your scraper) hammered the site, tripped abuse thresholds, or got added to an IP Access Rule by hand, the owner banned you specifically. This is the case when a plain residential connection — no VPN, no proxy — still gets 1006. The ban is intentional and standing.
A custom firewall rule catching a range you’re in - For 1007 and 1008 especially, the owner may have banned an entire IP range, an ASN, or written a WAF rule that blocks a pattern your traffic matches. You’re not individually listed; you just fall inside a net cast at someone else. Datacenter and hosting ASNs get blanket-banned constantly because so little legitimate human traffic comes from them.

Diagnose with DechoNet

IP Check shows the exact address you’re presenting to the site, and whether it belongs to a VPN, proxy, hosting provider, or a residential ISP. If it comes back as a datacenter or VPN IP, you’ve found your answer — the ban is on that shared exit, and the fix is to stop using it, not to email anyone.
RDAP Lookup tells you which organization and ASN owns that IP. A hosting or VPN provider’s ASN is exactly the kind of range owners ban wholesale; a residential ISP’s is not.
Reverse DNS on the address often exposes datacenter naming (ec2, vps, hosting hostnames) that confirms you’re routed through infrastructure a site owner has every incentive to block.

Resolution Checklist

Retry on a clean network — turn off the VPN and any proxy, or switch to cellular. If the site loads, the ban was on the shared IP, and you’re done. This one step resolves the large majority of 1006 reports.
Check the IP you present with an IP lookup. Datacenter or VPN → change your egress. Residential → the ban is likely targeted at you, and no network switch will help.
If it’s your server or scraper being banned, stop hammering the site first, then contact the owner. Fixing the behavior before you ask for an unban is the difference between a yes and a no.
Find the owner and quote the Ray ID. The Ray ID is how they locate your exact request in their Security Events log and confirm which rule banned you. Without it, they’re guessing. If you can’t find contact details, an RDAP/WHOIS lookup on the domain usually surfaces an abuse or registrant contact.
Do not open a Cloudflare support ticket expecting a fix. Cloudflare cannot override a customer’s security settings — their docs say so plainly. Only the site owner can lift the ban.

When to Escalate

If a clean residential IP still returns 1006, the ban is deliberate and targeted. There is nothing to diagnose on your end — the resolution lives entirely with the site owner, and your job is to reach them with the Ray ID and a reason they should trust you.
If you own the site and legitimate visitors are hitting 1006/1007/1008, the ban lives in your IP Access Rules or a custom firewall rule. Open Security → Events, filter by the Ray ID from a complaint, and you’ll see the exact rule and the action. A too-broad IP range or ASN block is the usual culprit — narrow it or add the affected IPs to an allow rule.
If the blocks correlate with a single country or a browser fingerprint rather than an IP, you’re likely looking at a different code wearing similar clothes — a 1009 country ban or a 1010 browser-signature block. Confirm the exact number on the screen before you chase the wrong fix.