Error 1020 Access Denied (Cloudflare) Fix

Problem

A page returns Error 1020: Access denied on a Cloudflare block screen, usually with a Ray ID at the bottom. The request never reached the origin — Cloudflare stopped it at the edge.

Symptoms

• The Cloudflare error page reads “Access denied” with the code 1020 and a Ray ID like 8a1b2c3d4e5f6789.
• It hits some visitors and not others — one network, one country, or one VPN is blocked while others sail through.
• It may fire only on certain paths (an admin URL, an API endpoint, a login form) and not the homepage.
• Nothing is actually down: the origin is healthy, and the same site loads fine from a different IP.

What This Error Actually Means

Error 1020 is Cloudflare’s code for a firewall rule on this site blocked you. It is not a Cloudflare-wide ban and not an outage. Some rule in the zone’s own security configuration — a custom firewall rule, a WAF managed rule the owner turned on, a Zone Lockdown, or an IP Access Rule — matched the request, and the rule’s action was Block.

That’s the key thing to internalize: 1020 is a decision, not a failure. It separates cleanly from the two families it gets confused with. The Cloudflare 5xx errors (520–527) mean the origin refused, timed out, or returned garbage. Error 1015 means a rate-limiting rule tripped on volume. Error 1010 means the Browser Integrity Check flagged the client as automated. 1020 specifically means: a policy someone configured said no.

Because it’s a policy, the fix depends entirely on which policy. Cloudflare records every block in the Security Events log with the exact rule that matched, the client IP, and the Ray ID from the error page. If you own the site, that log turns “access denied” into a specific line you can read. If you’re a visitor, the same Ray ID is the only thing that lets the owner find your request.

Top 3 Causes

1. A reputation, country, or ASN block catching the wrong traffic - The most common 1020 people actually hit. A rule blocks a country, a hosting ASN, a Tor exit, or IPs Cloudflare scores as low-reputation. VPNs, datacenter IPs, and shared mobile CGNAT ranges get swept up constantly — the rule was aimed at abuse and caught a real user.
2. A WAF managed rule matching a request pattern - The request looks malicious to a managed ruleset: SQL-injection-shaped query strings, a path traversal pattern, a scanner user agent, or a legitimate API call that happens to resemble one. The visitor did nothing wrong; the signature is a false positive.
3. A self-inflicted lockdown - The owner’s own monitoring, a headless test, a webhook, or an integration hits a Zone Lockdown or a firewall rule that was scoped too tightly. This is the one that produces confused “our own uptime check is getting 1020” tickets.

Diagnose with DechoNet

• IP Lookup to see how your own IP presents — geolocation, network, and whether it reads as a datacenter/VPN address. That tells you fast whether a country or reputation rule is the likely trigger before you ever open Cloudflare’s dashboard.
• Reverse DNS and RDAP to confirm the ASN and network the blocked IP belongs to — the exact fields a country/ASN firewall rule matches on.

Resolution Checklist

• Copy the Ray ID from the 1020 page. If you own the site, search Security Events for it; the matching rule, action, and client IP are all there.
• Check the blocked client’s IP against a country/ASN/reputation rule first — that’s the highest-probability cause. Confirm whether the IP reads as VPN/datacenter.
• If a WAF managed rule matched, read the rule ID and the request it fired on. If it’s a false positive on legitimate traffic, add a skip/allow for that path or that rule, not a blanket disable.
• Add a trusted IP (your office, your monitor, a partner API) to IP Access Rules as Allow, which is evaluated before Block rules.
• As a visitor: retry without a VPN, from a residential connection, without aggressive privacy extensions. If it persists, the block is intentional — contact the site with the Ray ID.
• Re-request the URL and confirm it no longer returns 1020.

When to Escalate

• If the block comes from a WAF managed ruleset you can’t safely tune yourself, escalate to whoever owns the Cloudflare security config — loosening managed rules blindly trades a false positive for real exposure.
• If you’re a visitor and a clean residential IP still gets 1020, the site is deliberately blocking your country, network, or client. That’s a policy the owner set on purpose; only they can lift it.