Direct Answer
Cloudflare error 1020 ("Access denied") means a website's own firewall (WAF) rule blocked your request at Cloudflare's edge. Unlike error 1015, it is not a rate limit — it is a deliberate access rule the site owner configured, triggered by things like IP reputation, country or network, request signature, or a protected path. The fix is to send clean, consistent requests from a trustworthy IP, respect the site's rules, and contact the operator when your access is legitimate.
What Is Cloudflare Error 1020?
Error 1020 is the code Cloudflare returns when a site's Web Application Firewall (WAF) has a rule that matched your request and blocked it. The page reads "Access denied" and tells you the site owner "may have banned your IP address or blocked your access." It is generated at Cloudflare's edge, before your request ever reaches the website's own servers.
The single most important thing to understand: 1020 is the site owner's decision, not Cloudflare's. Cloudflare simply enforces the rule the operator wrote. That is why the same request sails through on one site and returns 1020 on another — the difference is the firewall configuration, not your traffic volume.
This makes 1020 fundamentally different from a rate limit:
- It is rule-based, not counter-based. Nothing "resets" after a cooldown. The rule keeps matching until the reason it matched changes.
- It is a judgement about the request, not about how fast you sent requests. IP, headers, path, country, and network all feed into it.
- It is intentional. A human configured a WAF rule to keep certain traffic out. Respecting that intent is part of the fix.
Why Am I Seeing Error 1020?
A WAF rule can match on many signals. A 1020 usually comes from one of these:
- IP reputation. If your IP sits in a range with a history of abuse — many datacenter and cheap proxy ranges do — a WAF often blocks it outright. See what is IP reputation and why datacenter proxies get blocked.
- Country or network (ASN) rules. Some sites allow only certain countries, or block whole hosting-provider networks. If you are routing through a network the operator has excluded, every request is denied regardless of how careful you are.
- A suspicious request signature. Missing or inconsistent headers, an empty or automation-flavoured user agent, or a request that does not look like a real browser session can all trip a rule. This is one way sites detect proxies and automation.
- A protected or non-public path. Admin panels, internal APIs, and login or checkout endpoints frequently carry stricter WAF rules. A 1020 here often means the content simply is not meant for public access.
- A managed WAF ruleset. Cloudflare offers off-the-shelf rulesets (for known bad bots, common exploit patterns, and so on). Your request may match one of these even if the operator never wrote a custom rule.
In short: 1020 is the firewall telling you this request, from this source, is not allowed here. The fix depends on which of those signals matched.
How to Fix Cloudflare Error 1020
Because 1020 is a firewall decision rather than a speed limit, "wait it out" does not work. The right responses split by who you are.
If you are a regular visitor
- Confirm you are on the real site. A stray URL, a broken redirect, or an outdated bookmark can land you on a path the WAF protects. Navigate from the site's homepage instead.
- Disable a misbehaving extension or VPN. Some browser extensions inject headers or fire background requests, and shared VPN exit IPs often carry poor reputation. Turning them off can clear a 1020 that was caused by how you were connecting.
- Try a different, clean connection. If your current network's IP has a bad reputation — common on public Wi-Fi or overloaded shared connections — a normal home or mobile connection may not match the rule.
- Contact the site owner. If you keep hitting 1020 on content you should be able to reach, the operator is the only one who can review or adjust the rule. Cloudflare itself points blocked users back to the site owner — this is the intended escalation path.
If you run scripts or automated requests
- Confirm the content is public. A 1020 on a login, admin, or internal endpoint is a clear signal the content is not meant for automated access. Do not try to work around a rule that is protecting private data.
- Send clean, consistent requests. Use a normal, current user agent, send the headers a real browser sends, keep them consistent across a session, and avoid anything that reads as an automation tell. Many 1020s are really "this request did not look like a genuine client."
- Use an IP with good reputation. If your IP range is known for abuse, no header tuning will help — the rule matches on the IP itself. Requests from real, high-reputation consumer IPs are far less likely to match a reputation-based rule. See mobile vs residential vs datacenter proxies.
- Respect
robots.txtand the terms. If a path is disallowed, treat the 1020 as confirmation and stay out. Many sites publish an official API — using it removes the need to touch the protected HTML at all. - Do not brute-force the rule. Retrying the identical blocked request, or cycling through low-quality IPs to find one the rule misses, is the wrong response — and a site can escalate to a harder block when it sees the pattern. If access is legitimate, ask.
- Contact the operator for legitimate access. For genuine research or integration needs, reaching out to the site owner (or requesting API access) is the durable fix. Only they can change a WAF rule.
None of these steps "beat" the firewall. They make your request look like the honest, legitimate client it is, from a trustworthy IP — which is exactly what a WAF rule is trying to distinguish from abuse.
Error 1020 vs. Other Cloudflare Codes
Knowing which Cloudflare code you have tells you what to do. 1020 is a firewall block; the others below are different situations with different fixes.
| Code | Message | What it means | Typical fix |
|---|---|---|---|
| 1020 | Access denied | A firewall (WAF) rule blocked the request | Send clean requests from a good-reputation IP; check the content is public; contact the owner |
| 1015 | You are being rate limited | Your IP exceeded a per-IP request limit | Slow down, wait out the cooldown, pace requests |
| 429 | Too Many Requests | The HTTP status that usually accompanies a rate limit | Honor Retry-After, back off, reduce rate |
| 1006 / 1007 / 1008 | Access denied — your IP is banned | The site explicitly banned the IP or its range | Contact the site owner; the block is deliberate |
| 1010 | Access denied — browser signature banned | The client's browser signature was blocked | Use a genuine, current browser; contact the owner |
If you see 1015 or 429, the problem is your request rate and the fix is pacing — see fix Cloudflare error 1015 and fix 429 Too Many Requests. If you see 1020, 1006–1008, or 1010, the problem is a deliberate access rule. Rotating IPs or slowing down will not address the operator's decision — cleaning up your request and, where access is legitimate, contacting the owner will.
How a Clean German Mobile IP Fits In
A large share of 1020 blocks come down to one thing: the request arrived from an IP or network the firewall does not trust. Datacenter ranges and cheap proxy pools are widely catalogued and often blocked wholesale, so an otherwise-perfect request still gets an "access denied" purely because of where it came from.
Real mobile IPs read very differently. Because of CGNAT, a single mobile IP is shared by thousands of genuine subscribers, so it looks like ordinary consumer traffic and carries high IP reputation. For legitimate work — accessing public data you are allowed to reach — a clean, dedicated German mobile endpoint means your request is not blocked on IP reputation before its own merits are even considered.
Two caveats, stated plainly:
- A good IP is not a key to private content. If a 1020 is protecting a login, an admin panel, or a path
robots.txtdisallows, the answer is not a different IP — it is to stay out or ask for access. IP reputation only helps where access is legitimate in the first place. - A clean IP does not defeat a firewall. It removes one common, unfair reason for a block (bad-range reputation) so that honest, well-formed requests are treated on their merits. Pair it with clean headers, respect for each site's terms, and the law — see whether scraping is legal in Europe and are mobile proxies legal.
GermanProxy.io provides dedicated and shared German 5G mobile endpoints (Blue and Red Premium Mobile Network), HTTP and SOCKS5, with fair-use 20 GB/day per connection — built for legitimate, well-behaved access to public data, not for working around a site's firewall rules.
FAQ
What does Cloudflare error 1020 mean?
Error 1020 is Cloudflare's "Access denied" message. It means the site owner has a firewall (WAF) rule that matched your request and blocked it at Cloudflare's edge, before it reached the site. Unlike a rate limit, 1020 is a deliberate rule about who or what is allowed in — based on things like IP reputation, country, network, request headers, or the path you asked for.
How is error 1020 different from error 1015?
Error 1015 is a temporary, time-based rate limit that clears on its own once you slow down. Error 1020 is a firewall rule — it does not "expire" after a cooldown, because it is a decision about the request itself, not your request volume. Sending the same request from the same IP will keep returning 1020 until the underlying reason changes. See fix Cloudflare error 1015 for the rate-limit case.
How do I fix Cloudflare error 1020?
First confirm the content is meant to be public. Then send clean, consistent requests — proper headers, a normal user agent, no leaking automation tells — from an IP with good reputation. Respect robots.txt and the site's terms. If the block persists on content you have a legitimate reason to reach, contact the site owner; only they can adjust the rule.
CTA
Getting an "access denied" 1020 because your datacenter IP is on a blocklist, not because the content is private? Our German 5G mobile proxies give you real, high-reputation mobile IPs for legitimate access to public data — browse the plans or see how to test your setup.
Get a German mobile proxy: Real 4G/5G IPs from Germany, fair-use 20 GB/day — browse German mobile proxy plans or start small with a shared 5G proxy.