On this page 9 sections
Error 1020 when scraping: does a proxy help?
Error 1020 is Cloudflare's "Access denied" page: a security rule with a Block action and no custom response, set by the site owner, matched the request, and Cloudflare returned HTTP 403 (Cloudflare: Error 1020). A proxy helps sometimes: only when the rule matches your IP, its network (ASN) or its country. When it matches your client, headers or the path, the same scraper gets 1020 on every IP.
If the page opens in your browser on the same IP but your script gets 1020, no proxy helps yet: fix the client first (headers, cookies, a real browser), then compare IPs. And before any of it, check whether the site offers an API or permits automated access: a proxy does not grant permission.
| What you see | The rule matches | Does a proxy help? |
|---|---|---|
| The browser on your IP passes, the scraper fails | Your client: headers, user agent, cookies, bot score | No: fix the client first |
| Datacenter IPs fail everywhere, a residential IP passes | The network (ASN) or IP reputation | Yes: residential proxies |
| Every IP in one country fails, another country passes | The country | Yes, if the site's terms allow access from there |
| Every IP fails at your pace, slower requests pass | The request rate | Partly: slow down, then spread requests. A proxy can also make a challenge worse: Cloudflare says some VPNs or proxies may interfere with Turnstile, so keep one sticky IP for the whole session |
| Only some URLs fail | The path | No: the rule protects that path |
Test it with curl in two minutes
Send the same request with the same client twice, once from your own IP and once through a residential IP, and compare the status codes:
URL="https://example.com/page"
UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0 Safari/537.36"
# 1. From your own IP
curl -s -o /dev/null -w '%{http_code}\n' -A "$UA" "$URL"
# 2. The same request through a ProxyField residential IP in the US
curl -s -o /dev/null -w '%{http_code}\n' -A "$UA" -x gate.proxyfield.io:7000 -U "<login>-country-us:<password>" "$URL"
# 3. Is it Cloudflare, and which Ray ID? Dump the headers and keep the page
curl -s -D - -o block.html -A "$UA" "$URL" | grep -i -E '^(HTTP|server|cf-ray)'
grep -c 1020 block.html # more than 0: the block page names error 1020How to read the result:
| Direct | Through the residential IP | What it means | Next step |
|---|---|---|---|
| 403 | 200 | The rule matches your IP, its network or its country | Use the residential IP; keep the pace modest |
| 403 | 403 | The rule matches the client, the path or the rate, or it also covers that IP | Fix the client (headers, cookies, a browser), then test again; try another -country-<cc> only if the site serves that country |
| 200 | 200 | No block at this pace | Your scraper's own requests differ: compare its headers with the curl ones |
| 403 on one path, 200 on another | Same | A path rule | No proxy helps: that path is protected |
A Cloudflare response carries server: cloudflare and a cf-ray header; the first part of the cf-ray value is the Ray ID that the block page shows and that the site owner searches for. Curl sends no cookies and runs no JavaScript, so a page that needs a challenge solved fails in curl on every IP: test those in a browser. A new IP never makes a request permitted: collect public pages only, and follow the site's terms.
What each Cloudflare access denied code means
Cloudflare documents every code on its 1xxx errors page. The codes on this page are the ones a visitor or a scraper triggers; the others in the 1xxx range are configuration errors on the website's side.
| Code | Cloudflare's title | What the rule looks at | First fix |
|---|---|---|---|
| 1005 | Access Denied: Autonomous System Number (ASN) banned | The network your IP belongs to, often a datacenter or VPN network | An IP from another network, such as a residential one |
| 1006, 1007, 1008, 1106 | Access Denied: Your IP address has been banned | Your IP address | Another IP; ask the owner if the ban is a mistake |
| 1009 | Access Denied: Country or region banned | The country your IP is in | An IP in a country the site serves |
| 1010 | The owner of this website has banned your access based on your browser's signature | Your browser or HTTP client | A real, up-to-date browser and consistent headers |
| 1015 | You are being rate limited | How many requests you sent in a short time | Wait, then send fewer requests |
| 1020 | Access denied (HTTP 403) | Whatever the blocking rule tests: path, header, country, IP, bot score | Change one thing at a time to find the field |
Every Cloudflare error page shows a Ray ID. It doesn't tell you the rule, but the site owner can look it up in Security Events, so keep it when you ask for help.
Error 1020: access denied by a security rule
Error 1020 means a Cloudflare security rule with a Block action matched your request and had no custom response set, so Cloudflare served its "Access denied" page with HTTP 403. According to Cloudflare's 1020 page, requests blocked by WAF custom rules or managed rules get the WAF block page instead, and API Shield's schema validation and JWT validation can also return a 1020. The rule can test almost anything Cloudflare sees about the request, so the page alone doesn't tell you which part to change. Work through it:
- Open the page in a normal browser on the same IP. If it loads, the rule matches your client (headers, user agent, missing cookies or a low bot score); fix your client first.
- Try another network and country. If a different IP passes, the rule matches your IP, its network or its country.
- Slow down. Some sites use a custom rule in place of a rate limit.
- Check the path. Rules often protect only some paths, such as search, login or an API endpoint.
The curl test above runs step 2 from the command line.
A proxy can also make a challenge harder: Cloudflare's challenge troubleshooting notes that some VPNs or proxies may interfere with Turnstile, and its challenges guide says an IP with a poor reputation, often a shared VPN or corporate proxy, may be flagged. If a scraper keeps cookies across pages, keep its IP as well: a ProxyField sticky session holds one IP for 20 minutes by default and up to 36 h (-session-<id>-ttl-<seconds> in the username). Changing the IP never makes a request permitted: collect public pages only, and follow the site's terms. The Cloudflare 403 Forbidden doc walks through the client side (headers, JavaScript challenges and TLS fingerprints).
If you run the site: find the rule behind a 1020
Cloudflare's own fix for site owners, from the 1020 page:
- Get a screenshot of the error from the visitor, with its Ray ID and time.
- In the dashboard, open Security > Analytics > Events and search for the Ray ID or the visitor's IP address.
- Convert the time on the error page, which is in UTC, to your time zone before you search.
- The event shows which security feature and which rule blocked the request; change the rule if the block was a mistake, or set a custom error response for it.
Error 1015: you are being rate limited
1015 means the site's rate limiting rule counted too many requests from you in its window. Cloudflare's advice to visitors is to wait and try again later: "Do not repeatedly try to access the website within a short period of time, as this may extend the block" (Error 1015). The page gives no fixed duration, because the owner sets the window and the block time.
For a scraper: lower concurrency, add random delays, back off after each block, and spread requests over rotating proxies if the rule counts per IP. The same logic as an HTTP 429 applies: see 429 Too Many Requests.
Error 1010: banned browser signature
1010 means Cloudflare's Browser Integrity Check or a rule on the site judged your browser or client to be a known bad or automated one. Typical triggers are an HTTP library's default user agent, a missing or contradictory set of headers, and old browsers. Use a current browser; for scrapers, send a full, consistent header set or use a real browser through Playwright or Puppeteer. A new IP doesn't change your signature.
Errors 1005, 1006 and 1009: network, IP and country bans
These three look only at the address you come from:
- 1005 (ASN banned): the owner banned the whole network. Datacenter and VPN networks are the usual targets, so your home connection may pass where a server doesn't.
- 1006 to 1008 and 1106 (IP banned): the owner banned your IP. On a shared connection, such as an office, a mobile carrier or a VPN, someone else's activity may have caused it.
- 1009 (country or region banned): the site doesn't serve your country.
A residential IP from a country the site serves may clear 1005 and 1009; a new IP may clear 1006. ProxyField targets country, region and city (US: all 50 states), and the locations index lists the countries. Before you route around a country ban, read the site's terms: a site that chooses not to serve a country may also forbid access from it.
Access denied as a visitor, not a scraper
If you see a Cloudflare access denied page while browsing:
- Turn off your VPN, proxy or proxy extension and reload: shared VPN networks are often banned by ASN.
- Update your browser and pause extensions that change headers or block scripts.
- For 1015, wait several minutes before you reload.
- Still blocked? Contact the site owner with the Ray ID and the time; only they can change the rule.
Why Cloudflare flags a browser in the first place is covered in why Cloudflare thinks you are a bot.
Which access denied errors a proxy can fix
| Code | Does a proxy help? | Why |
|---|---|---|
| 1005 | Often | A residential or mobile IP is on another network |
| 1006 to 1008 | Yes, for that IP | A new IP is not on the ban list |
| 1009 | Yes, if the site serves another country you can use | Country targeting chooses the country |
| 1010 | No | The rule checks your client, not your IP |
| 1015 | Partly | Rotation spreads requests if the limit counts IPs; you still need a slower rate |
| 1020 | Sometimes | Only if the rule matches IP, network or country; never for a client or path rule |
The codes outside this range (52x origin errors, 1000-series DNS errors) are in Cloudflare error codes explained.
Cloudflare Access Denied Errors FAQ
What does Cloudflare error 1020 mean when scraping, and do proxies help?
ProxyField residential proxies cover 195+ countries, and they help with error 1020 only sometimes: 1020 is Cloudflare's "Access denied" page, sent with HTTP 403 when a security rule with a Block action, set by the site owner, matched your request. A new IP clears it only if that rule matches your IP, network or country. Test the page in a normal browser on the same IP: if it passes there, fix your scraper's headers and client, because no proxy will change the result.
What is Cloudflare error 1015?
"You are being rate limited": a rate limiting rule on the site counted too many requests from you in a short time. Wait, then send fewer requests.
How long does Cloudflare error 1015 last?
As long as the site owner's rule says: the owner sets both the counting window and the block time, so Cloudflare publishes no fixed duration. Retrying during the block can extend it, so wait several minutes before you try again.
What is the difference between 429 and Cloudflare error 1015?
Both mean "too many requests". A 429 is the standard HTTP status any server can send; 1015 is Cloudflare's page for a rate limiting rule that a site owner set in Cloudflare.
How do I fix Cloudflare error 1015?
Stop sending requests for a while, then come back at a lower rate with random delays and back-off. If you run a scraper, spread the requests over rotating IPs only if the limit counts per IP.
What is Cloudflare error 1010?
The site banned your access based on your browser's signature: Cloudflare judged your browser or HTTP client to be automated or known bad. Use a current browser, or send consistent browser headers; a new IP won't fix it.
What is Cloudflare error 1005, and how do I fix it?
The site owner banned the network (ASN) your IP belongs to, typically a datacenter or VPN network. Connect from another network, such as your home connection or a residential proxy.
What is Cloudflare error 1009, and how do I fix it?
The site doesn't serve the country or region your IP is in. Use a connection in a country the site serves, and check the site's terms first, since a country ban may be deliberate.
How do I fix Cloudflare error 1020?
Find what the rule matches by changing one thing at a time: browser, IP, country, request rate and the page path. If nothing you may legitimately change works, send the Ray ID to the site owner.
How can I test whether a proxy fixes Cloudflare error 1020?
Send the same curl request with the same User-Agent twice: once from your own IP and once through a residential proxy, such as -x gate.proxyfield.io:7000 -U "<login>-country-us:<password>", and print only the status code with -w '%{http_code}'. 403 direct and 200 through the residential IP means the rule matches your IP, network or country; 403 on both means it matches your client, the path or the rate, so fix those first.
Show 6 more questionsShow fewer questions
How does a site owner find which rule caused a Cloudflare 1020?
Search Security > Analytics > Events in the Cloudflare dashboard for the Ray ID or the visitor's IP, after converting the error page's UTC time to your time zone. The event names the security feature and the rule that blocked the request, so you can change it or give it a custom error response.
Why do I get Cloudflare access denied when I use a VPN?
VPN servers share a few networks and IPs among many users, so site owners often ban them by ASN (1005) or IP (1006 to 1008), and a VPN IP with a poor reputation is more likely to be flagged. Turn the VPN off and reload; if the page opens, the rule matched the VPN's network, not you.
Is Cloudflare error 1020 an IP ban?
Not always. A 1020 can match your IP, but also your user agent, headers, country, bot score or the path you requested; the IP-ban pages are 1006 to 1008.
Will a VPN or proxy fix Cloudflare error 1015?
Only partly. A new IP starts with a fresh count if the rule limits per IP, but sending at the same pace triggers it again; slow down as well.
Are Cloudflare 1005, 1010 and 1015 HTTP status codes?
No. They are Cloudflare's own error numbers shown on the block page; the HTTP status underneath is 403 for 1020, as Cloudflare's 1020 page states; the 1015 page itself names no status code.
How should automation handle Cloudflare access denied errors?
Detect the block page, stop sending to that site and log the code and Ray ID. Back off for 1015, fix the client for 1010, and change the IP only for 1005, 1006 and 1009.