Why Is Cloudflare Blocking Me? Fix Error 1020 and 1015

Seeing "Sorry, you have been blocked", error 1020, 1015, 1005, or 1009? What each Cloudflare block means, why it hit your IP, and the fixes that work.

You open a website and, instead of the page, you get a plain screen with the Cloudflare logo: "Sorry, you have been blocked", "Error 1020: Access denied", or "You are being rate limited". It feels as if Cloudflare has singled you out, but that is almost never what happened. Cloudflare sits in front of the website and enforces rules that the site owner chose. This guide explains what each block page means, why your IP address or browser triggered it, the fixes you can try yourself in a few minutes, and what to send the site owner when the block is not yours to remove.

The short answer

Cloudflare does not block visitors on its own initiative. Every block page in the 1xxx range means that a rule on that particular website matched your request. Cloudflare's own documentation is direct about it: because the website owner blocked the request, Cloudflare support cannot override the owner's security settings. What you can change is the thing the rule matched, and that is usually one of five things:

1. Your IP address - a VPN or proxy exit, a shared mobile or CGNAT address, or an address with a bad history.
2. Your request rate - too many page loads or API calls in a short window.
3. Your location or network - the site blocks your country, your region, or the whole network your IP belongs to.
4. Your browser - an outdated browser, JavaScript or cookies switched off, or an extension that gets in the way.
5. What you sent - a search or form submission that looked like an attack to the site's firewall.

Work through the fixes further down in order. If nothing changes, the block is deliberate and only the site owner can lift it. In that case send them the Ray ID printed at the bottom of the block page, because it lets them find your exact request in their logs.

Which Cloudflare block page are you seeing?

The wording and the error number tell you which kind of rule fired. Cloudflare documents every code in its 1xxx error reference, and the ones visitors run into most often are summarized below.

Before you close the tab, copy two things from the block page: the Ray ID, a unique reference for that one request shown near the bottom, and the time you saw it. With both, a site owner can look up the exact rule that stopped you. Without them, they are guessing.

Lily's block check

See what the site sees

Most Cloudflare blocks act on your IP address. Check whether yours is flagged as a VPN or proxy, and whether it sits on a blacklist, before you contact the site.

Run a proxy checkCheck blacklists

Why Cloudflare blocked your IP address

Most Cloudflare rules are decided per IP address, because the address is the one thing every request carries. That is why a block can follow you across every device on the same Wi-Fi and vanish the moment you switch to mobile data. These are the usual reasons an address ends up on the wrong side of a rule.

You are on a VPN, proxy, or Tor

VPN and proxy services send the traffic of thousands of users through a small pool of addresses. Some of those users scrape, spam, or probe for weaknesses, so the shared exit addresses build up a poor reputation quickly, and plenty of site owners block the hosting networks those servers live in outright. Error 1005, which bans an entire network (ASN), is often aimed at exactly that. Tor exit nodes are treated even more strictly on many sites.

If you are connected to a VPN, disconnect it completely and reload the page in a new tab. If the site opens, the VPN was the trigger. Our proxy check shows whether your current address is flagged as a VPN or proxy, and how sites detect VPN traffic explains why simply switching to another server often fails.

You share your IP address with many other people

Mobile carriers and a growing number of home internet providers use carrier-grade NAT (CGNAT), which places hundreds of customers behind a single public IPv4 address. Offices, schools, hotels, and public Wi-Fi do the same on a smaller scale. When anyone on a shared address misbehaves, a rule that acts on the address hits everyone behind it.

This is a known problem rather than bad luck. The IETF described it in RFC 6269: a server that puts an address in a "penalty box" after too many requests or failed logins ends up locking out other people who share that address, even on their very first attempt. If a site blocks you on one connection but not another, run our CGNAT test to see whether your home connection is shared, and read the CGNAT IP range guide for what the 100.64.0.0/10 addresses mean.

Your IP address has a bad history

IP addresses are recycled. Your provider may have handed you an address that sent spam or attack traffic last month, or a device on your own network may be infected and generating traffic you never see. Security services score addresses by what they have done recently, and a low score can trigger a block before you have done anything at all.

An IP blacklist check shows whether your address appears on public spam and abuse lists. Cloudflare's own advice for visitors who keep getting challenged includes scanning the computer for malicious programs, because an infected device produces exactly the kind of traffic these rules are built to stop.

You sent too many requests

Rate limiting rules count requests from one address over a short window. Rapid reloading, dozens of tabs on the same site, download managers, price trackers, extensions that prefetch pages, and scripts all add up quickly, and error 1015 is the result. Cloudflare's instructions for visitors are short: wait a while, then try again, and do not keep retrying within a short period, because that may extend the block.

Something you submitted looked like an attack

The "Sorry, you have been blocked" page usually comes from a web application firewall rule. These rules inspect what you send, not just who you are, and the block page itself names submitting a certain word or phrase, a SQL command, or malformed data among the possible triggers. Searching for a code snippet, pasting text with unusual characters into a form, or following a link with strange parameters can all match such a rule. If the block appeared straight after you submitted something, go back and try again without that text.

Your country or your network is blocked

Some sites only serve certain countries, and some block networks they associate with abuse. Error 1009 blocks by the country or region your IP address appears to be in, and error 1005 blocks by autonomous system number, the identity of the network your address belongs to. IP geolocation is not always accurate, so you can be refused for a country you are not even in; our guide on why IP location is often wrong explains how that happens. The ASN lookup shows which network your address belongs to.

Your browser does not pass the checks

Cloudflare challenges and its Browser Integrity Check rely on JavaScript, cookies, and a browser that looks like a normal browser. Cloudflare states that visitors must enable JavaScript and cookies to pass any type of challenge, and that ad blockers and other extensions can block the scripts a challenge needs. Very old browsers, privacy browsers with aggressive settings, and command-line tools are rejected far more often. Error 1010 is the explicit version: the owner blocked requests based on the browser's signature.

How to fix a Cloudflare block, step by step

Go through these in order. Each step either fixes the problem or rules out a cause, and the last one tells you who has to act.

1. Write down the error and the Ray ID. Take a screenshot of the whole page, including the Ray ID and the time. You will need it if the block does not clear.
2. Stop retrying for a few minutes. For error 1015 and other rate-based blocks, time is the fix. Reloading every few seconds keeps you above the limit.
3. Turn off your VPN or proxy. Disconnect fully, including browser VPN extensions and any system proxy, then reload in a fresh tab.
4. Try a different network. Switch from Wi-Fi to mobile data or the other way round. If the site opens on the other network, the block is tied to your IP address, not to your device or account.
5. Test a clean browser. Open a private window with extensions disabled, make sure JavaScript and cookies are allowed, and update the browser. Cloudflare also runs a challenge compatibility checker at debug.challenges.cloudflare.com.
6. Check your IP address. Look up your public IP, then run the proxy check and the blacklist check. A listing explains repeated blocks on many different sites.
7. Get a new IP address if yours is the problem. Restarting the router usually brings a new address on connections with a dynamic IP. On a phone, switching airplane mode on and off does the same for mobile data. Behind CGNAT you simply receive another shared address, which may or may not be flagged.
8. Scan your devices. If blocks follow your connection across many sites, run a malware scan on every device on the network, including old laptops and smart TVs that rarely get attention.
9. Contact the site owner. If none of this works, the rule is deliberate. Send the owner the Ray ID, the time, your public IP, and what you were doing. A template follows below.

Stuck on "Verify you are human" in a loop

A challenge that keeps coming back is not a block, but it can feel like one when the page never loads. Cloudflare's troubleshooting guide for challenges lists the usual causes: an unstable network connection, browser settings or extensions that block the challenge scripts, an unsupported browser, JavaScript switched off, and, in some cases, strong bot signals from the connection. Its recommended fixes, in order:

• Update the browser. Cloudflare challenges support all major browsers except Internet Explorer.
• Disable every extension and reload, especially ad blockers and script blockers.
• Make sure JavaScript and cookies are enabled for the site.
• Try a private window, then a different browser or device.
• Turn off any VPN or proxy.
• Switch to a different network, such as a mobile hotspot.

Passing a challenge stores a clearance cookie called cf_clearance in your browser, and that cookie is what stops the next page from challenging you again. If your browser blocks or deletes cookies for the site, you will be challenged over and over, so allow cookies for the site you are trying to use. When nothing on the list helps, Cloudflare suggests sending the site owner the error code and the Ray ID.

Why Cloudflare support cannot unblock you

Writing to Cloudflare feels like the obvious move, but for these block pages it does not help. The documentation for the IP ban errors says that because the website owner blocked your request, Cloudflare support cannot override the customer's security settings. The challenge documentation says the same about challenges: Cloudflare employees cannot remove them, and only the website owner can change the settings that show them. Cloudflare supplies the tools; every site decides for itself who gets through.

What to send the site owner

If you are blocked from a site you actually need, the owner can usually fix it in a minute, provided they can find your request. Look for a contact address on the site itself or its social profiles, or run a WHOIS lookup on the domain. A useful message contains:

• The full error, for example "Error 1020: Access denied".
• The Ray ID from the bottom of the block page.
• The date and time you saw it, with your time zone, so it can be matched against logs kept in UTC.
• Your public IP address, which our IP checker shows.
• What you were doing: the page you opened, the search you ran, or the form you submitted.

Keep it short and factual. Owners often block whole regions or networks without realizing that legitimate visitors are caught too, and a clear report is usually how they find out.

If you own the site: how to unblock a visitor

If a visitor reports a block and your rule is too broad, the fix lives in your Cloudflare dashboard. The documented process for error 1020 is:

1. Ask the visitor for the screenshot with the Ray ID and the time.
2. Open Security Events and search for the Ray ID or the visitor's IP address. Convert the visitor's local time to UTC first.
3. See which rule acted, then either adjust the rule or allow the visitor's address with an IP Access Rule.

For error 1015, review your rate limiting thresholds. If a rule counts requests over a very short period such as one second, Cloudflare suggests increasing the period to 10 seconds. If many of your visitors arrive from mobile networks, remember that one carrier address can stand for hundreds of people, so a per-IP limit that suits home broadband can lock out a crowd of genuine users at once.

Will a VPN get you past a Cloudflare block?

Sometimes, and it is worth being honest about when. If your own address is the problem, such as a shared carrier IP with a poor score or a recycled address that was used for abuse, a different IP can get you through. But VPN exits are one of the most common reasons for blocks in the first place. Many sites challenge or block VPN networks by default, which is why turning a VPN off fixes far more Cloudflare blocks than turning one on.

There is also a line worth respecting. If a site banned you on purpose, for example after a terms of service violation, using another address to get around the ban can break its terms again. For a deliberate block the reliable route is still the site owner. If you are unsure whether a VPN is even changing your address, our guide on a VPN that is connected but not changing your IP shows how to check.

If the problem is not Cloudflare at all but a message such as "your IP has been temporarily blocked" or "access denied" from another security service, our guide to IP addresses that get blocked or banned covers those, from Akamai and WordPress firewalls to Google's unusual traffic page.

Frequently asked questions

Is Cloudflare blocking me, or the website?

The website. Cloudflare enforces the rules the site owner set up, such as firewall rules, rate limits, and country or IP blocks. That is why the same IP address can be blocked on one Cloudflare site and work on thousands of others.

How long does a Cloudflare block last?

It depends on the rule. A rate limit (error 1015) usually clears once you stop sending requests for the period the owner configured. IP, country, network, and firewall blocks (errors 1005 to 1009 and 1020) last until the owner changes the rule or you connect from an address the rule does not match.

What is a Cloudflare Ray ID?

A unique identifier for one request that passed through Cloudflare, shown at the bottom of block and error pages. The site owner can search for it in their security events to see exactly which rule blocked you and why.

Why does the site work on mobile data but not on Wi-Fi?

The two connections use different public IP addresses. If a site opens on one and not the other, the block is tied to the address of the blocked connection, not to your device or your account.

Will clearing cookies fix a Cloudflare block?

It can fix a challenge loop, but it does not lift an IP block. For "Verify you are human" loops, allow cookies for the site and disable extensions. For errors such as 1020, 1006, or 1009, cookies are not the issue.

Can Cloudflare support unblock me?

No. Cloudflare's documentation states that support cannot override a customer's security settings. Contact the site owner with the Ray ID instead.

Does restarting my router change my IP address?

Often, on connections with a dynamic IP address. With a static IP, or when the provider keeps the same lease, you get the same address back. Behind CGNAT you may receive a different shared address. Check your public IP before and after the restart to confirm.

Did this article help?

IP Trackers is free with no sign-up. A small contribution helps keep the guides current and the tools running.

Support IP Trackers

By Tudor Uzun

Founder and Senior Software Engineer, IP Trackers

Published October 2, 2026Editorial standards