Cloudflare Error 1020: Access denied by a firewall rule
Also searched as: error 1020 · 1020 access denied · access denied cloudflare
Is Cloudflare Error 1020 happening on your domain?
An external probe from a different network and user agent shows whether the block is universal or targeted at particular clients.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
A Cloudflare WAF or firewall rule blocked the request. The origin never received it. The Security Events log names the exact rule that fired.
What Cloudflare Error 1020 means
1020 is a deliberate block, not a failure. Something in the request matched a rule: country, IP, user agent, path, or a managed WAF signature.
Causes and fixes, most likely first
A custom firewall rule is broader than intended.
Open Security → Events, find the blocked request, and read which rule matched. Narrow the rule to the traffic it was meant to stop.
A managed WAF rule flagged legitimate traffic as an attack pattern.
Create an exception for that rule on the affected path rather than disabling the whole managed ruleset.
Bot Fight Mode is blocking a legitimate integration or crawler.
Allowlist the integration by user agent or IP, or turn off Bot Fight Mode on API paths where it does more harm than good.
How to stop it happening again
- •Review Security Events after every WAF change — a broad rule looks identical to a traffic drop in analytics.
- •Test API and integration paths explicitly after enabling bot protection.
Frequently asked questions
Why am I blocked from my own site?
Your IP, country, or user agent matched a rule. The Security Events log names the rule; add an exception for yourself or narrow the rule.