A Cloudflare-branded denial page, a specific error code, and a Ray ID are the strongest clues that Cloudflare—not simply the website’s own server—rejected your request. A plain HTTP 403 does not prove that Cloudflare blocked your IP. Cloudflare and the origin server can both return 403 responses, so the website owner must confirm the cause in Cloudflare Security Events or origin logs.
Check the denial page first
- Read the entire page. Note whether it shows Cloudflare branding, the exact error number, the Ray ID, displayed time, and the site you requested. Save a screenshot.
- Record when it happened. Include the time zone. The owner will compare your time with Cloudflare’s UTC event time.
- Do not diagnose from “403 Forbidden” alone. An unbranded 403 commonly comes from the origin web server, which may be enforcing file permissions, ModSecurity, or its own IP-deny rule.
A Ray ID identifies the request. It may appear on the page, in browser developer tools, or in the cf-ray response header. It gives the site operator a way to search for the request, although Security Events can contain sampled data, so a missing result is not conclusive.
What the Cloudflare error codes indicate
Codes narrow the likely cause, but the owner still needs to inspect the matching event and action.
| Code | Likely restriction | What it means |
|---|---|---|
| 1020 | Firewall or custom security rule | A Cloudflare customer rule denied the request. |
| 1006, 1007, 1008, 1106 | Client IP ban | The customer’s configuration banned the requesting IP address. |
| 1005 | ASN ban | The restriction targets an Autonomous System Number, not necessarily one individual IP. |
| 1009 | Country or region restriction | The customer’s geographic policy denied the request. |
| 429 or an error associated with rate limiting | Request or traffic threshold | The response may reflect rate limiting or another security control rather than a permanent IP ban. |
Cloudflare security features can also challenge or deny traffic without implying that a person is permanently banned. A branded 403 therefore proves a Cloudflare security decision more reliably than it proves a permanent IP block.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
How to find your Cloudflare Ray ID
On the block page
Look near the bottom of the Cloudflare error page for a label such as “Ray ID,” followed by a hexadecimal-looking value. Capture the full value exactly, including letters, numbers, and any punctuation.
In browser developer tools
- Open developer tools (usually F12 or Ctrl+Shift+I).
- Open the Network tab and reload the page.
- Select the failed document request and inspect Response Headers.
- Look for
cf-ray. Copy its value and record the request time.
Do not post the Ray ID as proof that you personally were banned. It is an identifier for the request that helps the operator investigate.
Ask the website owner to verify the block
Visitors generally cannot remove a Cloudflare customer’s rule. Send the operator:
- The screenshot of the complete error page.
- The Ray ID.
- The approximate time and time zone.
- The URL you requested.
- What you were doing immediately beforehand (opening a page, submitting a form, using an API, or refreshing repeatedly).
- Your public IP address only if the owner asks for it through a trusted support channel.
Ask the owner to search Cloudflare Security > Analytics > Events (the dashboard labels can change) by Ray ID or visitor IP, then report the matched rule and action. For some workflows the relevant area is shown as Security > Events. The owner should also convert the event’s UTC timestamp when comparing it with your local time.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Cloudflare’s visitor guidance is to contact the website owner; Cloudflare support cannot override that customer’s security settings. The owner may need to inspect WAF custom rules, IP Access rules, rate limiting, bot controls, or other security products before changing anything.
How owners confirm what happened
Search the event, then identify the rule
- Open the site’s Cloudflare dashboard and the Security Events view.
- Search with the Ray ID and a narrow time window; if appropriate, search the visitor IP as well.
- Open the matching event and note the action (block, challenge, or another outcome), product, country, ASN, and rule expression.
- Compare the event with the site’s IP Access rules, WAF custom rules, rate limits, and bot or managed-security settings.
- Check origin logs if Cloudflare has no matching event or the page was an unbranded 403.
Cloudflare IP Access rules can allow, block, or challenge by IP address, ASN, or country. WAF custom rules and other features can do the same. The operator should identify the actual matched rule before changing policy. A blanket allowlist can bypass multiple controls and is not a safe default.
When a search finds nothing
Security Events may be sampled. Narrow the time range, try the Ray ID and IP separately, and check Log Explorer or other available logs. A missing event does not prove that no security control acted; it does mean the owner should investigate the origin and network path as well.
Separate Cloudflare blocking from other causes
Only one site fails
If unrelated websites work and one Cloudflare-protected site shows a branded denial, focus on that site’s rules. The documented denial codes describe restrictions configured by that site’s owner.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Several unrelated sites fail
Multiple failures can indicate an ISP-level block, a connectivity problem, a misconfigured VPN or proxy, DNS trouble, or another network issue. This pattern does not prove that every site owner blocked your IP. Cloudflare cannot restore connectivity when an ISP blocks an address on Cloudflare’s shared network.
The response is an unbranded 403
Treat the origin as a leading possibility. Ask the operator to check web-server permissions, ModSecurity, application rules, and origin IP-deny lists in addition to Cloudflare.
The page asks for a challenge
A challenge or an automated-traffic response is not identical to a permanent ban. Rate limits and bot controls can temporarily restrict requests. The owner should inspect the event’s action and duration rather than assuming the address is permanently blocked.
Practical checks that do not prove a block
- Try the same URL in a normal browser session with extensions disabled, then restore extensions one at a time. This can reveal an extension conflict, but it cannot identify the owner’s rule.
- Stop rapid refreshes, scripted retries, or parallel requests while troubleshooting; they can trigger rate limits.
- Test from a different legitimate network only to establish scope. A different result suggests a network- or IP-specific condition, not which rule caused it.
- Do not assume a VPN, router reset, or security utility will reverse a customer-configured Cloudflare rule. Only the site operator can change that policy.
Or skip the browser setup
If your goal is to capture the page for the owner rather than interact with the block manually, ScreenshotNeo provides a one-request website screenshot API. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and the response identifies the result with X-Page-Verdict and X-Billed headers. An MCP server supplies take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSee the ScreenshotNeo documentation for authentication and options. This cURL request captures a page as WebP:
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo supports full-page and element captures, device presets or custom viewports, dark mode, retina scale, PDFs, custom CSS and JavaScript, clicks, waits, blocked resources, headers, cookies, user agents, authorization, timezone, geolocation, transparent backgrounds, resizing, TTL caching, signed links, asynchronous webhooks, bulk capture of up to 100 URLs per call, usage reporting, and an OpenAPI specification. The free plan includes 1,000 screenshots per month without a card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting checklist
| Symptom | Likely explanation | Next action |
|---|---|---|
| Cloudflare page with 1020 and Ray ID | Customer firewall rule | Send the Ray ID and screenshot; ask the owner to inspect Security Events. |
| 1005 | ASN restriction | Ask whether the ASN rule, rather than one IP, matched. |
| 1006–1008 or 1106 | Client-IP ban | Have the owner verify the requesting address and matched rule. |
| 1009 | Geographic restriction | Ask the owner to check country logic; Enterprise IP Access rules and WAF custom rules have different availability. |
| Plain 403, no branding | Likely origin denial | Have the operator inspect origin permissions, ModSecurity, and server logs. |
| Different sites fail | Possible ISP or connectivity issue | Compare networks and contact the ISP if the owner finds no event. |
FAQ
Can I prove a Cloudflare IP block without contacting the owner?
No. Page branding, a code, and a Ray ID are useful evidence, but owner-side event and rule data are needed to establish what acted on the request.
Does changing my IP always fix a 1020 error?
No. A rule may target an ASN, country, request characteristics, or another signal, and changing addresses can also violate a site’s access policy. Ask the operator to identify the matched rule.
Recommended Free Tools
How long should I wait before trying again?
There is no universal waiting period. The event may be a temporary challenge, rate limit, or an explicitly configured block. The owner can determine its duration from the relevant rule and event.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Frequently Asked Questions
Can I prove a Cloudflare IP block without contacting the owner?
No. Page branding, a code, and a Ray ID are useful evidence, but owner-side event and rule data are needed to establish what acted on the request.
Does changing my IP always fix a 1020 error?
No. A rule may target an ASN, country, request characteristics, or another signal, and changing addresses can also violate a site’s access policy. Ask the operator to identify the matched rule.
How long should I wait before trying again?
There is no universal waiting period. The event may be a temporary challenge, rate limit, or an explicitly configured block. The owner can determine its duration from the relevant rule and event.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
