Cloudflare Error 1020 Access Denied means Cloudflare blocked a request based on a firewall rule. The request never reached your origin server.
This is not downtime. It is a security rule doing exactly what it was configured to do. Visitors see an access denied page, while the site itself may still be online for everyone else.
Quick Fix
- Open Cloudflare → Security → Events.
- Find the blocked request using the Ray ID from the error page.
- Identify which firewall rule triggered the block.
- Adjust or narrow the rule.
- Allow legitimate IPs if needed.
- Retest access.
In most cases, Error 1020 is caused by an overly strict custom firewall rule.
What Is Cloudflare Error 1020?
Cloudflare sits between visitors and your origin server. Every request is checked against security rules before it is forwarded.
If a rule matches, access is denied immediately and Cloudflare returns Error 1020.
What actually happens:
- The user sends a request
- Cloudflare evaluates firewall rules
- A rule matches the request
- The request is blocked
- Error 1020 is shown
The origin server is not involved. This is a CDN-level decision.
Why Error 1020 Happens
Error 1020 appears when a firewall rule is triggered. That rule can be custom or automatic.
Common triggers include:
- Blocked IP address
- Country restrictions
- Rate limiting
- Bot protection rules
- Custom WAF expressions
False positives are common when rules are too broad.
Main Causes
1. Overly Broad Custom Firewall Rules
Custom expressions can unintentionally block valid traffic. Examples include blocking entire IP ranges, blocking multiple countries, or filtering by user agent incorrectly. If the logic is too wide, real users get denied.
2. IP Blocking
If an IP is manually blocked, all requests from that address fail. This often happens during security testing or after a bot attack, when a shared office or VPN IP was added to the block list.
3. Aggressive Rate Limiting
Rate limiting protects against abuse, but low thresholds can block normal traffic. APIs, login pages, and checkout flows are common targets.
4. Bot Protection Sensitivity
Automated detection may flag legitimate users, especially those using VPNs, privacy browsers, or corporate proxies.
5. Country-Level Blocking
Geo-restrictions can deny access to real customers, remote staff, or search crawlers that exit from a blocked country.
How to Fix Cloudflare Error 1020
Step 1 — Locate the Blocked Event
- Log into the Cloudflare dashboard.
- Go to Security → Events.
- Search using the Ray ID shown on the error page.
This shows which rule caused the block, the client IP, country, user agent, and path.
Step 2 — Review the Triggering Rule
Examine the rule carefully. Check for broad IP matches, incorrect country filters, and overlapping conditions. A small mistake in an expression can block a large group of users.
Step 3 — Adjust or Narrow the Rule
Instead of disabling protection entirely:
- Refine the matching logic
- Use more specific IP ranges
- Limit the rule to sensitive paths only
Security should be precise, not aggressive.
Step 4 — Allow Legitimate Traffic
If a real user is blocked, add their IP to an allow rule or exclude a trusted ASN. Always retest after the change. Prefer an allow rule with a higher priority over deleting the security rule.
Step 5 — Review Rate Limiting Settings
Confirm thresholds match real traffic. Raise limits if legitimate users or APIs exceed them during normal use.
Advanced Troubleshooting
Analyze Traffic Trends
Look for spikes that line up with rule triggers. A sudden block after a rule edit is usually the rule, not an attack.
Audit All Firewall Rules
Complex rule stacks can overlap. One allow rule can lose to a later block rule if priority is wrong.
Test From Different Networks
Confirm whether the block is IP-specific or rule-based. Mobile data versus office Wi-Fi is a fast check.
Review Search Engine Access
Make sure Googlebot and other crawlers are not caught by country, IP, or bot rules. Blocked crawlers can hurt indexing.
Prevention Tips
- Use targeted firewall rules instead of global blocks.
- Review Security Events every week for false positives.
- Document who changed a rule and when.
- Scope blocks to login, admin, or API paths when possible.
- Do not block whole countries unless you accept the lost traffic.
When to Contact Support
Contact Cloudflare support if the triggering rule is unclear, logs look inconsistent, or Bot Fight Mode keeps flagging real users. Include the Ray ID and the timestamp.
FAQ
Is Cloudflare Error 1020 a server error?
No. The request is blocked before it reaches the origin server.
Can visitors fix Error 1020?
Usually not. The site owner must adjust firewall settings. Switching networks sometimes works if only one IP is blocked.
Does Error 1020 affect SEO?
Yes, if search crawlers are blocked. Indexing and crawl can stall until those requests are allowed.
Can VPN users trigger Error 1020?
Yes. Shared or previously flagged VPN IPs are often blocked.
What is a Ray ID?
A unique request identifier used to trace the blocked event in Cloudflare logs.
Final Thoughts
Cloudflare Error 1020 Access Denied is a firewall decision, not a server failure.
The fix is almost always a rule adjustment. Open Security Events, match the Ray ID, narrow the rule, and allow legitimate traffic. Keep protection precise so real users and crawlers are not caught in it.
Related Cloudflare & CDN Errors
If you are troubleshooting a Cloudflare or CDN issue, these codes point to a different layer:
- Error 520 Unknown Error — the origin returned an unexpected response.
- Error 521 Web Server Is Down — the origin refused the connection.
- Error 522 Connection Timed Out — the origin did not respond in time.
- Error 523 Origin Is Unreachable — Cloudflare could not route to the origin.
- Error 524 Timeout Occurred — the origin took too long to finish the request.
- Error 525 SSL Handshake Failed — TLS failed between Cloudflare and the origin.
- Error 526 Invalid SSL Certificate — the origin certificate failed strict validation.