A Cloudflare-branded denial page with a specific error code and Ray ID is the strongest visitor-side clue that Cloudflare made the access decision. A plain HTTP 403 is not enough: it can come from Cloudflare or from the website’s origin server. Record the page details, then send them to the site owner so they can search Cloudflare Security Events and identify the rule, action, and address involved.
What a Cloudflare block looks like
Read the entire response page before trying workarounds. Look for the Cloudflare name or logo, an error number, a Ray ID, a displayed time, and the site you requested. A branded page is useful evidence, but the code determines what kind of restriction may have occurred.
Do not diagnose an individual IP block from a bare 403. Cloudflare’s documentation says an unbranded 403 is typically generated by the origin web server behind Cloudflare. Common origin causes include file or directory permissions, ModSecurity, and an IP deny rule on the server itself.
Why the Ray ID matters
A Ray ID identifies the request that produced the page. The site owner can use it, or your visitor IP and the approximate time, to search Security Events or Log Explorer. The Ray ID may also appear as the cf-ray response header in browser developer tools. Security Events can contain sampled data, so a missing result does not conclusively prove that no event occurred; narrowing the time range can reveal more records.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Cloudflare error codes that point to access restrictions
Use an error number as a clue, not as a complete diagnosis. Different codes refer to different dimensions of a site owner’s security policy.
| Code | Likely meaning | What it does—and does not—prove |
|---|---|---|
| 1020 | Denied by a Cloudflare customer firewall rule. | Shows that a customer-configured rule denied the request; it does not, by itself, tell you whether the rule matched your IP, ASN, country, request pattern, or another condition. |
| 1006, 1007, 1008, 1106 | Cloudflare reports a banned client IP. | Strong evidence of an IP-based customer restriction, subject to the owner’s event and rule records. |
| 1005 | An Autonomous System Number (ASN) ban. | Points to a network or provider range rather than necessarily one individual address. |
| 1009 | Country or region restriction. | Indicates geographic policy. Cloudflare documents country blocking through IP Access rules for Enterprise customers; other plans can use WAF custom rules. |
| 1015 or an HTTP 429 result | Rate limiting or another request-volume control. | May be temporary request control, not a permanent ban on your IP. |
A branded 403 can also result from a WAF rule, challenge decision, rate limit, or another security feature. Only the site owner’s event details can establish which rule actually ran.
How to check from the visitor side
- Capture the complete page. Take a screenshot showing the branding, error code, Ray ID, requested hostname, and displayed time. If the page is long, include all of those fields rather than only the headline.
- Write down the timing. Note the date, local time, and timezone. Owners commonly search using UTC, so include both your local timezone and the approximate UTC equivalent if you know it.
- Copy the Ray ID exactly. Preserve every character. If there is no visible Ray ID, open browser developer tools, reload the page, and inspect response headers for
cf-ray. Do not alter the value when sending it to the owner. - Record what you were doing. Say whether you were opening the homepage, submitting a form, signing in, downloading a file, or making repeated requests. The action can help the owner identify a WAF or rate-limit match.
- Check the scope. Try the same site once in a normal browser window and, if appropriate, test another unrelated Cloudflare-protected site. One failing site keeps the investigation focused on that site. Several unrelated failures can justify asking your ISP about connectivity, but they do not prove an ISP block.
- Contact the website owner. Send the screenshot, exact URL, Ray ID, timestamp with timezone, your public IP address if you are comfortable sharing it, and a short description of the action. Ask the owner to check the corresponding Security Event and tell you whether an IP, ASN, country, WAF, firewall, challenge, or rate-limit rule matched.
Cloudflare’s visitor guidance for a 1020 page is to provide the website owner with a screenshot. Cloudflare support cannot override a customer’s security settings for you; the operator of the site controls those rules.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
How the website owner verifies the decision
- Open the Cloudflare dashboard for the affected zone.
- Search Security Events using the Ray ID or visitor IP, and set a narrow time window around the displayed event time. For a 1020 investigation, Cloudflare documents the path Security > Analytics > Events. The 1005 guidance refers to Security > Events. Labels can change as Cloudflare updates its dashboard.
- Open the matching event and inspect the action, rule name or ID, source, country, ASN, requested path, and any WAF or rate-limit metadata.
- Compare the event timestamp in UTC with the visitor’s local time. Confirm that the event belongs to the reported hostname and request, not merely to another request from the same address.
- Review the rule that produced the action. Cloudflare IP Access rules support allow, block, and challenge actions based on IP, ASN, or country. WAF custom rules and other security products can also deny or challenge traffic.
- Change the narrowest policy that fixes the legitimate problem. Do not add a blanket allow for an IP or ASN without understanding what protections that exception bypasses. Cloudflare recommends custom rules for IP- and geography-based blocking, but the owner should identify the matched rule before changing it.
If the owner cannot find a matching Cloudflare event, check origin access logs, web-server permissions, ModSecurity, and origin IP-deny rules. Sampling in Security Events means that absence from the list is not conclusive.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Cloudflare block, origin 403, or ISP problem?
| Observation | Most useful interpretation | Next check |
|---|---|---|
| Cloudflare branding plus 1020 | A customer firewall rule denied the request. | Owner searches Security Events by Ray ID or IP and inspects the matched rule. |
| Cloudflare branding plus 1006–1008 or 1106 | A customer-configured client-IP ban is indicated. | Owner confirms the exact IP and action; verify whether a shared, mobile, VPN, or proxy address is involved. |
| Cloudflare branding plus 1005 | An ASN-level restriction is indicated. | Owner checks the network/ASN condition rather than treating it as only one household address. |
| Cloudflare branding plus 1009 | A country or region policy is indicated. | Owner checks geographic rules and the plan or feature that supplied them. |
| Branded challenge, 403, or 429 without a listed code | A WAF, bot, challenge, or rate-limit decision is possible. | Owner uses the event action and rule details; do not label it a permanent IP ban. |
| Unbranded 403 | Origin-server denial is commonly responsible. | Inspect origin logs, permissions, ModSecurity, and server deny rules. |
| Several unrelated sites fail | An ISP or broader connectivity issue is possible, but not proven. | Compare networks and ask the ISP; keep ISP filtering separate from a site owner’s Cloudflare policy. |
Finding your public IP without confusing the diagnosis
The address that a website sees may differ from the address shown by a device or local router. Mobile networks, corporate gateways, VPNs, proxies, and carrier-grade NAT can make many people appear under one public address. If the owner asks for your IP, obtain it from a reputable “what is my IP” page or your network administrator and provide the time it was observed. Treat that address as time-sensitive; it may change when you reconnect.
An owner should not assume that every request from the same address is the same person. Shared addresses can trigger reputation, rate, or abuse rules for innocent visitors. The event’s path, user agent, ASN, country, and rule expression provide context that a single IP value cannot.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Troubleshooting common situations
“I see 1020 Access Denied. Can I unblock myself?”
Usually not. A 1020 page means the site’s Cloudflare customer rule denied the request. Send the owner the screenshot and Ray ID and ask for an event review. Repeated refreshes can create more events or trigger rate controls, so stop retrying while the owner investigates.
“The owner says there is no event.”
Confirm the hostname, UTC conversion, Ray ID spelling, and search window. Ask the owner to check whether Security Events data is sampled and to search by visitor IP as well as Ray ID. If the page was unbranded, move the investigation to origin logs and server security modules.
Free tools Windows power users keep installed
One-click scans. No signup required.
“My VPN or mobile connection works, but home broadband does not.”
The change suggests that the two networks present different public IPs or ASNs, but it does not identify the rule. Tell the owner both addresses, their ASNs if known, and the times of the attempts. Do not present a VPN as proof that Cloudflare blocked your original address, and do not use one to evade a site’s access policy without the owner’s permission.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
“The page says 1005.”
Ask the owner to review the ASN restriction. Changing devices on the same provider may not help because the policy can cover the provider’s network range.
“The page says 1009.”
This is a geographic restriction clue. Ask the owner which country or region rule matched and whether the service is intentionally unavailable there. The documented Cloudflare implementation differs by plan, so the owner must inspect the actual rule type.
“I receive a 403 with no Cloudflare logo.”
Give the owner the full response, URL, time, and any server headers they request. Ask them to inspect the origin web server, permissions, ModSecurity, and origin IP deny lists instead of assuming Cloudflare blocked you.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsBest Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
What not to conclude
- A 403 alone does not prove an IP ban.
- A Ray ID proves that Cloudflare handled a request, not that your permanent IP was banned.
- A different result on another network does not identify whether the original cause was IP, ASN, geography, reputation, rate, or an origin rule.
- A missing Security Event is not definitive because event data can be sampled.
- An ISP-level block is separate from a website owner’s Cloudflare rule; Cloudflare cannot restore connectivity that an ISP has filtered.
Or skip the browser setup
If you need a reproducible screenshot of the denial page for the site owner, ScreenshotNeo can capture the URL through one request. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; bot checks, blank pages, timeouts, failed loads, and cache hits are not billed as clean shots. Its response includes X-Page-Verdict and X-Billed headers, which helps you document what happened.
Use the API documentation at https://screenshotneo.com/docs/ for authentication and options. Replace the example URL with the Cloudflare error-page URL you need to document:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. It offers 1,000 screenshots per month free with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account if you want to capture evidence without configuring a browser.
FAQ
Can Cloudflare support remove a block for me?
No. The website owner controls the customer’s Cloudflare rules and must investigate or change them.
Recommended Free Tools
Does a Ray ID reveal my IP address?
No. It identifies the request. The owner can use it with their dashboard records, which may include the visitor IP and other request attributes.
Is an ASN ban the same as an IP ban?
No. Error 1005 points to an Autonomous System Number, which can cover a provider’s network range rather than one address.
Can a site owner allow only my address safely?
Possibly, but an allow rule can bypass other controls. The owner should understand the matched rule and the security consequences before creating an exception.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
