Cloudflare Error 1020 means a Cloudflare firewall rule denied access to the website. If you are a visitor, save a screenshot showing the Ray ID and timestamp, then send it to the website owner. If you own the site, use that Ray ID (or the client IP) and the event time to find the matching record in Security > Analytics > Events, determine why the request was blocked, and make the narrowest rule or IP Access change that resolves the verified cause.
This is not normally a diagnosis of a broken browser or computer. The visitor and the site owner have different jobs, so the correct fix depends on which side of the block you control.
What Error 1020 means
Cloudflare’s dedicated guidance describes the message as “Error 1020: Access denied” and says it indicates that access to the website was denied by a Cloudflare firewall rule. The common case is a client or browser blocked by rules configured by the Cloudflare customer (the website owner). See Cloudflare’s Error 1020 documentation (updated August 3, 2026).
The error page itself usually does not explain which rule condition matched. The owner must inspect the corresponding security event to identify the request attribute, rule, or access control that caused the denial. A custom error page can change the default presentation, so not every 1020 page will look identical.
Recommended Free Tools
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
1020 is a Cloudflare 1xxx error, not simply an HTTP 403
Cloudflare places 1020 in its 1xxx error family. These errors are represented in the HTML response body, whereas ordinary HTTP errors such as 403 and 429 are returned in the HTTP status header. That distinction matters when you inspect a response programmatically: do not assume every page containing “1020” is an ordinary origin-server 403. Cloudflare explains the difference in its 1xxx errors reference (updated April 23, 2026).
If you are the blocked visitor
You cannot edit the website’s Cloudflare firewall. Your useful contribution is evidence that lets the owner locate the exact event.
- Capture the complete error page. Include the Error 1020 text, Ray ID, timestamp, and any other diagnostic details shown. Make sure the screenshot is readable rather than a cropped image of only the headline.
- Send it to the website owner or support contact. Use the site’s published support address, contact form, or another legitimate channel. Explain the URL you tried to open and the approximate time, including the timezone if you know it.
- Wait for the owner’s investigation or use another legitimate contact route. Only the owner controls the site’s Cloudflare rules. Cloudflare’s documented visitor resolution is to provide the owner with the screenshot.
Clearing cookies, changing browsers, disabling security software, or connecting through a VPN are not documented fixes for Error 1020 on Cloudflare’s official page. They may change a request, but you should not present any of them as a guaranteed or official remedy. Do not ask Cloudflare Support to change a third-party site for you; Cloudflare states that only the website owner can request technical support.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
If you own the website
Use the visitor’s screenshot as an index into Cloudflare’s event data. Avoid disabling all firewall protection: first establish what matched and then make a targeted correction.
- Obtain the diagnostic details. Ask for the screenshot if the visitor did not provide one. Record the Ray ID, client IP (if displayed), requested URL, and timestamp exactly as shown.
- Open the event log. In the Cloudflare dashboard, go to Security > Analytics > Events. Cloudflare’s documentation refers to this as the Security Events log.
- Search by Ray ID or client IP. Use the Ray ID first when available; otherwise search for the visitor’s client IP. Restrict the search to the relevant time window.
- Account for UTC. Convert the timestamp shown on the error page to the timezone used by the dashboard. Preserve the original UTC value and its timezone when communicating with the visitor so you do not investigate the wrong minute.
- Assess the matching event. Read the rule action and the request details that caused the match. Decide whether this was an intended block, a false positive, an overly broad expression, or an IP access decision that no longer fits your policy.
- Apply the narrowest correction. Update the relevant Firewall Rule, or allow the visitor’s IP in IP Access Rules when that is the appropriate result of your investigation. Keep the rest of your protections active.
- Retest. Ask the visitor to try again and verify that the intended security controls still operate for other traffic. If the event cannot be located or the documented steps do not resolve the issue, consult Cloudflare’s general 1xxx guidance and contact Cloudflare Support as the site owner.
Choosing between a rule change and an IP allow
| Finding in Security Events | Reasonable next action | What to avoid |
|---|---|---|
| A rule expression is broader than intended and matches legitimate requests | Refine or update that specific Firewall Rule | Turning off every firewall rule |
| The request is legitimate and the visitor’s address should be trusted under your policy | Add a narrowly scoped IP Access Rule for that address or range | Allowing large, unrelated address ranges without review |
| The block is intentional | Explain the policy to the visitor or leave the control in place | Making an exception solely because a screenshot was supplied |
| No matching event appears | Recheck Ray ID, client IP, URL, and UTC conversion; then seek owner-level Cloudflare support if needed | Guessing which rule fired |
Troubleshooting checklist
The visitor did not include a Ray ID
Request a new screenshot or a copy of all text on the error page. Search with the client IP and a tightly bounded time range. If neither identifier is available, the event may be difficult to distinguish from other traffic.
The event search returns nothing
- Confirm that you searched Security > Analytics > Events, not an unrelated analytics report.
- Check whether the timestamp was converted from UTC correctly.
- Check for transcription errors in the Ray ID or IP address.
- Use the visitor’s URL and a narrow time window to reduce unrelated results.
The visitor is still blocked after an allow
Verify that the allow applies to the same IP the event recorded and that the request is not being denied by a different rule. Reopen the event after the change rather than assuming the first rule was the only control involved. Scope exceptions as narrowly as your access policy permits.
Rank #3
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
The page looks different from Cloudflare’s standard page
Cloudflare permits custom error pages. Confirm the diagnostic text and identifiers instead of relying on visual appearance alone. A page styled by the site can still represent a 1xxx error, while an ordinary origin response may use a different status header.
Is this a server outage?
Error 1020 specifically indicates a firewall access denial. It does not by itself establish that the origin server is down. Cloudflare documents 5xx responses separately in its 5xx errors reference (updated June 5, 2026).
How to document and prevent repeat false positives
- Keep the visitor’s screenshot, Ray ID, URL, and original UTC timestamp together in the incident record.
- Record which rule or IP Access entry matched and why the final change was safe.
- Prefer precise conditions over broad blocks when updating expressions.
- Review exceptions periodically so a temporary allow does not become forgotten permanent access.
- When support is required, have the owner contact Cloudflare; a visitor cannot open the technical case on the owner’s behalf.
Or skip the browser setup
If your goal is to capture the page for an incident record, ScreenshotNeo can return a screenshot or PDF with one request. It accepts cookie and consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and the response identifies the result with X-Page-Verdict and X-Billed headers. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
For request parameters and the OpenAPI description, see the ScreenshotNeo documentation. Replace the target URL with the page you are documenting.
Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
- 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
- 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Error 1020 does—and does not—tell you
- It tells you that Cloudflare denied access through a firewall control.
- It does not name the matching rule in the visitor-facing message.
- It does not prove that the visitor’s device, browser, or internet connection is defective.
- It does not authorize a visitor to change the site’s security configuration.
- It gives the owner an investigation starting point when the Ray ID, client IP, and UTC time are preserved.
Frequently Asked Questions
Can a visitor remove Error 1020 without the website owner?
No. The visitor can document the page and send its identifiers to the owner, but only the owner controls the Cloudflare firewall and IP Access rules.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where should a site owner look first?
Open Cloudflare’s Security > Analytics > Events log and search for the Ray ID or client IP, using the error page’s UTC timestamp.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Should I disable Cloudflare firewall rules to fix 1020?
No. Identify the matching event first, then update the specific rule or add a narrowly scoped IP Access exception when justified.
Why does a 1020 page not behave like a normal 403 response?
Cloudflare classifies 1020 as a 1xxx error represented in the HTML body, while ordinary HTTP errors such as 403 are returned in the response status header.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
