Free tools Windows power users keep installed
One-click scans. No signup required.
Cloudflare Error 1020 means a Cloudflare firewall rule denied access to the website. If you are a visitor, save the error page and send its Ray ID and timestamp to the site owner; you cannot change the rule yourself. If you own the site, search Security > Analytics > Events for that Ray ID or client IP, account for the timestamp’s timezone, inspect the matching event, and then make the narrowest rule or IP Access change that resolves the verified cause.
What Cloudflare Error 1020 means
Cloudflare’s official page calls this message “Error 1020: Access denied” and defines it as access denied by a Cloudflare firewall rule. The common case is a client or browser blocked by a rule configured for the website. The error page by itself does not reveal which rule or request attribute triggered the decision; the website owner must inspect the corresponding security event.
Cloudflare places 1020 in its 1xxx error family. These errors are generally described in the HTML response body, unlike ordinary HTTP errors such as 403 or 429, which are returned in the HTTP status header. A site can customize error pages, so the exact appearance and wording may differ.
The official Error 1020 guidance was last updated August 3, 2026: Cloudflare Error 1020 documentation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
If you are the blocked visitor
1. Capture the complete error page
Take a screenshot before refreshing. Include the “Error 1020: Access denied” message and every identifying detail shown, especially:
- Ray ID
- Date and time displayed on the page
- Your client IP, if Cloudflare shows it
- The website address you attempted to open
Do not crop out the Ray ID or timestamp. They allow the owner to locate one event among many requests.
2. Send the screenshot to the website owner
Use the site’s support email, contact form, help desk or another legitimate channel. Explain the page you requested and when the block occurred. Cloudflare’s documented visitor remedy is to provide the owner with the screenshot; only the site owner controls the firewall policy.
3. What not to assume
Clearing cookies, changing browsers, disabling security software, waiting, or connecting through a VPN is not identified by Cloudflare’s Error 1020 documentation as a guaranteed or official fix. Those actions can also change the evidence the owner needs. Report the original page first and follow the owner’s instructions.
If you own the website
1. Get the visitor’s evidence
Ask for the unedited screenshot, Ray ID, client IP (if displayed), exact URL and the timestamp including its timezone. A screenshot without the Ray ID or time can make a precise lookup difficult.
2. Open Security Events
- Sign in to the Cloudflare dashboard.
- Open Security > Analytics > Events. Cloudflare’s documentation refers to this as the Security Events log.
- Search using the Ray ID first. If that is unavailable, search for the client IP and narrow the time window.
Cloudflare records event times in UTC. Convert the timestamp printed on the error page to UTC before searching, or explicitly set the dashboard’s time range so the event is not missed. Preserve the visitor’s original timezone when communicating with them.
3. Inspect the matching event
Review the rule that actioned the request and the attributes Cloudflare evaluated. Check whether the request was from a legitimate user, an automation process, a known network, a country or region covered by a policy, or a pattern your rule intended to block. Also verify that you matched the correct event rather than a nearby request from the same IP.
4. Apply the narrowest correction
If the rule is too broad, update the relevant Firewall Rule (Cloudflare’s current documentation notes that the older Firewall Rules product is deprecated). If a trusted user must be admitted, add that address to the appropriate IP Access Rule with the smallest scope and duration that meets your policy. Do not disable all firewall protection merely to make one page load.
After saving the change, ask the visitor to retry and provide a new Ray ID if the denial continues. Keep a record of why the exception exists so a later rules review can remove or tighten it.
5. When to contact Cloudflare
If the documented investigation does not resolve the issue, Cloudflare’s general 1xxx guidance says to contact Cloudflare Support. Cloudflare specifies that technical support cases must be opened by the website owner. A visitor should continue working through the site owner rather than opening a support case on the owner’s behalf.
Why legitimate visitors get blocked
Error 1020 is a policy result, not a diagnosis of a broken phone, browser or internet connection. Common possibilities include:
- A firewall expression matches an IP range, country, ASN, path, header or other request property more broadly than intended.
- A security rule was written for abusive automation but also matches a normal browser.
- An allowlist was not updated after a corporate network, ISP or hosting provider changed addresses.
- The visitor’s request coincided with a rule deployment or configuration change.
These are investigation categories, not proof of a particular cause. The matching Security Events record is the authority for an individual block.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchVisitor and owner responsibilities at a glance
| Role | What you control | Useful evidence | Next action |
|---|---|---|---|
| Blocked visitor | Your report and supporting details | Screenshot, Ray ID, timestamp, client IP if shown | Contact the website owner |
| Website owner | Cloudflare rules and IP Access policies | Ray ID or client IP plus correctly converted event time | Inspect Security Events, then adjust the relevant control |
Troubleshooting branches
The owner cannot find the event
- Confirm the Ray ID was copied exactly, including letters and numbers.
- Convert the displayed time to UTC and widen the search window slightly.
- Search by client IP if it appears on the page.
- Verify that the request reached the Cloudflare zone you are inspecting and that you are viewing the correct account.
The owner finds several possible events
Match the event’s exact time, requested host and path, action and Ray ID. Do not change a rule based only on an IP match; the same address may generate unrelated requests.
The visitor is still blocked after a rule change
Check whether another rule is taking the blocking action, whether an IP Access Rule conflicts with the intended exception, and whether the visitor is retrying the same URL. Ask for a fresh screenshot and Ray ID after each material change.
The page looks like a normal 403
Check the response body and headers. Cloudflare’s 1xxx errors are distinct from standard HTTP status errors, and custom error pages can change the presentation. Do not label every 403 response as Error 1020 without the Cloudflare error details.
Rank #4
Or skip the browser setup
If your goal is to document the blocked page for a ticket or incident record, ScreenshotNeo can capture a URL with one request instead of setting up a browser. It is a website screenshot API and MCP server for developers. Cookie and consent banners, newsletter popups and chat widgets are removed before the capture; bot checks, blank pages, failed loads and timeouts are not billed, and each response identifies the page verdict and billing status in headers. Its MCP server lets Claude, Cursor and other MCP clients call screenshot tools directly.
See the ScreenshotNeo documentation for all options. A basic cURL capture is:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo includes full-page and element captures, device and viewport controls, lazy-image loading, custom CSS and JavaScript, waits, request blocking, headers, cookies, user agents, geolocation, PDFs, caching, signed links, asynchronous webhooks and bulk capture. One thousand screenshots per month are free with no card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.
Security and privacy considerations
Error pages can expose Ray IDs, IP addresses, internal paths or timing information. Share screenshots only with the site’s legitimate support channel. Site owners should limit IP exceptions, document their purpose and review them regularly. When automating captures, treat API keys, cookies, Authorization headers and signed links as secrets; do not place them in public source code or client-side pages.
Frequently Asked Questions
Is Cloudflare Error 1020 caused by my computer?
Not necessarily. It means the website’s Cloudflare firewall denied the request. The owner must inspect the matching Security Events record to determine why.
Can a visitor remove Error 1020?
No. A visitor can provide the screenshot, Ray ID and timestamp, but only the website owner can change the Cloudflare rule or IP Access policy.
What is the Ray ID used for?
It is an identifier the website owner can use, together with the event time, to locate the specific blocked request in Cloudflare Security Events.
Is Error 1020 the same as HTTP 403?
No. Cloudflare classifies 1020 as a 1xxx error presented in the response body, while 403 is an HTTP status code in the response headers, although a customized page can make appearances similar.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
