---
title: "Cloudflare Error 1020: causes and how to fix it"
description: "A Cloudflare WAF or firewall rule blocked the request. The origin never received it. The Security Events log names the exact rule that fired."
canonical: "https://lemwatch.com/errors/cloudflare-1020"
source: "https://lemwatch.com"
---

# Cloudflare Error 1020: Access denied by a firewall rule

> A Cloudflare WAF or firewall rule blocked the request. The origin never received it. The Security Events log names the exact rule that fired.

## Short answer

 A Cloudflare WAF or firewall rule blocked the request. The origin never received it. The Security Events log names the exact rule that fired.

## What Cloudflare Error 1020 means

 1020 is a deliberate block, not a failure. Something in the request matched a rule: country, IP, user agent, path, or a managed WAF signature.

## Causes and fixes, most likely first

- A custom firewall rule is broader than intended. Open Security → Events, find the blocked request, and read which rule matched. Narrow the rule to the traffic it was meant to stop.
- A managed WAF rule flagged legitimate traffic as an attack pattern. Create an exception for that rule on the affected path rather than disabling the whole managed ruleset.
- Bot Fight Mode is blocking a legitimate integration or crawler. Allowlist the integration by user agent or IP, or turn off Bot Fight Mode on API paths where it does more harm than good.

## How to stop it happening again

- Review Security Events after every WAF change — a broad rule looks identical to a traffic drop in analytics.
- Test API and integration paths explicitly after enabling bot protection.

## Check your own domain

 An external probe from a different network and user agent shows whether the block is universal or targeted at particular clients.

## Frequently asked questions

### Why am I blocked from my own site?

 Your IP, country, or user agent matched a rule. The Security Events log names the rule; add an exception for yourself or narrow the rule.


## Related

- [All website error codes](https://lemwatch.com/errors)
- [Cloudflare Error 1015](https://lemwatch.com/errors/cloudflare-1015)
- [Cloudflare Error 520](https://lemwatch.com/errors/cloudflare-520)
- [HTTP 403](https://lemwatch.com/http-status-codes/403)
- [Free Uptime & response check](https://lemwatch.com/tools/website-uptime)
- [All monitoring checks](https://lemwatch.com/features)