Problem

A page returns Error 1020: Access denied on a Cloudflare block screen, usually with a Ray ID at the bottom. The request never reached the origin — Cloudflare stopped it at the edge.

Symptoms

  • The Cloudflare error page reads “Access denied” with the code 1020 and a Ray ID like 8a1b2c3d4e5f6789.
  • It hits some visitors and not others — one network, one country, or one VPN is blocked while others sail through.
  • It may fire only on certain paths (an admin URL, an API endpoint, a login form) and not the homepage.
  • Nothing is actually down: the origin is healthy, and the same site loads fine from a different IP.

What This Error Actually Means

Error 1020 is Cloudflare’s code for a firewall rule on this site blocked you. It is not a Cloudflare-wide ban and not an outage. Some rule in the zone’s own security configuration — a custom firewall rule, a WAF managed rule the owner turned on, a Zone Lockdown, or an IP Access Rule — matched the request, and the rule’s action was Block.

That’s the key thing to internalize: 1020 is a decision, not a failure. It separates cleanly from the two families it gets confused with. The Cloudflare 5xx errors (520–527) mean the origin refused, timed out, or returned garbage. Error 1015 means a rate-limiting rule tripped on volume. Error 1010 means the Browser Integrity Check flagged the client as automated. 1020 specifically means: a policy someone configured said no.

Because it’s a policy, the fix depends entirely on which policy. Cloudflare records every block in the Security Events log (in the dashboard, the zone’s Security > Analytics → Events tab) with the exact rule that matched, the client IP, and the Ray ID from the error page. If you own the site, that log turns “access denied” into a specific line you can read. If you’re a visitor, the same Ray ID is the only thing that lets the owner find your request.

Top 3 Causes

  1. A reputation, country, or ASN block catching the wrong traffic - The most common 1020 people actually hit. A rule blocks a country, a hosting ASN, a Tor exit, or IPs Cloudflare scores as low-reputation. VPNs, datacenter IPs, and shared mobile CGNAT ranges get swept up constantly — the rule was aimed at abuse and caught a real user.
  2. A WAF managed rule matching a request pattern - The request looks malicious to a managed ruleset: SQL-injection-shaped query strings, a path traversal pattern, a scanner user agent, or a legitimate API call that happens to resemble one. The visitor did nothing wrong; the signature is a false positive.
  3. A self-inflicted lockdown - The owner’s own monitoring, a headless test, a webhook, or an integration hits a Zone Lockdown or a firewall rule that was scoped too tightly. This is the one that produces confused “our own uptime check is getting 1020” tickets.

Diagnose with DechoNet

  • IP Lookup to see how your own IP presents — geolocation, network, and whether it reads as a datacenter/VPN address. That tells you fast whether a country or reputation rule is the likely trigger before you ever open Cloudflare’s dashboard.
  • Reverse DNS and RDAP to confirm the ASN and network the blocked IP belongs to — the exact fields a country/ASN firewall rule matches on.

Resolution Checklist

  • Copy the Ray ID from the 1020 page. If you own the site, search for it in the zone’s Security > Analytics → Events tab; the matching rule, action, and client IP are all there.
  • Check the blocked client’s IP against a country/ASN/reputation rule first — that’s the highest-probability cause. Confirm whether the IP reads as VPN/datacenter.
  • If a WAF managed rule matched, read the rule ID and the request it fired on. If it’s a false positive on legitimate traffic, add a skip/allow for that path or that rule, not a blanket disable.
  • Add a trusted IP (your office, your monitor, a partner API) to IP Access Rules as Allow, which is evaluated before Block rules.
  • As a visitor: retry without a VPN, from a residential connection, without aggressive privacy extensions. If it persists, the block is intentional — contact the site with the Ray ID.
  • Re-request the URL and confirm it no longer returns 1020.

When to Escalate

  • If the block comes from a WAF managed ruleset you can’t safely tune yourself, escalate to whoever owns the Cloudflare security config — loosening managed rules blindly trades a false positive for real exposure.
  • If you’re a visitor and a clean residential IP still gets 1020, the site is deliberately blocking your country, network, or client. That’s a policy the owner set on purpose; only they can lift it.

Check your own domain now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.