The short version
- 01Take a screenshot of the whole error page, including the Ray ID at the bottom.
- 02Send that screenshot to the site owner, which is exactly what Cloudflare tells visitors to do.
- 03Try without a VPN or proxy, since a shared exit address is a common trigger.
- 04If you own the site, search Security Events under Security then Analytics for that Ray ID.
- 05Convert the error page's UTC timestamp to your own timezone before searching.
- 06Update the rule that fired, or allow the visitor's IP through IP Access Rules.
Raw message
Error 1020 — Access denied
Likely causes
- A Cloudflare firewall rule configured by the site owner blocking your request.
- A rule aimed at a country, network or user agent that happens to include you.
- A VPN, proxy or shared IP address with a poor reputation.
- A browser extension altering requests in a way a rule treats as suspicious.
What 1020 means
Cloudflare states that error 1020 indicates access to the website is denied by a Cloudflare firewall rule, and gives the cause as a client or browser being blocked by a Cloudflare customer's firewall rules.
The important word is customer. This is not Cloudflare blocking you on its own initiative — it is a rule that the owner of that particular website configured, applied to your request. A different Cloudflare-protected site will very likely let you straight in.
Cloudflare's own documentation notes that the Firewall Rules product it refers to is deprecated, having been succeeded by WAF custom rules. The error and the diagnosis are unchanged; only the name of the screen in the dashboard has moved.
If you are a visitor: the Ray ID is the whole message
Cloudflare gives visitors exactly one instruction: provide the website owner with a screenshot of the 1020 error message you received. That sounds like a brush-off and it is not, because of what the error page carries.
Every Cloudflare error page shows a Ray ID — a unique identifier for that specific request. With it, the site owner can find your exact blocked request in their logs. Without it, they are looking for one request among millions and will usually give up. Capture the whole page rather than cropping to the message.
Before you write, it is worth trying once without a VPN or proxy. Shared exit addresses accumulate the reputation of everyone using them, and a rule aimed at abusive traffic can catch a perfectly ordinary visitor arriving from one.
If you own the site
Cloudflare's procedure is precise. Collect the screenshot from the affected visitor, then search the Security Events log — found under Security, then Analytics, in the Events tab — for the Ray ID or the client IP address from the visitor's error message.
There is a detail in Cloudflare's instructions that trips people up: convert the UTC timestamp on the error page to your local timezone when searching. A search in the wrong hour returns nothing and makes it look as though the block was never logged.
Once you have found the event, Cloudflare's step is to assess the cause of the block and then either update the firewall rule or allow the visitor's IP address in IP Access Rules. Which of those is right depends entirely on what the rule was for, and the Security Events entry tells you which rule fired.
Sources and review notes
Checked on . Based on Cloudflare's support documentation for error 1020. The Security Events path, the Ray ID search and the timezone warning are as published. The explanation of why the Ray ID matters, and the suggestion to try without a VPN first, are editorial. Cloudflare dashboard navigation changes over time. Glitchary is independent of Cloudflare.