How is 1009 different from Cloudflare's 1020 and 1010?

All three are Access Denied blocks, but they trigger on different things. 1009 is 'Access Denied: Country or region banned' — Cloudflare mapped your IP to a country the owner blocked. 1020 is the generic 'Access Denied' fired by a custom WAF or firewall rule that matched something about your request (a path, a header, an ASN). 1010 is 'the owner has banned your access based on your browser's signature' — an automated-browser fingerprint, not your location. And 1006/1007/1008 mean your specific IP was banned, not your whole country. The four-digit code tells you exactly which lever the site owner pulled.

I'm not in the banned country. Why do I get 1009?

Because Cloudflare decides your country from your IP address, not your passport. If you're on a VPN or proxy, the exit node's country is what counts — a US user routed through a banned exit gets blocked. It also happens when IP geolocation is simply wrong: mobile CGNAT, a freshly reassigned IP block, or a corporate egress can map to the wrong country. Check what country your public IP actually resolves to before assuming the site made a mistake.

I own the site. How do I stop blocking a country by accident?

1009 comes from a country block you configured — either an IP Access Rule scoped to a country, or a custom WAF rule matching a geo field like ip.geoip.country. Open Security, find the rule with a country in it, and either remove the country or switch the action from Block to Managed Challenge so legitimate visitors get a CAPTCHA instead of a wall. If you didn't set it, check whether a security template or a managed ruleset added a geo block you didn't notice.

Views: 102

1009 Access Denied: Country or Region Banned (Cloudflare)

Error 1009: Cloudflare blocked your country with a 403. See which country your IP maps to and whether a VPN exit tripped it. Free instant check, no sign-up.

Check your domain for this issue now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.

Problem

A visitor loads the site and gets a Cloudflare page reading “Access Denied: Country or region banned” with error code 1009 and an HTTP 403. The request never reached the origin. Cloudflare looked up the visitor’s IP, decided which country it belongs to, matched it against a block the site owner configured, and stopped the request at the edge.

Symptoms

The Cloudflare error page says Error 1009 and Access Denied: Country or region banned.
The HTTP status is 403 — it’s a deliberate block, not a server failure.
It’s consistent for some visitors and invisible to others, splitting cleanly by geography.
Turning on a VPN in a different country makes the site load instantly — or, if you were already on a VPN, turning it off does.

What 1009 Actually Means

Cloudflare 1009 is a location block, and location means one specific thing here: the country that Cloudflare’s IP-to-country database assigns to your address. Every request hitting Cloudflare’s edge gets tagged with a two-letter ISO 3166 country code derived purely from the source IP. If the site owner has a rule that blocks that code, the request dies at the edge with a 403 and the 1009 page. The origin server never hears about it.

The critical thing to internalize: this is not your device, your account, or your browser. It’s your IP’s apparent country. That word “apparent” is where almost every confusing 1009 comes from. IP geolocation is a best-effort mapping, not ground truth. A VPN moves your apparent country to the exit node. Mobile carriers route through CGNAT that can geolocate to a different region than where you’re standing. Newly allocated or recently transferred IP ranges lag in the databases for weeks. So “I’m clearly in France and it says my region is banned” is a completely normal 1009 — Cloudflare thinks you’re somewhere France’s owner blocked.

Don’t confuse 1009 with its siblings. A 1020 is a custom firewall rule that matched something — could be a path, a user agent, an ASN, anything. A 1010 targets your browser’s automation signature. A 1006/1007/1008 bans your individual IP. 1009 is specifically and only about country. If you can read the four-digit code, you already know which of the site’s five different block mechanisms you tripped, and that narrows the fix enormously.

Top 3 Causes

The site intentionally blocks your region - Licensing, sanctions compliance, or abuse mitigation. Streaming catalogs, government portals, and shops that only ship domestically routinely block whole countries, and Cloudflare’s IP Access Rules make it a two-click setting. If you’re genuinely in a blocked country, the block is working as designed and there’s nothing to “fix” on the technical side.
Your VPN or proxy exits in a banned country - You turned on a VPN for privacy and your traffic now leaves from an exit node in a region the site blocks. This is the single most common surprise 1009: the user swears they’re in an allowed country, and they are — but their traffic isn’t. Switching to an exit in an allowed country, or turning the VPN off, resolves it immediately.
IP geolocation maps you to the wrong country - Mobile CGNAT, a recently reassigned IP block, or a corporate egress that routes through another region can all tag you with a country you’re not in. The site’s block is aimed at that country; you’re collateral. This one isn’t fixable by the visitor beyond changing networks — it needs the site owner to loosen the rule or the geolocation database to catch up.

Diagnose with DechoNet

IP Check to see the public IP you’re actually presenting to Cloudflare and the country it geolocates to. This is the exact input Cloudflare’s edge uses to decide 1009, so it settles the question in one look: if your IP maps to a country you didn’t expect — because of a VPN, a proxy, or a stale database — you’ve found the block’s cause. If it maps to your real country and you’re still blocked, the site is deliberately banning your region, and the fix is on their side, not yours.

Resolution Checklist

Check what country your public IP resolves to. If it’s not where you are, a VPN, proxy, or bad geolocation is the culprit — that’s the whole diagnosis for a visitor.
If you’re on a VPN, switch the exit to an allowed country or turn it off and retry. A 1009 that vanishes when you change exits was never about you — it was your route.
If your IP maps to the correct country and you’re blocked, the site is intentionally banning your region. A VPN into an allowed country is the only visitor-side workaround; otherwise you need the owner to make an exception.
If you own the site: open Security and find the rule carrying a country — an IP Access Rule scoped to a country, or a custom WAF rule using a geo field. That rule is the source.
Decide whether Block is really what you want. Switching the action to Managed Challenge lets real users through a CAPTCHA while still stopping automated abuse from the region. A hard country Block also catches VPN users and mis-geolocated mobile visitors you probably didn’t mean to lose.
Confirm you didn’t inherit the block from a template. Security profiles and managed rulesets can add geo blocks you never explicitly set; scan the full rule list, not just the ones you remember creating.

When to Escalate

If legitimate customers in an allowed country report 1009, escalate to whoever owns the Cloudflare account and audit the country rules — a too-broad geo block is quietly turning away paying users routed through the wrong region.
If you need to serve a sanctioned or high-abuse country but only certain paths, don’t lift the whole block. Move to a scoped custom rule and, if the traffic profile is genuinely hostile, pair it with rate limiting and a challenge rather than an all-or-nothing country ban.